Glacier
Detect hidden AI before it detects you.
Glacier is a static binary analysis system that detects AI and ML models embedded inside compiled software, binaries, and firmware. No execution. No network connection. Fully air-gapped.
Every artifact a static tool can reach is detected, 28 of 28. The benchmark deliberately includes commercial applications whose model bytes are vendor encrypted, and the six that are pure ciphertext stay in the denominator on purpose.
Frontier models already exploit real systems.
Frontier AI models can now discover and exploit zero-day vulnerabilities. In 2026, researchers used a restricted frontier model to defeat Apple's newest hardware memory defense in under a week.1 Weeks later, a publicly available model in the hands of a single researcher surfaced a critical flaw that had survived four years in a live system. A working exploit existed within a day of the model's release.2
Those incidents show what frontier models can do when pointed at a system. The emerging exposure is models embedded inside the software itself. Capability is climbing. Model sizes are shrinking. Small models can already be compiled directly into ordinary executables and firmware. Every binary entering your environment is now a potential carrier of undisclosed, autonomous capability.
Your security stack can't see it.
SBOM and SCA tools inventory what software declares. They cannot see inside a compiled binary. Sandboxes have to run the file, and running it is the risk. Reverse engineering gives you disassembly, not answers.
No tool in today's security stack checks compiled software for an embedded model. Glacier is that layer.
Static analysis. Full visibility.
Glacier statically analyzes executables, firmware images, and containers and reports whether AI or ML models are embedded inside: what was found, where, and with what confidence.
Air-gapped by design
Runs fully offline. Built for classified and disconnected environments.
Never executes the sample
Safe on untrusted binaries, malware, and firmware.
Sees through packaging
Analyzes content inside archives, installers, mobile packages, and documents.
Explainable results
Evidence-backed findings your analysts can audit and defend, not just a score.
Benchmarked, not promised.
false positives across 15,193 system files
false positives on 21 verified model-free real-world applications
of the full real-world holdout, 28 of 34 artifacts. 28 of the 28 that a static tool can reach.
The holdout deliberately includes 10 commercial applications whose model bytes are vendor encrypted. Glacier reaches four of them without decrypting anything. The remaining six are pure ciphertext, which is the boundary of static analysis itself and not of one tool. They stay in the denominator on purpose: a real software estate contains them, and removing them would overstate field performance.
Benchmarked on a 34-artifact real-world positive set and a 21-artifact benign set. All SHA-256 pinned, labeled out of band and never by Glacier itself, and held out from signature harvesting by an enforced denylist. The holdout spans production applications packaged for Windows, Linux, and Android, including self-contained AI executables and commercial applications whose model bytes are vendor encrypted, with models in common on-device and embedded inference formats.
On compression-wrapped models, measured separately from the real-world holdout: 100% detection with zero false positives, and zero false positives on benign document and archive controls.
Where hidden models matter most.
Defense primes and program security
verify what ships on the platform before it ships.
Software supply chain
inspect vendor deliverables at intake, before deployment.
OT, ICS, and embedded firmware
assess firmware images without powering the target.
Classified environments
full capability inside air-gapped networks.
Built under defense review.
- MVP developed under U.S. Air Force-funded research.
- Deemed awardable by the CDAO (Chief Digital and Artificial Intelligence Office).
- Core detection method patent-pending.
- StrataMentis is SAM.gov registered with an active CAGE code.
Shy Pahlevani
Founder of LiveSafe, the mobile risk intelligence platform that grew to protect nearly 5 million people across more than 400 enterprises, universities, and government agencies before its 2020 acquisition by Vector Solutions. The platform earned the Department of Homeland Security's highest SAFETY Act accreditation for anti-terrorism technologies and was piloted by the U.S. Navy. Backed by Barry Diller and FedEx founder Fred Smith, who both joined the board. EY's 2020 Mid-Atlantic Entrepreneur of the Year for his next venture, HUNGRY. Advises StrataMentis on go-to-market and scaling security products into enterprise and government.