Every customer site, watched by AI that never sleeps

Illuminate IQ is an AI-powered network intelligence layer that runs alongside your existing Nepean Networks SD-WAN deployment. It uses the DPI flow data already produced by every Nepean Networks node to learn what's normal for each customer site, detect anomalies and threats, and deliver investigated alerts and customer-facing reports — without requiring any new hardware.

You can think of it as an NDR (Network Detection & Response) product designed for the MSP delivery model rather than a single enterprise SOC. Where Darktrace, Vectra, and ExtraHop sell to large in-house security teams, Illuminate IQ sells through MSPs to SMB and mid-market customers as a packaged service.

Antares, the management plane, gives you connectivity, monitoring, and traffic visibility. Illuminate IQ adds the analytical layer on top:

• Behavioral baselines — per-device profiles of what's normal traffic versus anomalous
• AI-investigated alerts — plain-English explanations of what's happening, not just events
• Compound threat detection — multiple signals combined into a single high-quality alert
• Customer-facing automated reports — weekly plain-English reports your customer can read
• Natural language Q&A — ask questions about a site in plain English from the Antares portal

The Antares dashboard tells you what your network is doing. Illuminate IQ tells you what it means.

No. Illuminate IQ uses the DPI flow data already produced by the Nepean Networks node at each customer site. There are no new agents, no new appliances, no network taps, and no firewall changes required at the customer end.

Every time you mark an alert as a true positive or false positive in the Antares portal, that signal feeds back into pattern intelligence shared across your entire customer base. Three direct effects:

• Confirmed false positives at one customer reduce alert noise at every customer that subsequently sees the same pattern
• Confirmed threats at one customer raise detection priority for the same anomaly type at every other customer immediately
• New customers benefit on day 1 — they inherit fleet patterns instead of waiting two weeks for a personal baseline to mature

The data that's shared across the fleet is anonymized pattern intelligence — not customer-identifying data, IP addresses, or content.

Three timescales:

• Day 1 — fleet pattern intelligence applies immediately
• Days 1–7 — initial alerts begin firing on obvious anomalies. Some noise expected as personal baselines build
• Day 14 — full personal baseline maturity. False-positive rate drops markedly

Set customer expectations accordingly. The first two weeks include some noise; from week 3 onwards the alert quality is dramatically higher.

Illuminate IQ degrades gracefully. The Antares node continues to perform its core SD-WAN routing as normal. When connectivity returns, queued flow data is forwarded and the analysis catches up automatically.

You'll see a node_offline alert if a site stops reporting for more than 15 minutes. No customer-impacting downtime, no service degradation.

The deployment is a configuration change on the Antares portal side. You enable Illuminate IQ for a partner account, enable it for the customer's specific node(s), and the second flow sink is activated automatically. No on-site visit, no truck roll.

Illuminate IQ collects DPI flow metadata — source/destination IPs, ports, protocols, application identification, byte counts, and timing. It does not capture packet payloads, no email content, no file content, no chat content.

Data is stored on Nepean Networks infrastructure in OVH Gravelines (EU). Data residency options for AU and APAC are available on request. Retention defaults: 30 days raw flow data, 12 months aggregated metrics, indefinite for confirmed incidents and reports.

No. Illuminate IQ is purely analytical — it observes flow data and produces alerts. It does not block traffic, does not replace IPS/IDS functionality, and does not act as a firewall.

Your customer's existing edge security continues to handle inline blocking. Illuminate IQ is additive: it catches the things signature-based firewalls miss because they're behavioral anomalies, not known signatures.

Yes — and these are often where Illuminate IQ delivers the most value. Hikvision cameras, Synology NAS units, Dahua DVRs, building management systems, and other IoT/OT devices typically have very predictable behavioral baselines, which makes anomaly detection especially effective.

Alerts surface through the Antares portal — they appear inline next to the relevant node in the dashboard, with the full investigation narrative attached. You can also configure email and webhook delivery for P1/P2 alerts to your MSP NOC tools.

