FOR JEREMY — CONFIDENTIAL
RungsX
The first product built on Pearl's causal framework — from research to production
Mark Gentry · 1580358 B.C. LTD. · April 2026
The Problem No One Solved
25 Years of Data. Still No Causation.
You've spent 25 years building data systems. Everything you've built — every log pipeline, every schema, every analytics layer — operates at the same level: observation. What happened? How often? What correlates with what? That is Rung 1 of Pearl's Ladder, and it's where the entire data industry lives.
Judea Pearl won the Turing Award in 2011 for proving that you cannot derive causal relationships from statistical data alone — and for providing the mathematics to actually do causal reasoning. His framework has three rungs. The industry has spent 15 years at Rung 1. No one has shipped Rungs 2 and 3 as a product. Until now.
The gap: A log pipeline tells you that PsExec ran on 14 hosts in 40 minutes. It cannot tell you that this is stage 4 of a ransomware kill chain, that the attacker has 6 hours of access remaining, and that isolating one specific network segment right now reduces encryption probability from 94% to 4%. That calculation requires causal reasoning — not correlation. That is what RungsX produces.
Who Pearl Is and Why It Matters
The Science Behind the Engine
Judea Pearl is a computer scientist and philosopher at UCLA. His 2011 Turing Award citation — the Nobel Prize equivalent in computing — recognized his work on probabilistic and causal reasoning in artificial intelligence. His book The Book of Why (2018, co-authored with Dana Mackenzie) is the accessible version of the framework; his technical text Causality (2000, 2nd ed. 2009) is the mathematical foundation that RungsX is built on.
Pearl's central argument is that causation is not a statistical concept. No amount of data, no matter how large, can tell you whether X causes Y — it can only tell you that X and Y are correlated. To reason about causation you need a separate mathematical object: a causal graph (a Directed Acyclic Graph, or DAG) that encodes the assumed causal structure of the domain, plus a calculus for reasoning over it. That calculus is Pearl's do-calculus.
The Causal Graph (DAG)
The domain model that makes reasoning possible
A directed acyclic graph where each node is a variable (e.g., "EDR policy," "execution event," "lateral reach") and each edge is a causal relationship ("EDR policy set to Monitor allows execution to proceed"). The graph encodes what causes what in the domain. RungsX builds and maintains these graphs for each vertical — security, civil rights, LSAT, healthcare. The graph is the IP. The reasoning engine runs over it.
The do-calculus
The mathematics of intervention
Pearl's notation do(X=x) means "we intervene and set X to x" — as opposed to merely observing that X=x. This distinction is everything. Observing that patients who take a drug recover more often does not mean the drug caused the recovery (they may be healthier patients). do(drug=yes) forces the intervention regardless of patient health. RungsX uses do-calculus to score every containment or response option as a causal intervention — before the team acts.
Why LLMs cannot do this: A large language model trained on all of Pearl's papers still cannot perform do-calculus correctly on a novel domain. It will produce fluent, confident, wrong answers — because it is interpolating from training text, not executing the mathematics. RungsX implements the mathematics directly. The output is deterministic and auditable. It does not hallucinate because it is not predicting — it is computing.
The Framework
Pearl's Three Rungs — Plus One
Pearl describes three levels of causal reasoning as a ladder. Each rung requires more information and more sophisticated mathematics than the one below it. Each also answers a qualitatively different kind of question.
1
Association
"What is? What happened?"
Observational data. Conditional probability. P(Y | X) — the probability of Y given that we observe X. Every statistical model, every ML system, every log analytics platform, every LLM operates here. Powerful, but fundamentally limited: observation cannot establish cause.
Every AI product today
2
Intervention
"What if we do X?"
Pearl's do-calculus. P(Y | do(X)) — the probability of Y if we force X to happen, regardless of what normally causes X. Requires a causal graph, not just data. RungsX uses this to score containment options: "If we isolate this segment, what is the probability ransomware deploys?"
RungsX — live
2.5
Anticipation
"What happens next — before it happens?"
