Singularity is the Event Horizon structural-signature layer. It identifies files whose structure matches the spectral signatures of known weakness classes — and ranks them into four review buckets. Deterministic. On-premises. No AI in the loop.
The 17-year-old FreeBSD NFS bug. The 27-year-old OpenBSD TCP race. The 16-year-old FFmpeg H.264 heap overflow. All recognised CWE categories. The novelty in Mythos's disclosed findings is the location, not the class.
If known classes have known structural signatures, then a structural pattern matcher pointed at the right files can surface a meaningful fraction of those same classes without LLM inference cost. That structural pattern matcher is Singularity.
Event Horizon and Singularity ship from the same scanner. Same structural-recognition engine, same deterministic discipline. The inventory layer earns trust first; the signature layer extends it.
Event Horizon scans C/C++ code and maps structural crypto fingerprints. It tells teams where crypto-like structure is present and how files cluster by form. Four buckets: Unknown / Boundary / Consistent / Mute.
Singularity applies deterministic structural signatures for known weakness classes and ranks files into review buckets. It is a triage layer for expert investigation. Four buckets: Signature-Match / Signature-Adjacent / Signature-Cleared / Out-of-scope.
Four buckets, mirroring the Event Horizon inventory layer's four-bucket discipline. No bucket asserts a vulnerability finding. Every bucket is a triage signal.
Core structural signature present. Candidate for prioritised review.
Related structure present; full signature does not fire. Review as secondary queue.
Clearing structure present for this class. Historically vulnerable family, currently hardened shape.
File form does not match this class context.
Phase 0 defines the minimum sample floors and calibration thresholds a structural-signature class must satisfy before it can ship as a preview deliverable. The current state of those gates:
Calibration metrics from the Phase 0 curated label set. Production-threshold claims are not yet made; each class is at preview level.
| Class | Positives | Negatives | TPR (strict) | FPR (strict) | Precision (strict) | Production claim |
|---|---|---|---|---|---|---|
| R2-HEAP-OVF-PARSER | 22 | 68 | 1.000 | 0.000 | 1.000 | Preview — not claimed |
| R2-INT-OVF-SIZE | 21 | 69 | 1.000 | 0.043 | 0.875 | Preview — not claimed |
| R2-UAF-STATE | 24 | 52 | 1.000 | 0.000 | 1.000 | Preview — not claimed |
Total bucket assignments across the full Phase 0 validation pack (every file-class result from the three Phase 0 detectors):
A practical large-sample Recall@K proxy on FFmpeg's libavformat module. This benchmark reports how concentrated security-fix-related files (identified by keyword in commit subjects) are within higher-ranked structural hotspots.
Of 53 historical commit-file pairs identified by security-relevant keywords (52 of which are in the heatmap), the following fractions appear within the top-K ranked structural hotspots:
The product's defensible perimeter is structural classification. The honesty rails below name what Singularity does not do so that when we describe what it does, it can be believed.
Singularity is Phase 0 — a calibration preview, not a shipping product. It is not sold, bundled, or promised as a deliverable while it is at preview status. When it reaches production-claim, the waitlist is told first.
Event Horizon is the product you can buy today. Singularity is the layer being built on top of it — shown here so you can judge the evidence yourself, not so it can be sold ahead of what it can prove.
As the catalogue expands and external validation completes, Singularity becomes a standard output of every Event Horizon scan. Join the waitlist and you will hear when it does — or talk to Rob directly.
Join the Singularity waitlist