The GPU-Native Security Intelligence Platform
Three integrated NVIDIA-accelerated layers plus foundation models and serving infrastructure. Stream, Agents, and Edge — all powered by NVIDIA Morpheus, NeMo, Triton, and Jetson Orin. From 2M+ events/sec detection to <0.4ms inference to air-gapped OT protection.
Five Integrated Layers
Detection, investigation, edge protection, foundation models, and serving infrastructure — all GPU-accelerated, all unified through NVIDIA Triton and zero-copy DMA.
Quellra Stream (Detection Engine)
NVIDIA Morpheus GPU pipeline with custom CUDA kernels, TensorRT models (NetSecBERT INT8), and RAPIDS cuDF. 2M+ events/sec, sub-millisecond inference, 40× faster than CPU.
Quellra Agents (Investigation & Response)
NeMo Planner orchestrates 6 NIM microservices: telemetry correlation, attack chain reconstruction (cuGraph HAN GNN), threat intel RAG, blast radius prediction, report generation (NeMo LLM + Guardrails), and response execution. 200-500ms attack chain reconstruction.
Quellra Edge (OT/ICS)
Jetson AGX Orin 64GB (275 TOPS) or NX 16GB (157 TOPS). DLA for deterministic OT protocol scoring (Modbus/DNP3/OPC-UA/Profinet), GPU for burst inference, GPIO relay for hardwired SIS interlock. Air-gap autonomy.
Foundation Model Layer
DGX H100 for NetSecBERT pre-training on synthetic + real data. NeMo LoRA per customer (A100, 2-4 hrs/quarter, 20-50 MB adapters). NeMo Curator for deduplication. Synthetic bootstrap via NeMo MITRE ATT&CK generator.
Serving Infrastructure
NVIDIA Triton Inference Server with dynamic batching, model ensemble, and 80%+ GPU utilization. Deployment modes: Cloud SaaS, On-premise (NIM + AI Enterprise), Hybrid, Edge-only, DGX Cloud.
Quellra Stream — Detection Engine
NVIDIA Morpheus GPU pipeline with zero-copy DMA and custom CUDA kernels. Token extractor converts NetFlow v9/IPFIX into 128-token sequences for NetSecBERT. IOC hash-join kernel performs 2M parallel lookups/sec against a 50M IOC database. Packet header statistical feature extraction detects C2 in encrypted traffic via CDF/entropy analysis. TensorRT serves NetSecBERT INT8 (under 0.4ms/event, 50× faster than CPU), encrypted traffic classifier, and behavioral anomaly model (per-entity Z-score vs 90-day baseline). RAPIDS cuDF handles real-time feature engineering. Result: 2M+ events/sec throughput, 70%+ false positive reduction.
Quellra Agents — Investigation and Response
NeMo Planner orchestrates 6 autonomous agents packaged as NVIDIA NIM microservices and NVIDIA AI Enterprise. Agent 1: Telemetry Correlation (RAPIDS cuDF joins). Agent 2: Attack Chain Reconstruction (cuGraph BFS + HAN GNN with PyG, 5 entity types: user, device, process, network flow, file object). Agent 3: Threat Intel Enrichment (NeMo Retriever RAG against MITRE ATT&CK, KEV, ISAC feeds). Agent 4: Blast Radius Assessment (predictive lateral movement model, >80% probability in 15 min). Agent 5: Report Generation (NeMo LLM + Guardrails for SOC-ready narrative). Agent 6: Response Execution (firewall/EDR/IdP/OT API orchestration). Attack chain reconstruction completes in 200-500ms.
Ingest & Detect
Morpheus + TensorRT2M+ events/sec processed through NVIDIA Morpheus. TensorRT INT8 inference scores every event in under 0.4ms.
Correlate & Reconstruct
RAPIDS cuDF + cuGraphTelemetry correlation via cuDF joins. HAN GNN reconstructs attack chains across 5 entity types in 200-500ms.
Assess & Report
NeMo LLM + GuardrailsBlast radius prediction identifies hosts at risk. NeMo generates SOC-ready investigation report with confidence scores.
Contain & Respond
NIM MicroservicesPre-approved playbooks execute containment — isolate hosts, revoke credentials, block IPs. Auditable and reversible.
