Rachel Clark spent the first half of her career building things that had to work. 

In 1987 she enlisted in the United States Marine Corps; from there she moved into the U.S. Navy, where she built inertial navigation systems for submarines and surface ships, the guidance hardware that tells a vessel where it is when nothing else can. That work became the foundation of a four-decade career spanning engineering and security. 

Today, she's applying the same instinct, building systems that have to operate precisely all the time, to a different problem: cybersecurity that doesn't wait for a human to notice something's wrong.

Three years ago, Clark founded Skadi Cyber Defense in Bracebridge, Ont, in the heart of Muskoka cottage country. She built the company to tackle a problem she saw scaling faster than most defenders could keep pace with. 

"I started Skadi three years ago because I was looking for a way to solve some pretty big cybersecurity issues," Clark says. "What we've done here is we've built a new kind of artificial intelligence that experiences the world around it, forms its own concepts based on what it sees and acts on those concepts autonomously. It's not a large language model like you see in ChatGPT and Claude. What we’ve built is a living cyber defence."

Clark's explanation of how Frostbow works leans on a deliberately human analogy. Rather than training on a fixed dataset, she says, the system builds its own understanding the way a person does. 

"It works very similarly to how the human brain works and how it functions," Clark says. "If you're a child, and you're starting to experience the world around you, you'll go to a stove and touch it and say that's hot. You develop a concept around hot and a concept around pain, and over your lifetime those concepts become more refined. We start to make relationships between concepts: hot doesn't always equal pain. That's what Frostbow does, only within a cybersecurity environment. Just as a child builds a mental model of the world through experience, Frostbow builds a precise map of the systems it protects, forming its own security concepts from what it observes, and acts on that knowledge autonomously."

That map is what lets it recognize when something doesn't belong. Clark illustrates the idea with a second scenario, one she returns to often when explaining Frostbow to non-technical audiences. 

"Consider a person isolated in a room," Clark says. 

"Given enough time, the human brain would start to notice little idiosyncrasies about the room: the number of dots in the ceiling tile, or the pieces of dirt on the floor. It would build a precise map of what your room looks like. If an ant crawled underneath the door, it would register that ant as something anomalous, and trigger a response. Frostbow does precisely that but within a cybersecurity environment, at sub-second speed."

The system doesn't stop at recognizing a threat once. It propagates what it's learned across every node it protects. "When one node identifies a threat, it shares that intelligence across the entire network,” Clark says. “The description, the behaviour, the attempted action. Every other node is immediately informed and prepared to respond.”

For a defence and security audience, the obvious question is how much of that response happens without a person in the loop. Clark says the system is built to defer, not just to act. 

"Whenever Frostbow encounters a decision it cannot make with sufficient confidence, it escalates for human context," Clark says. "That conservativism is by design. Using the ant analogy, if it detects something unfamiliar, it will flag it for review. Once informed, it incorporates that knowledge going forward. Human accountability is always present, as much or as little as the operator requires."

Clark's pitch to the defence sector isn't only about detection speed. It's also about paperwork, and the growing compliance burden facing every company in the DND supply chain. 

"There are significant new requirements coming from the CPCSC that companies in the defence supply chain have to conform to," Clark says. 

"Part of our market strategy is to approach those companies and show them how Skadi can help them with some of those requirements for CPCSC. If you do business with the Department of Defence, compliance is not optional. The CPCSC is currently in phase one, which is self-assessment, but phase two is approaching and will require demonstrable controls and systems in place. Our focus is not only on selling directly into DND and NATO, but also on helping defence supply chain companies achieve and maintain compliance as those requirements evolve. "

It's a pitch aimed squarely at the same UxS and defence-supply-chain companies Vanguard has been tracking as they grapple with certification timelines, and it suggests the compliance burden itself is becoming a viable market wedge for cyber vendors, not just a cost centre for primes and subcontractors.

Skadi is chasing that opportunity aggressively. A recent contribution from FedNor is helping fund the push. 

"That's helping us to accelerate our action towards DND and NATO," she says.

Defence is one of three markets Skadi serves, alongside enterprise and the private sector. 

That diversification is deliberate, and is what allowed Clark to build the company on her own terms.

"Defense sales cycles are insanely long," Clark says. "Building a diversified business means we are not waiting on any single market to move."

Clark is candid that Bracebridge is an unusual home base for a company pursuing NATO and DND contracts. It's a region better known for cottages than code. 

"I'm surrounded by farms and tourism. Trade and tourism is mainly here," Clark says. "But there's good reason to start in Muskoka, because it's centrally located to Ottawa and Toronto at the same time. We are developing our platform to serve mining operations in northern Ontario, around North Bay and Sudbury, so being centrally located matters. I think the Muskoka, North Bay, Sudbury corridor is going to be a tech corridor."

On the competitive landscape, Clark is unambiguous about where she thinks Skadi stands. She sees the company's head start as effectively uncatchable. 

"To our knowledge, no other company has deployed this architecture in cybersecurity production," Clark says. "And even if a competitor began building it today, that gap is not closeable by throwing resources at it. Learning is incremental. You cannot accelerate it by adding more computers.”