Hamburg, November 5, 2026. – It’s just past 2:00 a.m. when the first login attempts start coming in on a server: „root,“ „admin,“ „backup.“ Forty attempts in one minute. Taken on its own, this would be a log entry that no one reads. But the same attacker had already tried this with two other companies shortly before. A single server cannot recognize this pattern. A network of many servers can.

This is exactly where Mesh Intelligence comes in—a proprietary solution developed by Hamburg-based OIT.One GmbH. The connected servers continuously report suspicious activity to a central authority, where the reports are analyzed across all systems. If an attacker’s IP address exceeds defined thresholds, it is blocked. The block then applies to all participating systems and, upon request, directly within the customer’s perimeter firewall as well. If the attacker tries to target the next system, they will no longer receive a response.

Together, Not Alone

„A single server detects an attack. A mesh detects the pattern,“ says Tim Stephan Schulze, CEO of OIT.One GmbH. „Every attack experienced by one of our participants makes everyone else more secure. It’s basically herd immunity for IT infrastructure.“

The blocks are intentionally time-limited and are extended in the event of repeated attacks. Administrators can manually lift them at any time. A whitelist always takes precedence, ensuring that authorized access—such as remote maintenance—is not accidentally blocked.

Proven in an emergency

Just how important such an additional layer of protection is became clear in October 2026. The „PwnEscape“ kernel vulnerability revealed a critical flaw in virtualization environments for which older system versions had not received a patch. Until the affected systems were updated, OIT.One temporarily provided additional protection for its own infrastructure using Mesh Intelligence. This ensured coverage of precisely the critical time window between the disclosure of a vulnerability and its resolution.

AI as a Tool, Not a Black Box

Mesh Intelligence relies on artificial intelligence, but does not make it the sole decision-maker. The foundation is a rule-based, deterministic set of rules. In addition, AI supports the analysis and helps classify anomalies more quickly. „For us, AI is a powerful tool, but not an end in itself,“ says Schulze. „We combine it with clear rules so that every action remains justifiable and verifiable. That is exactly what auditors require under ISO 27001 or NIS2, and that is exactly what our customers expect.“

Join in or just trust us

Companies can benefit in two ways. They can actively integrate their own servers into the mesh: Integration is performed via an installation script, and depending on their preferences, the systems can report attacks, adopt the shared blocklist, or do both. Customers whose systems are hosted by OIT.One are automatically protected without any additional effort.

In the future, Mesh Intelligence is also expected to integrate with the OIT Service Desk and support device inventory management there as well.