Quellra Edge — OT/ICS Protection
Purpose-built for operational technology and industrial control systems. Deployed on NVIDIA Jetson AGX Orin 64GB (275 TOPS) or Jetson Orin NX 16GB (157 TOPS) in fully air-gapped environments. DLA (Deep Learning Accelerator) handles deterministic OT protocol scoring for Modbus, DNP3, OPC-UA, and Profinet with hardwired SIS (Safety Instrumented System) interlock via GPIO relay. GPU cores handle burst inference for novel pattern detection. Zero cloud dependency — model updates delivered via secure USB. Detects anomalous commands before they reach physical actuators, with PLC isolation capability. Air-gap autonomy meets real-time protection.
- Jetson AGX Orin 64GB (275 TOPS) or NX 16GB (157 TOPS)
- DLA for deterministic OT protocol scoring (Modbus/DNP3/OPC-UA/Profinet)
- GPU burst inference for novel pattern detection
- GPIO relay for hardwired SIS interlock and PLC isolation
- Air-gapped operation with secure USB model updates
- IEC 62443 compliant segmentation and real-time monitoring
Foundation Model Layer
DGX H100 pre-trains NetSecBERT on synthetic + real security telemetry. NeMo LoRA fine-tunes per customer on NVIDIA A100 (2-4 hrs per customer per quarter, 20-50 MB adapters). NeMo Curator deduplicates training data for higher signal. Synthetic bootstrap via NeMo MITRE ATT&CK generator creates realistic attack sequences for data-scarce scenarios. Result: customer-specific models that understand your unique environment, threat landscape, and business context — without sharing raw data.
# DGX H100 NetSecBERT Pre-training Pipelinemodel: NetSecBERT-basearchitecture: BERT with security-specific tokenizer (128-token sequences)hardware: DGX H100 (8x H100 80GB)framework: NVIDIA NeMo training: dataset: - synthetic: NeMo MITRE ATT&CK generator (60%) - real: anonymized customer telemetry (40%) - deduplication: NeMo Curator (95% dupes removed) batch_size: 2048 training_time: 72 hours checkpoints: every 10k steps # Customer-Specific LoRA Fine-Tuninglora_adapter: hardware: NVIDIA A100 80GB training_time: 2-4 hours per customer per quarter adapter_size: 20-50 MB deployment: via NVIDIA Triton model ensemble privacy: adapters trained on customer data, never sharedServing Infrastructure
NVIDIA Triton Inference Server orchestrates all models with dynamic batching, model ensemble, and concurrent execution. Achieves 80%+ GPU utilization across detection, investigation, and response workloads. Deployment modes: Cloud SaaS (multi-tenant Triton on A100/H100), On-premise (NVIDIA NIM + AI Enterprise for air-gapped data centers), Hybrid (Stream + Agents in cloud, Edge on-site), Edge-only (Jetson Orin for fully disconnected OT), and DGX Cloud (GPU-as-a-service for burst workloads). One platform, five deployment options.
Platform Differentiators
GPU-Native
Built from the ground up on NVIDIA CUDA, Morpheus, TensorRT, NeMo, and RAPIDS. Not a CPU platform with GPU bolted on — every pipeline stage runs on GPU memory with zero-copy DMA.
Full Fidelity
Zero sampling, zero data loss. Every packet, every log, every signal is analyzed at wire speed. 2M+ events/sec with sub-millisecond inference.
Autonomous
NeMo Planner orchestrates 6 agents (NIM microservices) that investigate, correlate, and respond without waiting for human approval. 200-500ms attack chain reconstruction.
Edge-Ready
Deploy the same models on Jetson AGX Orin (275 TOPS) or NX (157 TOPS) in air-gapped OT environments. DLA for deterministic protocol scoring, GPU for burst inference, GPIO for hardwired SIS interlock.
Customer-Specific Models
NeMo LoRA fine-tunes NetSecBERT per customer on A100 (2-4 hrs/quarter, 20-50 MB adapters). Your models understand your environment without sharing raw data.
Enterprise-Grade Serving
NVIDIA Triton Inference Server with dynamic batching, model ensemble, and 80%+ GPU utilization. Five deployment modes: Cloud SaaS, On-premise, Hybrid, Edge-only, DGX Cloud.
Built on the NVIDIA AI Platform
Quellra leverages the full NVIDIA stack — from CUDA kernels to Morpheus pipelines to NeMo orchestration to Triton serving. Every layer is GPU-accelerated, enterprise-supported, and purpose-built for real-time AI at scale.