Novel RungsX extension. Streams do-calculus inference continuously between decision points — projecting the next causal stage in real time. Provisional patent filed. This is not in Pearl's original framework. It is a new contribution: turning Rung 2 from a query-response system into a continuous forward-projection engine.
RungsX only — patent pending
3
Counterfactual
"What would have happened?"
The hardest rung. Requires a fully specified structural causal model. P(Y_x | X=x', Y=y') — the probability that Y would have been different if X had been different, given what we actually observed. This is what produces the post-incident report: "If EDR policy had been Block, the breach would not have occurred."
RungsX — live, 96.96% benchmark
Why Rung 3 is hard: Counterfactual reasoning requires reasoning about worlds that did not happen. You need to know not just what the causal graph looks like, but what the structural equations are — the precise functional relationships between variables. Most domains don't have these. Building them requires deep domain expertise plus the mathematical framework. That combination — domain knowledge + Pearl's SCM framework + a working implementation — is what took years to assemble and what no competitor has.
The Proof
Benchmarks
CLadder — Causal Reasoning
96.96%
Theoretical ceiling: 98.6% (7 known dataset bugs). Within 1.6% of the mathematical maximum. GPT-4 scores ~65%.
CausalEng — Adversarial Chains
100%
Chains up to 100 nodes. Trained on 50. Generalizes to 2× the training domain. Zero failures on adversarial inputs.
BIG-Bench Hard — Coverage
27/27
Full coverage. 6,508 of 6,511 questions. Every category of structured reasoning in the standard evaluation suite.
What the Engine Discovered on Its Own
Two Findings That Weren't Planned
When you implement Pearl's full framework correctly, things emerge that you didn't design for. Two findings from RungsX that are worth knowing:
Emergent Altruism — Ethics Without Training
The causal engine derives moral responsibility from structure alone
RungsX was given 7 ethical dilemma scenarios — including classic cases like "kill one person to save five." No ethics training. No rules. Just the causal framework. The engine's answer in every case: the person who initiates the causal chain that leads to harm bears the causal responsibility — regardless of intent or outcome count. 7/7 scenarios consistent.
Why it matters: This is not a programmed rule. It is what the causal framework computes when you ask it to trace responsibility through a causal graph. It has direct implications for AI safety, legal liability, and autonomous systems.
CLadder Honest Benchmark Protocol
We found and removed 168 keyword giveaways from the standard test
The standard CLadder benchmark — the industry test for causal reasoning — contained 168 questions where the correct answer could be inferred from keywords alone, without any actual causal reasoning. A model could score high by pattern-matching the question text. We identified these, removed them, and established a new "honest" benchmark protocol.
Why it matters: Our 96.96% score is on the honest benchmark — not the inflated one. Most systems reporting CLadder scores are partially measuring heuristics. Ours is measuring actual Rung 3 reasoning.
Why Your Background Connects
You've Built Adjacent to This Before
This isn't a pitch. It's a recognition. Look at what you've already done and where RungsX sits on top of it.
LogSavvy — Director of Product (2006–2008)
Log management and analysis. The RungsX security platform is a causal reasoning layer on top of exactly this problem. You built the data collection side. We built the reasoning side.
DIRECT
Sensage — Senior Data Architect (2003)
You designed the "Security Schema" for normalizing events from IDS systems, firewalls, routers, email servers. The RungsX log parser ingests exactly these sources — CrowdStrike, Splunk, Sentinel, SentinelOne, Sysmon. You built what RungsX reads.
DIRECT
Distributed Systems + Cloud + DevOps
The causal engine is built. What it needs next is the infrastructure layer — multi-tenant deployment, API hardening, real-time log ingestion at scale. That is a distributed systems problem, not an AI problem.
ARCHITECTURAL FIT
Patent Holder
You understand what it means to have novel IP with no prior art. Rung 2.5 (Anticipated Intervention) is exactly that — a novel extension of Pearl's framework not published anywhere. Provisional filed. Needs to convert before any paper goes public.
