# Red Onion Systems — Map of Content This maps **Red Onion Systems** and its product **TelemetriX**, a layer that captures DNS and network telemetry, enriches it, routes only the useful part to expensive tools, and keeps the rest as a searchable archive. The argument runs: DNS carries the earliest signal on a network, nobody keeps it because keeping it is priced by volume, the resolver cannot be touched to get it, so mirror it instead, and the copy stays inside the customer's boundary. Start anywhere and follow the wikilinks. ![[Screenshot 2026-09-13 at 23.53.23.png]] > [!abstract] How to read this map > Bottom layer, a data fact: nearly every connection starts with a name lookup, so DNS sees things before they happen. Next, a money problem: security tools charge by volume, so teams drop 40 to 60% of it. Then a design constraint: production DNS is the one box nobody will let you modify. The answer is a mirror, which is why the site calls it a resolver-preserving layer. The wedge is cost, the expansion is control, and the deal facts are in [[Red Onion Overview]]. > [!info] At a glance > - **What** — telemetry capture, enrichment, routing and retention, starting with DNS > - **Core idea** — the cost of keeping data and the cost of analysing it have been welded together, and they do not have to be > - **Mechanism** — mirror the resolver rather than change it > - **Round** — indicative ~$600k, mostly enterprise sales and channel hires > - **Stage** — product in place, pilots in motion across three continents, no paid production deployment yet --- ## 1 · DNS sees things first Malware calling home, shadow IT, exfiltration leaving the jurisdiction, algorithm-generated domains. All of it appears in a lookup before the connection is made, on every device, with nothing installed. > [!quote] From the company's own framing > "Nobody keeps what DNS reveals." - → [[What DNS Traffic Reveals]] - → [[DNS as a Security Signal]] - → [[DNS Resolution Mechanics]] ## 2 · Keeping it is priced by volume, so it gets thrown away Ingestion pricing means cost decides what is retained instead of risk. Teams sample at peak, which is when the unusual traffic appears, and the gap shows up later as a slow investigation or a missing audit record. > [!warning] Stated figures > Millions of events per second in carrier environments. 40 to 60% of DNS logs dropped under volume pressure. Searchable retention around 30 days. - → [[The Cost of Keeping Everything]] - → [[Separating Capture Economics from Analytics Economics]] - → [[Position Next to SIEM and Data Lake]] ## 3 · The resolver is the box nobody will let you touch DNS is load-bearing and fails loudly, so changing it is the hardest sale in infrastructure. Taking a copy of the stream avoids the problem entirely: the resolver behaves exactly as before, and TelemetriX reads the mirror. ![[Screenshot 2026-09-13 at 23.53.33.png]] - → [[Mirroring Instead of Touching the Resolver]] - → [[DNSTAP and Where the Data Comes From]] - → [[Encrypted DNS Favours Resolver-Side Collection]] - → [[What TelemetriX Does]] ## 4 · The copy stays inside the boundary Today the answer is given and then gone, and often the resolver belongs to someone else in another jurisdiction. With a mirror, the organisation holds its own behavioural record. That is a compliance argument and a sovereignty argument at the same time. > [!important] Why the resolver is a sovereignty question at all > Whoever runs it holds a complete log of intent for every device behind it. It is the reason states fund their own resolvers. - → [[Sovereign Intelligence and the Copy That Stays]] - → [[The Resolver as Sovereignty Chokepoint]] - → [[Regulation as the Timing Argument]] - → [[Data Embassies]] ## 5 · What compounds Cost reduction opens the door. Data gravity and compliance dependency are what keep it open: each month adds history that exists nowhere else, and audit processes get built on top of