Evaluation
Last reviewed August 19, 2026 · Mitchell Sipus, PhD, Founder & CEO
We run a 30 day trial at a low fee tied to an agreed performance indicator, credited toward your license if you proceed, on your real data in your own environment.
How do I evaluate CyPhER?
We run a 30 day trial at a low fee tied to a mutually agreed key performance indicator, and the fee is credited toward your license if you proceed. Structuring it this way keeps both sides honest. You define in advance what a successful outcome looks like, we agree to it before we start, and at the end there is a factual answer rather than a negotiation about whether the trial went well. Common indicators customers choose include identifying policy violating traffic patterns already present in the environment, reducing adversary dwell time, and reducing time to result on investigations that currently take weeks or longer. Others set indicators around alert volume reduction, completeness of visibility across previously unmonitored segments, or the accuracy of an existing tool's output when measured against a complete record. The trial runs on your real data in your environment, and findings can be independently verified against the observed record, which is a property a deterministic system can offer and a confidence-score system structurally cannot.
What questions should I ask any vendor in this market?
Four questions separate approaches in this category more reliably than a feature matrix. First, is your detection deterministic or probabilistic, meaning does a finding represent something you observed or something you estimated. Second, can I independently verify a finding against the underlying evidence, or am I verifying your system's account of its own reasoning. Third, does your detection depend on a learned model of normal behavior, and if so what happens if an adversary was present while it learned or is patient enough to drift it. Fourth, is your collection complete or sampled, because an analytics layer cannot recover information the collection layer never captured.
What does a CyPhER evaluation prove that a product demonstration does not?
A demonstration proves the product works on traffic the vendor chose, and an evaluation on your network proves it works on yours. The claims that matter in this category, including detection of activity other tools missed and collapse of alert volume into workable findings, are only meaningful against real traffic, and our reference results came from exactly such conditions. The United States Air Force evaluation result and the SolarWinds blind test were both produced under evaluation conditions we did not control.
What does CyPhER cost?
CyPhER is licensed to scale with the environment it observes, and we structure evaluations so that a proof of value carries forward into a production engagement rather than being sunk cost. Pricing specifics depend on environment scale and configuration, and we would rather scope honestly against your actual network than publish figures that mislead in both directions.
How does North Star Labs handle sensitive data?
CyPhER analyzes network behavior at layers 2 through 4, and it operates fully on premises with no requirement that your data leave your environment. For defense and regulated customers, we work within the security and compliance frameworks the engagement requires, and we are experienced with the accreditation processes that government deployments involve. Specific data handling commitments are documented per engagement.
Does North Star Labs work with partners and resellers?
We work with channel and delivery partners, including government-focused distribution, and we operate a partner program for organizations whose customers need what we build. Systems integrators, managed security providers, and sector-focused consultancies serving critical infrastructure operators are natural fits.