Network is healthy
Fleet totals — all devices across 2 routers
Healthy Sequences
0
behavioral classifications · all routers
Threat Windows
1 unusual →0
behavioral classifications · all routers
Network Topology
2 routers
Office Gateway
Riverside HQzarouter_DEMO01HQ
Connected Devices
workstation-09
192.168.1.109
Orvane Computing
normal
workstation-12
192.168.1.112
Orvane Computing
normal
hr-laptop-03
192.168.1.55
Dunmoor Devices
normal
file-server-01
192.168.1.20
Ferrowick Compute
normal
nas-backup
192.168.1.10
Rookhaven Storage
normal
front-door-cam
192.168.1.71
Falkmere Vision
normal
warehouse-printer
192.168.1.60
Greywick Imaging
unusual
conf-room-tv
192.168.1.40
Pellmont Display
normal
reception-ipad
192.168.1.31
Dunmoor Devices
normal
02:42:5e:48:b2:f1
192.168.1.131
Quillon Boards
training
02:42:5e:48:b2:90
192.168.1.122
Tinwick Microsystems
training
02:42:5e:6a:17:24
no IPv4 seen
randomized MAC
training
Branch AP
Distributionzarouter_DEMO02BR
Live preview of Franklin · anonymized sample network
Meet Franklin
Franklin lives on your router, learns how every device behind it normally behaves, and stops threats before they spread.
Franklin analyzes the traffic of every device behind your router in real time, catching malicious activity and odd communications before damage occurs.
Franklin scores traffic on the router itself. No cloud round-trips, no slowdown, and your traffic never has to leave the building.
Franklin learns what normal looks like for each device and flags what strays from it, so novel malware is caught by its behavior, not a signature list.
How Franklin works
Franklin installs on your router and starts working immediately. Minimal footprint, zero configuration.
Franklin learns how each device on your network normally behaves and builds its own baseline — no rules to write, no signatures to update.
Franklin scores activity in real time on the router, identifying anomalies that signature-based tools never see.
Threats are contained automatically. Franklin alerts you with the reason, not a flood of raw logs.
Use cases
Ship Franklin on subscriber routers to detect botnets, DDoS staging, and compromised devices before they affect your infrastructure. Aggregate behavioral telemetry across millions of endpoints.
News
ZeroAnomaly is a featured startup at Web Summit Lisbon, 9–12 November 2026. Come meet the team, see Franklin, and tell us about your network.
Team

John Carter, PhD
Co-Founder
Software entrepreneur and researcher in behavioral malware detection for IoT, with a recent PhD from Drexel University.
john@zeroanomaly.com
Brian Mitchell, PhD
Co-Founder
Technology leader and cybersecurity researcher with over 30 years of industry and academic experience.
brian@zeroanomaly.com
Spiros Mancoridis, PhD
Co-Founder
Auerbach Berger Endowed Chair in Cybersecurity and Distinguished Professor of CS at Drexel University.
spiros@zeroanomaly.com
Pavlos Protopapas, PhD
Co-Founder
Scientific Program Director at the Institute for Applied Computational Science, Harvard University.
pavlos@zeroanomaly.comResearch
calBERT: Securing Routers Serving IoT Networks using Contrastive Augmented Learning
J. Carter, S. Mancoridis, P. Protopapas, B. Mitchell, B. Lilley
contrastBERT: Behavioral Anomaly Detection for Malware using Contrastive Learning
J. Carter, S. Mancoridis, P. Protopapas, B. Mitchell
sysBERT: Improved Behavioral Malware Detection using BERT Trained on sys2vec Embeddings
J. Carter, S. Mancoridis, P. Protopapas
Malware Detection in Cloud Native Environments
B. Mitchell, A. Chandnani, J. Carter, D. Roumelioti, S. Mancoridis
Behavioral Malware Detection using Language Model Classifier Trained on sys2vec Embeddings
J. Carter, S. Mancoridis, P. Protopapas, E. Galinkin
Contact
Tell us about your environment — we'll show you what Franklin finds.