Positive Technologies has deployed an internal platform based on Security Lakehouse architecture to aggregate anonymized telemetry from all products and client installations. The system processes up to one million events per second at peak and handles over 50 billion records daily, enabling the identification of multi-target cyberattack campaigns that remain invisible when analyzed in isolation.
The platform replaces fragmented data storage, which previously required manual extraction and cross-team coordination. Security Lakehouse automatically standardizes data, allowing developers and analysts to access ready-to-use datasets. This infrastructure supports the company's cloud-based web application and API protection tool, PT Cloud AF, by detecting patterns across multiple clients.
AI models trained on the Lakehouse data identify anomalies by correlating behavior across different products, such as detecting unusual network protocols on devices. This cross-product visibility allows for more accurate threat detection. The platform currently powers PT X and is being integrated into the next generation of company products, including MaxPatrol O2.
The transition to this architecture addresses the limitations of traditional systems that rely on static correlation rules. By increasing data storage depth and retrospective search speeds, the platform enables the company to manage high-load environments where legacy architectures fail. The system integrates data from client-side PT NAD and cyber intelligence feeds.