IP ALIGNMENT
The Full Market
Every Domain Where Causation Is the Missing Layer
The RungsX reasoning engine is domain-agnostic. The same four-layer architecture — Situation Scan, Decision Guide, Foresight Engine, Evidence Analysis — runs on any domain where you can build a causal graph. The IP is the engine and the patent. The go-to-market is the domain models. We build one, it works. Then we build the next one. Here is the full picture of where this goes.
The core pattern: In every domain below, the industry has built powerful data and correlation systems (Rung 1). Nobody has shipped Rungs 2, 2.5, and 3. The gap is the same gap everywhere — just dressed in different vocabulary. RungsX fills it once, then deploys it everywhere the gap exists.
Security & Defence — Highest Urgency
Cybersecurity
MSSPs, enterprise SOCs, CISOs
Domain model built
Customer conversation open
$300B+ market
The gap: SIEMs and EDRs tell you what happened. They cannot tell you which containment action stops the breach right now, which network segment to isolate, or — after the fact — what would have prevented it. Splunk tells you PsExec ran on 14 hosts. It cannot tell you that you have 6 hours before encryption deploys.
RungsX value: Real-time kill chain stage identification. do-calculus intervention scoring across all response options. Post-breach Rung 3 report: the exact causal chain from initial access to impact, and the specific decision that would have broken the chain. Parsers live for CrowdStrike, Splunk, Sentinel, SentinelOne, Sysmon. Demo and domain model complete. Beachhead customer: Alvaka Networks (Kevin McDonald, LA — ~$168K ARR target).
Defence / Military
MoD, Five Eyes, defence contractors
UK MoD opportunity active
Q3 2026 first meeting
$800B+ global defence
The gap: Military intelligence systems produce signals and probability scores. They cannot produce an auditable causal decision trace from sensor observation to command decision to outcome — which is exactly what parliamentary oversight, courts of inquiry, and international tribunals require. Attribution in multi-domain operations (cyber + kinetic) is currently forensic guesswork.
RungsX value: Kill chain attribution across multi-domain operations. Real-time mission decision scoring. Rung 3 post-action report: the complete chain from observation to outcome with the counterfactual that would have changed it. UK Ltd (RungsX Ltd) being registered for MoD contracting. ROE accountability is a current procurement requirement — not a future one.
Autonomous Drones
Defence OEMs, BVLOS operators, MoD
Domain model built
Regulatory mandate arriving
$55B drone market by 2030
The gap: Drone AI is observation + rules. It cannot score mission decisions against causal outcomes, project detection probability 90 seconds forward, or produce the Rules of Engagement accountability trace that international humanitarian law requires for autonomous kinetic action. Every military drone manufacturer has the same accountability problem and no solution.
RungsX value: Mission decision guidance with detection-avoidance scoring. Foresight Engine projects threat envelope intersection before it happens. Rung 3 ROE audit trail: what the drone observed, computed, decided, and why — immutable and legally defensible. Swarm fault attribution. FAA/CAA/EASA BVLOS rules create a mandatory commercial market on the same timeline as the defence market.
Industrial / OT Security
Energy utilities, critical infrastructure
Framework ready
NERC CIP / NIS2 compliance
$15B+ OT security market
The gap: SCADA and industrial control systems generate massive event logs. Plant failures and OT security incidents are attributed after the fact through expensive forensics. No current system can monitor the causal state of a plant's control network in real time and project when a threshold will be crossed.
RungsX value: Real-time causal monitoring of industrial control chains. Rung 2.5 pre-emption: flags when the causal trajectory is heading toward a failure threshold before it arrives. Post-incident Rung 3 audit trail for NERC CIP, NIS2, and TSA pipeline security compliance. Same architecture as cybersecurity — different domain DAG.
