Nyx | Autonomous Fraud Operations for banking powered by AI

Autonomous Fraud Operations

AI gave attackers scale. Nyx gives you autonomy.

Nyx is the foundation system for Autonomous Fraud Operations, already running in production within regulated environments at leading European banks since December 2025.

See Nyx running on your data →
The Operating Model Gap

Your AI is in pilot.
The fraud targeting your customers is not.

Fraud operations teams have adopted AI tools, but each tool runs in a separate silo, each requiring human effort to integrate, manage, and correlate. The resulting gap is increasingly personal financial liability for named executives.

The operating model itself is the constraint.

Human-bounded operations
4–5 hours Per case, industry baseline
Industry baseline autonomous operations
<5 min Full investigation, every case
77x faster Production validated · Dec 2025

The structural shift

Autonomous Fraud Operations.
A different operating model.

Nyx makes Autonomous Fraud Operations real. Detection, investigation, decisioning and response run continuously at machine scale, without human throughput being the rate-limiting factor. Analysts move from processing volume to governing outcomes.

Your team governs the function. Nyx executes it.

Event Received

User USR-*****7291
Date 2025-01-10
Source FXDR Platform
Label confirmed-fraud
47 sessions

Autonomous Operations

Investigation Analyst
Full attack chain reconstruction
Campaign Hunter
Correlates isolated cases
Intelligence Writer
Transforms analysis into decision-ready output
Security Posture Agent
Monitors and tunes all active rules

Ready for Review

Recommendation
Recommendations
Add IP 2.49.17.46 to blocklist TECHNICAL
Contact customer—explain, reset credentials HUMAN
Escalate—campaign affects 9 victims ESCALATION
Attack timelines
Attack Timeline
14:29:31 Fraud Session Starts Device enrolled via compromised creds
14:31:04 BLOCKED IP 2.49.17.46 flagged
14:33:17 Session Escalated Cross-victim correlation triggered automated escalation protocol…
14:34:52 Campaign Linked 9 accounts linked to same attacker infrastructure node…
14:37:09 Accounts Frozen Affected accounts suspended pending manual review…
14:41:55 Alert Dispatched SOC notified, case ticket #FR-2241 opened…
14:53:12 RESOLVED Infrastructure block confirmed, 9 accounts secured…
Investigation report
Reports
🇮🇹 🇬🇧 🇪🇸
In the analyst's working language
The investigation identified a coordinated multi-stage attack targeting the mobile banking application. The attacker enrolled a fraudulent device using stolen credentials, then conducted account takeover across 9 user accounts within an 18-day window. Session analysis reveals automated tooling consistent with an organised fraud campaign originating from Eastern European IP infrastructure…
Read more Attack timelines
The architecture that makes everything possible

The complete operational picture. Structured before any autonomous reasoning begins.

Before Nyx produces a recommendation, every actor, channel and interaction across your institution's digital environment is classified, enriched and correlated into structured, auditable evidence in full operational reality.

What you get

Operate at scale. Respond at speed.
Report with confidence.

Autonomous Fraud Assessment

Trigger: Every event, fully investigated. — No sampling
  • Full causal chain reconstructed from first event to recommended action
  • Structured, evidence-ready output produced automatically, without manual assembly
  • Prioritised recommendation with confidence level and impact analysis
  • Explainable, auditable, and replayable. Complete for regulatory review

Continuous intelligence

Trigger: Pattern detection running 24/7. Intelligence generated as it develops.
  • Identifies campaigns before monetisation
  • Maps shared infrastructure across attacks
  • Surfaces high-probability targets
  • Campaign intelligence delivered as it develops

Autonomous Risk Optimisation

Trigger: Always running. Controls adapt without manual intervention.
  • Tracks risk drift across portfolio
  • Detects weak controls and blind spots
  • Recommends posture adjustments as threats evolve
  • Decision-ready — not a data dump. Everything prepared for immediate action on review.

Evidence-complete.  Cross-correlated.  Action-specific.  Explainable.

Nyx identified attacks we had not detected and improved our defences automatically. What it delivered independently exceeded expectations.

Production Validation  ·  December 2025  ·  2M+ live users  ·  EU Tier-1 institution

<5 min Average full assessment time Average 2.5–3 minutes
Zero Analyst hours per case
2M+ Live users protected EU tier-1 scale · regulated environment
Continuous Improvement

A defended position that compounds.

Nyx builds institutional memory of your threat environment: attack history, behavioural patterns, and attacker infrastructure.

Nyx sharpens with every case completed and every campaign identified.
01 — Observe Nyx executes autonomously
02 — Understand Intelligence delivered,
decision-ready
03 — Act You decide — your team
owns strategic oversight
04 — Evolve Nyx sharpens

In Production

See Nyx running on your data.

Already running at leading European Financial groups. Onboarding select institutions next.

  • ✓ Autonomous Fraud Operations in production. Below 5 minutes per assessment, average 2.5–3 minutes, zero analyst hours.
  • ✓ Every fraud event assessed end-to-end. Full coverage.
  • ✓ Every recommendation explainable, auditable, and impact-analysed before any action is taken.
  • ✓ Single-tenant deployment: your data never touches a shared graph.

You can unsubscribe from these communications at any time by following the link that you will find at the bottom of any e-mail received from us or by sending an e-mail to privacy@cleafy.com.

We’ll respond within 48 hours.

Already operating on live fraud data.

“This is exactly what I’m missing — my team doesn’t do this.”— Head of Fraud Operations, upon seeing first Nyx executive summary

“We used to triage. Now we decide.”— Senior Fraud Analyst, Major European retail bank

“What used to take my team a full day, Nyx completed in under 4 minutes.”— VP Fraud Defence, European Financial Institution

Frequently Asked Questions

Autonomous Fraud Operations

Autonomous Fraud Operations (AFO) is an operating model in which the full fraud lifecycle — detection, assessment, decisioning, and response — runs at machine scale without requiring human intervention at every step. In a traditional model, every alert needs an analyst to open it, work it, and close it. In AFO, the system runs the process continuously. Human experts move to oversight: setting strategy, reviewing outcomes, and handling consequential decisions. The ceiling on fraud operations is no longer headcount.
Co-pilots and case investigation tools make analysts faster at what they already do. Nyx changes what they do. Automation keeps humans in the processing chain — every case still needs someone to start it, run it, and close it. Nyx runs the full fraud lifecycle end-to-end, at machine scale. Analysts move from throughput to oversight.
Every actor, channel, and signal is already structured and connected before any AI reasoning starts. Specialist agents run the full fraud lifecycle in parallel — no prior training required. Nyx doesn't rely on a generic model trained on industry data. It builds knowledge of your specific threat landscape: the attacker infrastructure, behavioural patterns, and account relationships particular to your environment. It doesn't start from zero on each case. The output is a complete assessment, not a risk score.
Under 5 minutes, end to end, versus four-plus hours manually. And it applies to every signal, not a sample, so backlogs don't build.
Yes. Nyx operates at the campaign level, not just the individual case level. It continuously correlates patterns across accounts, devices, channels, and time to identify coordinated activity that a case-by-case review would miss. When a new fraud pattern emerges, Nyx identifies it as a connected campaign rather than isolated incidents.
It's attack-agnostic: it investigates the facts of each case rather than matching signatures. That covers account takeover, scams, fraudulent device enrolment, malware- and RAT-driven fraud, and coordinated multi-stage campaigns.