S·02 · Perimeter Security & Response

Coherent command for critical sites.

Bases, plants, ports, airports — high-value perimeters under coordinated air, ground and access threats. MESH OS fuses the existing fleet of perimeter sensors, badge readers, LPRs and C-UAS feeds into one shell, so the SOC sees one incident, not eight alerts.

90s
Detect → cited response
87%
False alarm reduction
1
Operator per zone
4×
Concurrent vector resolution
The problem

Sensors fire. The SOC drowns.

Critical-site SOCs run a stack of point products that do not share state. Threats come in coordinated waves — the operator must guess at correlation in real time.

P · 01

Eight tools. One incident.

Perimeter intrusion, drone, badge, LPR, video — each on its own pane. Operator triages between tools while threat is in motion.

P · 02

Air and ground correlate manually.

A drone overflight that pre-stages a fence breach reads as two unrelated alerts. Correlation lives in the operator's head, or not at all.

P · 03

ROE buried in PDF.

Engagement matrix lives in a binder. Under stress, dispatch defaults to the loudest channel — radio — and the audit trail goes with it.

P · 04

Drills don't survive contact.

Tabletop response and live response diverge. The shell that worked in exercise was a different shell from the one in the SOC at 3 AM.

The incident · Abqaiq

14-Sep-2019 vector, recompiled.

A composite drawn from the documented Abqaiq attack profile and adjacent industry incidents — drone overflight pre-staging a ground intrusion attempt against the same crude stabilization sector.

REC · 0314:00 LT · ABQAIQ · GROUND + AIR
10 events · 9m elapsed · zero process upset
0314:00rfRF anomaly · 2.4GHz signature, bearing 312°detect
0314:18rdrRadar-N correlates · low-SNR, small UASfuse
0315:02ctrStab-3 airspace incursion · alt 120mdetect
0316:11fenceFence sensor F-08 · perimeter contact NWdetect
0316:30cmdCoordinated threat 0.91. Air + grounddecide
0316:55histPattern match · Abqaiq 14-Sep-2019prior
0317:42opAir effector authorized. Ground QRF dispatchedact
0318:30airUAS jammed at 2.1 km, recovered intactact
0320:14grdQRF on F-08 · 2 detainedact
0323:00aarBoth vectors closed. Crude flow nominalclose
The shift

Same fleet. Different layer.

MESH OS does not replace your perimeter sensors, your C-UAS layer, or your access control. It replaces the layer between them and the SOC seat — and what the SOC operator sees while they decide.

Before · Legacy

Eight panes. One operator.

  • Perimeter, C-UAS, badge, LPR each on its own console.
  • Air and ground threats correlate in the operator's head.
  • ROE binder beside the keyboard.
  • Dispatch over radio, off-system.
  • Cloud picture freezes when uplink drops.
  • Per-vendor audit trail. No unified record.
After · MESH OS

One shell. One incident. One decision.

  • Perimeter + C-UAS + access fused per entity.
  • Air-and-ground correlation surfaced as one threat object.
  • Command AI proposes; cites the ROE clause.
  • Dispatch in-shell. QRF tasking logged.
  • Edge nodes hold zone state through link drops.
  • One audit trail. Cryptographically attributed.
Run the scenario

The same incident, inside the shell.

The simulator below renders the Abqaiq scenario in the operator's view. Click the phase tabs to jump the timeline. Air and ground — fused into one decision.

00–11s
PHASE 01
Detect
RF anomaly, radar correlation, then fence sensor — three channels, one entity. Threat score 0.91 inside 90 seconds.
11–18s
PHASE 02
Decide
Command AI drafts air-effector + QRF response, citing 2019 Abqaiq pattern + active ROE clause. Supervisor reviews, approves under logged authority.
18–34s
PHASE 03
Act
UAS jammed at 2.1 km, recovered intact. QRF on fence breach. Two detained. Crude flow nominal throughout.
PHASE · DETECT  ·  03:14 AM · Abqaiq stabilization sector · perimeter nominal.
SCENARIO · ABQAIQ
Operational impact

What measurably changes.

Operator-measured deltas from a three-zone Abqaiq-class pilot, instrumented against the legacy SOC baseline on the same sensor footprint.

90s
Detect → cited response
First sensor return to drafted multi-domain action.
87%
False alarm reduction
Multi-sensor fusion vs. raw per-channel alerts.
1
Operator per zone
Single seat covers what previously took three.
4×
Concurrent vectors resolved
Air, ground, badge, LPR — handled in one queue.
Why it works

Four MESH OS capabilities, composed.

No new layers introduced for perimeter work. The solution is a configuration of the four fixed MESH OS capabilities — and how little they leak into operator attention.

01Perception

Eight feeds. One entity.

Perimeter intrusion, C-UAS RF/radar, badge events, LPR, video — fused per entity in real time. Re-ID survives camera handoffs and zone seams.

02Command AI

Drafts the response. Cites the ROE.

Command AI proposes air and ground tasking, naming the ROE clause that authorizes it. Operator approves, modifies, or rejects. Authority unambiguous.

03Edge-first

Zones hold state when links drop.

Local edge nodes per zone keep perception and decision logic running through uplink loss. On reconnect, edge logs reconcile with central in seconds.

04Sovereign

On-prem, inside the boundary.

Qudra-resident stack. Models, data, infrastructure stay inside the facility's regulatory boundary. Air-gap-capable for sensitive sites.

Deployment

Ten weeks. One zone. Live operations preserved.

Abqaiq-class facilities don't turn off for deployment. MESH OS ingests the existing perimeter and C-UAS sensor fleet, runs in shadow, then cuts over one zone at a time.

D · 01Weeks 1–4

Ingest & shadow.

MESH ingests existing perimeter, C-UAS, badge and LPR feeds. Operators run their current workflow; MESH runs in shadow. We instrument the baseline against historical incidents.

D · 02Weeks 5–10

Single-zone cutover.

Crew transitions to the MESH shell with dual-stack backup. Command AI in advisory mode. We tune thresholds against your incident log — including 2006 and 2019 vector patterns.

D · 03Weeks 11+

Site-wide rollout.

Additional zones onboard on the same control tier. Edge nodes roll with sensor refreshes. Authority for autonomous response expands case-by-case under doctrine.

Pilot request

Run a 10-week pilot on one zone.

Deploy in shadow against your existing perimeter and C-UAS fleet. Operators keep their workflow. We instrument the baseline, cut over one zone, and prove the delta against your incident log — including the vectors that matter.

Next · S·03
Counter-UAS