SIEM integration (syslog/CEF, Sentinel native connector, Splunk HEC) is on the committed Q2 2026 roadmap.

Available now: Antares portal (native), webhook delivery for alerts (REST/JSON), email delivery for weekly reports and high-severity alerts, REST API for read access.

On the committed roadmap:

• Q2 2026 — Syslog CEF/LEEF for SIEM compatibility
• Q3 2026 — Native Microsoft Sentinel, Splunk HEC, Elasticsearch, Datadog connectors
• Q4 2026 — ConnectWise Manage / Autotask / Halo PSA ticket creation, ITGlue enrichment
• 2027 — EDR enrichment (Huntress, Blackpoint, SentinelOne), bidirectional Sentinel integration

Yes. The Illuminate IQ API exposes read endpoints for alerts, incidents, devices, baselines, and reports. Authentication is via API key, scoped per partner account so you only see your own customers' data.

Documentation and sandbox access are available through the partner portal.

Rough guide once baselines are mature (post day 14):

• Quiet office, ~50 devices — 0–5 alerts/week, mostly P3/P4 informational
• Hospitality / guest WiFi heavy, ~500 devices — 5–20 alerts/week, mostly behavior normalization
• IoT/OT heavy site (cameras, BMS), ~200 devices — 3–10 alerts/week, often the most actionable

P1 alerts should be rare — perhaps 1–2 per month across a 50-site fleet.

Mark the alert as a false positive in the Antares portal and add an optional note. Three things happen automatically:

• The specific device-destination pair is added to the customer's allowlist for that anomaly type
• The personal baseline for that device adjusts to incorporate the new "normal"
• The pattern feeds into the fleet learning model — if 5+ partners confirm the same pattern, it activates as a fleet-wide suppression

Two reports generate automatically every week per site: an MSP technical report (comprehensive alerts, incidents, action items, fleet position) and a customer-facing report (plain-English summary for the business owner).

Reports generate every Monday morning AEST for the previous week.

Inside the Antares portal, you can ask questions about a customer's network in plain English — "What are the Hikvision cameras doing?", "Has there been unusual traffic to China?", "Which device is using the most bandwidth?" This is fastest for triage when a customer calls with a vague question.

When the system detects an incident, it creates a record with a unique reference (OW-2026-04-####), generates an investigation narrative, surfaces it at P1 or P2 severity, and sends webhook/email notification. It continues monitoring and adds new alerts to the same incident as the situation evolves.

Check three things in order: (1) Node connectivity — is the Antares node online and forwarding flows? (2) Illuminate IQ status — check the Illuminate IQ panel in the Antares portal for last flow received and baseline maturity. (3) Alert suppression — has the alert profile been adjusted to suppress lower-severity alerts?

If those three look healthy and you're still seeing nothing, raise a ticket with the partner team.

DPI flow metadata only — source/destination IPs, ports, protocols, application identification, byte counts, and timing. No packet payloads, no email content, no file content, no chat content. This is the same data the Antares node already produces for connectivity monitoring.

No. The fleet pattern model only stores anonymized pattern shapes — anomaly type, device class, destination ASN, country code. No customer-identifying information is ever shared across the fleet. No IP addresses, no MAC addresses, no traffic content.

Illuminate IQ supports compliance in several ways:

• Australian Privacy Act / NDB — earlier breach detection supports the 30-day notification requirement
• GDPR — EU data residency (OVH Gravelines) is the default; AU residency available on request
• PCI DSS 10.x — comprehensive logging of network traffic flows supports the monitoring control objective
• ISO 27001 A.12.4 — event logging and monitoring control directly supported

Nepean Networks engineering and support staff can access customer flow data only when investigating a partner-raised support ticket, and only with the partner's explicit consent. Routine operations are entirely automated — no human reads your customers' data as part of normal operations.

All customer data access is logged and auditable. Partners can request the full access log for any customer at any time.