ENGINEERING EVIDENCE · FIRST PILOT
Results from the first Lira pilot
Anonymized measurements from the first Lira pilot. They demonstrate real operating load without exposing customers, hosts, accounts or source addresses.
Rolling 30-day period; cumulative blocks shown separately
First Lira pilot only
Data generated: 2026-10-12 20:32 UTC
Latest cached snapshot — generated 2026-10-12 20:32 UTC.
Geography of blocked sources
Country is derived from the network source address. It describes routing geography and does not attribute a person, organization or attacker.
27 source countries were observed in total. 12 meet the publication threshold of at least 3 unique blocked sources and are shown below.
ID20
GB12
LT12
NL8
US8
PL6
FR4
HK4
UA4
BG3
FI3
SG3
There is not enough aggregated data to publish country distribution.
Publication safeguards
- No IP addresses, hostnames, usernames or customer names
- No per-customer or per-server breakdown
- Five-minute cached aggregate instead of database access from the browser
- Timestamp and reporting period displayed with every snapshot
How the figures are calculated
- The reporting scope is explicitly limited to the first Lira pilot; partner and customer environments are excluded.
- Authentication events are counted as Windows records received during the rolling period. One connection may produce more than one event.
- A blocking decision is a recorded Lira decision with an application time. Unique sources are deduplicated by source address but addresses are never published.
- Authorized sign-ins include successful RDP network and interactive logon records. They demonstrate operational load and are not interpreted as security incidents.
- Country rows are published only when at least three unique blocked sources are present. LAN and unknown locations are excluded.
What these measurements prove
The figures show that Lira processed sustained authentication and blocking workloads during its first pilot. They are operational evidence, not an independent audit, certification or claim that every failed event was a confirmed attack.