About

Why Protet exists

A CI/CD runner routinely holds registry credentials, cloud IAM roles, and signing keys — real, usable privilege, often broader than the production workloads it builds ever get. Almost none of that surface is watched.

Security tooling for the software supply chain has mostly stopped at what's declared: a lockfile, an SBOM, a lint rule against a manifest. That catches a real class of problems, but it structurally can't see a postinstall script that only turns malicious once a build actually runs it, a hijacked runner executing commands as your CI, or a dependency-confusion payload that looks identical to a legitimate package until it's installed and running.

Protet watches what a build actually executes — not what it declares — and applies a detection model trained specifically on real execve command sequences to flag the sessions that don't belong. It's built to run wherever a build already runs: fully on your own infrastructure and air-gapped if that's what your environment requires, or hosted, if it isn't.

We think the deeper problem isn't any single supply-chain attack technique — it's a whole class of infrastructure that's privileged, ephemeral, and barely watched: broad credentials, short-lived, and almost nobody looking at what it actually executes. CI/CD build runners are the clearest example, and where Protet starts.

Who builds it

Protet is built and run by Robin Frehner. By day he's a machine-learning engineer in cyber security, building malware detectors — finetuned code models for malicious-macro detection, neural networks that classify malware at very low false-positive rates — with published research in anomaly detection behind him. Protet applies that same discipline to what CI/CD build sessions actually execute.

It's independent and founder-led: the person who designed the detection model and wrote the pipeline is the same person who answers your email — no support tier, no account manager, no layer between you and the engineer who knows exactly how it works.

It's also built in the open where it counts. The package-analysis feed runs the same detector every day against real, newly-published packages — you can watch it work before you trust it with a build. The how it works and security pages spell out precisely what it does, what it stores, and how a model earns the right to ship. No black box.

Find Robin on LinkedIn.

Get in touch

Questions, feedback, or want to talk through your environment before committing to anything — email hello@protet.io and you'll reach Robin directly.