TEAM · BUILDER OF AMOSKYS
Akash Thanneeru
Security Operations Engineer. Builder of AMOSKYS. Obsessed with defending the environments and the people who cannot afford to be wrong.
Security Operations Engineer. Builder of AMOSKYS. Obsessed with defending the environments and the people who cannot afford to be wrong.
Hardening AMOSKYS auth and DNS collectors for production reliability, designing the Endpoint Security Framework system extension, and preparing the distribution entitlement application.
I spent a year on a SOC desk defending 1,200 networked medical devices at Hunterdon Healthcare. Infusion pumps, imaging modalities, bedside monitors. Boxes the vendor would not let me patch and the clinical team could not afford to unplug. One shift I sat with the thought that if I missed an alert, a patient would be on the other end of it, and I could not stop thinking about it.
That is the moment AMOSKYS started, even though I did not have a name for it yet. I wanted every place that could be attacked to be watched by something that would tell the truth about what happened, in a way that no attacker could rewrite, so that the people depending on those machines would never be quietly harmed in the dark.
I started with what I had. A Mac. A hard disk. One peripheral agent. Then another. Then a correlator. Then a detection brain. Then a dashboard. Today AMOSKYS is a signed, notarized macOS endpoint security product running the same philosophy I began with.
In March 2026 Apple granted the Endpoint Security Framework development entitlement to AMOSKYS in nine days, against a typical wait of months. The system extension is in design now, and the distribution entitlement application is the next milestone. The dense agent mesh that exists today gives AMOSKYS its eyes; ESF will give it kernel-level reflexes.
Any place that can be attacked has to go through something. A kernel syscall, a network socket, a disk write, a DNS lookup, a credential use. Every surface is a chance to see, and every seen event is a chance to prove. AMOSKYS is built on five layers, with integrity as a first-class primitive.
Sensors. Signed logs. Correlation. Heterogeneous brains. Adaptive learning. Five layers, stacked.
Signed with an Apple Developer ID, notarized, and granted the Apple Endpoint Security Framework development entitlement. Live multi-tenant dashboard at amoskys.com.
I am a Security Operations Engineer with four years of hands-on defense across healthcare IT and clinical OT. I have run the NIST 800-61 incident response lifecycle on mixed IT and medical device environments, authored more than 270 runbooks and root cause analyses, tuned SIEM correlation content in Splunk and Microsoft Sentinel, and operated EDR, IDS, IPS, DLP, and WAF platforms in production.
I hold a Master of Science in Computer Science from Northwest Missouri State University and a Bachelor of Technology in Computer Science and Engineering from the National Institute of Technology, Warangal.
Microsoft Sentinel and Defender XDR deployment, automated IOC enrichment pipeline, STRIDE threat modeling and CVSS 3.1 risk analysis of an IoT platform.
Vulnerability assessments and internal and external network penetration testing across 15 healthcare client tenants and 7,000 assets. Identified more than 90 exploitable misconfigurations and produced prioritized remediation runbooks aligned to HIPAA and ISO 27001.
Defended 2,000 IT endpoints and 1,200 networked medical devices. Ran the full incident response lifecycle on 700 alerts per month. Authored 270 runbooks, root cause analyses, and after-action reports. Recognized as Best Employee, Q2 2022.
Triaged 400 alerts per month on a 24x7 global SOC desk supporting 50,000 endpoints. Contributed to the GSOC's first MITRE ATT&CK coverage map and earned a return offer to the full-time engineer role.
First author of a peer-reviewed paper on hierarchical network intrusion detection, combining XGBoost, LSTM autoencoders, and a multi-layer perceptron across 2.27 million network flows from CSE-CIC-IDS-2018. Achieved 96.3 percent accuracy with a 30 percent reduction in false positives across DoS, DDoS, brute-force, and infiltration attack classes. Also presented at CCSC Central Plains 2025.
The paper is the formal version of the same question I work on operationally: how do you tell the truth from the noise, at scale, without drowning the humans who have to act on the answer?
AMOSKYS is a macOS endpoint security product today. That is the first substrate. The second is industrial and manufacturing OT, passive only, process-aware, decoding Modbus, DNP3, EtherNet/IP, Siemens S7, and OPC UA, running the same five-layer architecture on a different wire and a different physics. The third substrate is whatever cannot be patched next.
The thesis underneath all of it is simple. The things that cannot be patched are the things that carry the most risk, and the people who depend on those things deserve a defender that tells the truth. AMOSKYS is my attempt to build that defender in the open, one substrate at a time, with integrity as a primitive and detection content anyone can read.
AMOSKYS is designed, scoped, validated, and shipped by me. I use modern AI coding assistants as an accelerator for implementation, the same way an engineer in 2010 used Stack Overflow and an engineer in 2000 used O'Reilly books. Every detection philosophy, every probe-to-MITRE mapping, every architectural decision, every priority call is mine. The product knows what it is because I do.
I believe being transparent about this is the only honest way to build security tools in the era we are living through. The defenders who win the next decade will be the ones who can hold a clear philosophy, reason about adversary behavior, and direct the tools at their disposal toward outcomes that matter. AMOSKYS is my attempt to do exactly that, in public, while building something the people who depend on it can actually trust.