NVIDIA Morpheus
GPU-accelerated cybersecurity pipeline framework with zero-copy DMA. Powers Quellra Stream detection engine.
CUDA + cuDNN + TensorRT
Custom CUDA kernels for token extraction and IOC lookups. TensorRT optimizes NetSecBERT to INT8 for <0.4ms inference.
NVIDIA Triton Inference Server
Dynamic batching, model ensemble, and 80%+ GPU utilization. Serves all detection, investigation, and response models.
NVIDIA NeMo + NIM + Guardrails
NeMo Planner orchestrates 6 agents. NIM packages them as microservices. NeMo LLM + Guardrails generates SOC-ready reports. NeMo Retriever RAG enriches with threat intel.
RAPIDS (cuDF + cuGraph)
cuDF for real-time feature engineering and telemetry correlation. cuGraph BFS + HAN GNN for attack chain reconstruction (200-500ms).
NVIDIA Jetson Orin + DGX H100
Jetson AGX Orin 64GB (275 TOPS) for edge OT/ICS. DGX H100 for NetSecBERT pre-training. A100 for customer LoRA fine-tuning.
NVIDIA AI Enterprise
Enterprise licensing, support, and security hardening for on-premise and air-gapped deployments. Includes NIM containers.
DGX Cloud
GPU-as-a-service for burst workloads, model training, and hybrid deployments. Instant access to H100/A100 clusters.
Developer-First API
Integrate Quellra into existing workflows with a single API call. Stream events from Morpheus detection pipeline, trigger NeMo agent investigations, and orchestrate NVIDIA NIM response microservices programmatically.
import { Quellra } from '@quellra/sdk'; const client = new Quellra({ apiKey: process.env.QUELLRA_API_KEY, endpoint: 'https://api.quellra.com/v1', deployment: 'cloud', // or 'on-premise', 'hybrid', 'edge', 'dgx-cloud'}); // Stream real-time threat events from NVIDIA Morpheus pipelineconst stream = client.stream.subscribe({ sources: ['network', 'endpoint', 'identity'], severity: ['critical', 'high'], morpheus_pipeline: 'netflow-v9-netsecbert',}); stream.on('threat', async (event) => { // Dispatch NeMo-orchestrated agent to investigate (6 NIM microservices) const investigation = await client.agents.investigate({ alertId: event.id, depth: 'full', // runs all 6 agents: correlation, attack chain, enrichment, blast radius, report, response autoContain: true, nemo_planner: 'default', }); console.log(`Agent ${investigation.agentId} reconstructed attack chain in ${investigation.chainReconMs}ms`); console.log(`Blast radius: ${investigation.affectedEntities} entities, ${investigation.lateralMoveProb}% lateral move probability`); console.log(`Response executed via NVIDIA NIM in ${investigation.ttc}ms`);});Platform Performance
Events/sec (40× CPU)
Inference latency (<0.4ms, 50× CPU)
Attack chain reconstruction (200-500ms)
False positive reduction
GPU utilization (NVIDIA Triton)
Deployment modes
Complete Visibility in One Pane
Monitor all five layers from a single dashboard. Real-time NVIDIA Morpheus detection throughput, NeMo agent orchestration status, Jetson Orin edge device health, DGX H100 model training progress, and NVIDIA Triton serving metrics — everything you need without switching tools.
Threats Blocked
12,847
Active Agents
24
Avg Response
0.3s
Coverage
99.9%
Enterprise-Grade Security at Every Layer
NVIDIA AI Enterprise provides FIPS 140-2 validated containers. Customer data never leaves your environment.
Customer Data Isolation
All telemetry processed in dedicated VPC. Only anonymized 128-dimensional embeddings leave customer environment.
Air-Gap Capable
Jetson Orin runs full inference pipeline with zero cloud dependency. GPIO relay operates independently of IP network.
Auditable Agent Actions
Every containment action logged with timestamps, confidence scores, and reversibility flags. Full forensic trail.
Powered by the full NVIDIA AI stack
ExperiencethePlatform
See how five integrated NVIDIA-accelerated layers work together — from NVIDIA Morpheus detection to NeMo agent orchestration to Jetson Orin edge protection. 2M+ events/sec, <0.4ms inference, 200-500ms attack chain reconstruction.