Legal, Compliance & Financial Crime — Structural Demand
Civil Rights / Legal
Civil rights orgs, public defenders, MyGuardian
Live in demo
MyGuardian partnership
$400B+ US legal industry
The gap: People in civil rights encounters have no real-time guidance on their rights, and no post-incident causal record of what happened and why. Legal analysis of police encounters is produced weeks later by attorneys who weren't there. The causal chain from initial contact to escalation to outcome is reconstructed from conflicting accounts.
RungsX value: MyGuardian records the encounter. RungsX reasons over it in real time — surfacing rights at each causal stage of the encounter. Post-incident: exact causal chain from first officer contact to outcome, the intervention that would have de-escalated, and the constitutional rights triggered at each node. Six encounter types, all 50 states. Daubert-compliant causal attribution for litigation.
Insurance
P&C insurers, Lloyd's syndicates, subrogation firms
High-value roadmap
$7T global insurance industry
The gap: Claims are assessed by adjusters using heuristics. Root cause for complex losses — fires, floods, supply chain failures, cyber events — is contested and litigated. Underwriting models are correlation-based: "accounts with these characteristics have higher loss rates." Nobody knows which specific operational decisions caused the loss.
RungsX value: Rung 3 counterfactual report on every major claim: what caused the loss, what would have prevented it, who initiated the causal chain. Subrogation: identify the third-party causal agent for cost recovery — with a mathematically grounded causal trace, not an adjuster's opinion. Underwriting: causal risk model for a policy, not just historical correlation. Cyber insurance is a $15B sub-market entirely built on the same problem RungsX solves in security.
Financial Crime
Banks, payment networks, compliance
Framework ready
$50B+ financial crime market
The gap: Fraud detection is pattern matching — high-risk transaction flagged. AML is rule-based threshold alerts. Neither produces a causal chain from the first anomaly to the full fraud event. BEC (Business Email Compromise) wire fraud: someone authorized a $4M transfer. Nobody can show the causal sequence of decisions that led to that authorization.
RungsX value: Fraud causation chain — how did this account reach compromise state, step by step. BEC intervention scoring: what decision could have broken the authorization chain. AML: the causal path from source funds to this destination, not just a pattern match. Real-time intervention scoring as a transaction chain develops. The security domain model already covers BEC — extending to full financial crime requires a domain DAG extension, not a new engine.
Litigation Support
Big law, expert witness firms, litigation support
Roadmap
$40B+ litigation support market
The gap: Expert witnesses produce opinions. Courts require causation but receive correlation analysis dressed up as causal argument. The Daubert standard requires that expert testimony be based on sufficient facts and reliable methodology — statistical correlation frequently fails it when challenged. Tort liability hinges on causation that most analytical tools cannot produce.
RungsX value: Daubert-compliant causal attribution. The structural causal model produces a mathematically grounded causal trace — not an expert's interpretation of correlational data. Tort: who initiated the causal chain that led to the harm and what was the precise causal mechanism. Patent infringement: was the defendant's action the but-for cause of plaintiff's loss. The Emergent Altruism finding (causal responsibility follows the chain initiator) maps directly to established legal doctrine.
Human Systems — Large Scale, Longer Timeline
Healthcare / Clinical
Hospital systems, pharma, clinical trial sponsors
High-value roadmap
$500B+ healthcare analytics
The gap: Clinical data is almost entirely observational. Patients on drug X have better outcomes — but does the drug cause the improvement, or do healthier patients self-select for it? Diagnostic systems flag abnormal values. They cannot trace the causal pathway from initial biological event to current presentation, or score which intervention would have the highest causal impact on the specific patient's trajectory.
RungsX value: Treatment causation — what intervention changed this patient's trajectory (not just correlation with outcomes). Diagnostic chains — what biological pathway caused this deterioration. Adverse event attribution — which combination of factors (drug + comorbidity + dose + timing) caused the adverse outcome. Clinical trial design — do-calculus on treatment protocols before running a $500M trial. Pearl's do-calculus was developed partly in response to the confounding problem in clinical epidemiology. It is the natural fit.