it. > [!tip] > A saving can be competed away. Three years of evidence a regulator has already accepted cannot. - → [[Why It Becomes Hard to Remove]] - → [[One Pattern, Many Data Sources]] - → [[data gravity]] - → [[Switching Cost Design]] ## 6 · How it sells Four buyer motions on one platform, entered through whichever pain is loudest in the account, with pilots running in Africa, Singapore and Belgium. - → [[Who Buys and Why]] - → [[Go-to-Market Across Three Regions]] - → [[The Business Model]] - → [[The Founder and the Relationship Channel]] --- ## The company, compressed > [!abstract] Red Onion Systems > Founded and led by **Phares Kariuki**, previously VMware East Africa at Westcon, then founder of **Angani** (Sub-Saharan Africa's first public cloud provider), **Node Africa**, and **Pure Infrastructure**. Product **TelemetriX** is in place and demoable. Active PoC path with a Singaporean telecom operator, early compliance-led discussions with a Belgian bank, demand signal from a major African telco, and **Axispoint** signed up as a delivery partner. Indicative round **~$600k** for a 12-month plan, mostly sales and channel hires. Commercials: **$80k base ACV**, 75–85% gross margin, 12–18 month sales cycle. Year 5 plan ~$25m run-rate across ~300 clients. > > **Where it stands.** Pre-revenue on production deployments. The round funds converting live pilots into signed contracts, and the milestones say so plainly. Full detail in [[Red Onion Overview]]; things still to establish in [[TelemetriX - Questions to Follow Up]]. ## Concept map ```mermaid graph TD SIG[What DNS Traffic Reveals] --> COST[The Cost of Keeping Everything] COST --> WEDGE[Separating Capture Economics from Analytics Economics] MIR[Mirroring Instead of Touching the Resolver] --> WEDGE DNSTAP[DNSTAP and Where the Data Comes From] --> MIR ENC[Encrypted DNS Favours Resolver-Side Collection] --> DNSTAP WEDGE --> PROD[What TelemetriX Does] PROD --> SOV[Sovereign Intelligence and the Copy That Stays] PROD --> POS[Position Next to SIEM and Data Lake] REG[Regulation as the Timing Argument] --> SOV SOV --> STICK[Why It Becomes Hard to Remove] POS --> STICK STICK --> EXP[One Pattern, Many Data Sources] EXP --> BUY[Who Buys and Why] BUY --> GTM[Go-to-Market Across Three Regions] GTM --> BM[The Business Model] FOUND[The Founder and the Relationship Channel] --> GTM BM --> DEAL[Red Onion Overview] DEAL --> OQ[TelemetriX - Questions to Follow Up] class SIG,COST,WEDGE,MIR,DNSTAP,ENC,PROD,SOV,POS,REG,STICK,EXP,BUY,GTM,BM,FOUND,DEAL,OQ internal-link; ``` ## DNS fundamentals Background for the whole map. Read in order if the domain is new. - → [[DNS Resolution Mechanics]] — recursive vs authoritative, the root-TLD-authoritative walk, caching and TTL - → [[DNS as a Security Signal]] — beaconing, DGA, tunneling, sinkholing - → [[DoH and DoT]] — encryption relocates the observer - → [[The Resolver as Sovereignty Chokepoint]] — a complete log of intent; DNS4EU as the clean case - → [[DNS Security Vendor Landscape]] — Infoblox, EfficientIP, Umbrella, Corelight, and the free floor ## The whole thing in one breath > [!tip] > [[What DNS Traffic Reveals]] is the earliest signal on any network, but [[The Cost of Keeping Everything]] means most of it is dropped, and the one fix nobody will authorise is changing the resolver. TelemetriX takes a copy instead through [[Mirroring Instead of Touching the Resolver]], which lets it split capture from analysis in [[Separating Capture Economics from Analytics Economics]], keep the record inside the boundary per [[Sovereign Intelligence and the Copy That Stays]], and become progressively harder to remove through [[Why It Becomes Hard to Remove]]. The saving opens the account; the archive and the compliance dependency keep it. ## Related - [[Security MoC]] - [[Cryptography MOC]] - [[Telco MoC]] - [[Sovereign AI Positioning]] - [[Defensibility Principles MOC]] - [[Technical DD Framework]] - [[VC Moc]]