Supply Chain / Logistics
Manufacturing, retail, 3PL providers
Framework ready
$20T global supply chain
The gap: Supply chain analytics tell you where the bottleneck is and what the current delay is. They cannot tell you what caused the disruption, which upstream decision propagated through the chain to produce this outcome, or what intervention would have absorbed the shock before it cascaded. Post-disruption reviews are narrative — "the port congestion caused delays" — not causal.
RungsX value: Disruption root cause — what was the causal origin (supplier failure, demand spike, logistics decision, weather event) and exactly how it propagated through the network. Rung 2.5 pre-emption: flags when a developing upstream condition is on a causal trajectory toward a downstream disruption, before it arrives. Rung 3 post-disruption report for insurance claims and supplier liability. Decision scoring for rerouting and inventory responses in real time.
Education / LSAT
LSAT students, law schools, test prep
App built (WhyLSAT)
iOS — near App Store
$1.5B LSAT prep market
The gap: LSAT prep teaches pattern recognition — students learn to identify surface features of argument types and guess the pattern. They do not learn to trace the actual causal structure of an argument. High scorers game the test; they don't necessarily reason better. There is no product on the market that teaches causal argument structure as a skill.
RungsX value: WhyLSAT — 50-node causal DAG of all LSAT reasoning concepts, diagnostic gap mapping, personalized causal chain explanations. When a student gets a question wrong, the system traces the exact point in the causal argument where their reasoning diverged. 122 questions covering all 50 concepts. Institutional licensing to law schools is the scale play — replacing test prep with genuine causal reasoning education.
Environmental / ESG
Energy, mining, heavy industry, regulators
Generic parser ready
$50B+ ESG compliance market
The gap: Environmental incident attribution is contested and litigated for years. "What caused the spill" is answered by competing expert witnesses on both sides. ESG reporting is correlation-based — emissions are measured, not traced to specific operational decisions. Regulators want causal accountability; they get statistical reporting.
RungsX value: Causal incident trace for environmental events — the exact decision sequence that caused the spill or emission event, the intervention that would have contained it, and who initiated the causal chain. Rung 3 report as a regulatory submission document. ESG causation: attribution of specific emissions levels to specific operational decisions, not just aggregate measurement. The generic parser (CSV/JSON) already ingests environmental sensor data — the domain DAG is the only build required.
Near-Term — Active Conversations
Where the First Revenue Comes From
Cybersecurity — Beachhead Customer
Alvaka Networks (Los Angeles MSSP)
Kevin McDonald — CEO, Alvaka Networks — has expressed direct interest. ~1,200 endpoints, 40 clients. Target: $168K ARR. The demo is live. The domain model is built. The log parsers are live. The meeting is the next step. Alvaka is the reference customer that unlocks the MSSP market.
Defence — Strategic
UK Ministry of Defence
Active opportunity. Kill chain analysis and ROE accountability are primary MoD procurement requirements. UK Ltd (RungsX Ltd) being registered to support government contracting. First meeting: Q3 2026. The drone brief and the kill chain attribution capability both map to active MoD requirements.
Legal / Civil Rights
MyGuardian Partnership
Real-time causal guidance during civil rights encounters. MyGuardian records. RungsX reasons. Six encounter types, all 50 U.S. states. Live in demo. Partnership is being structured — RungsX provides the reasoning layer, MyGuardian provides the platform and user base.
IP Milestone
Patent Conversion + Two Papers
LESA Benchmark and Emergent Altruism papers drafted and ready for submission. Provisional patent filed on Rung 2.5. Conversion to full patent is the next IP milestone — must happen before any academic publication. Once converted, both papers go out and the academic citation network starts building.
The honest ask: Twelve domains. One engine. The causal reasoning system is built and validated. The domain models are live or framework-ready. The commercial conversations are open. What the company needs next is a technical co-founder who can own the infrastructure, scaling, and systems layer — multi-tenant deployment, real-time log ingestion at scale, API hardening — so the founding architect can stay on the science and the IP. That is a very specific problem. Your background maps to it directly. The question is whether the scope of what this can become is worth your time.