No cloud dependency
Nothing is uploaded. Nothing depends on a vendor cloud. An air-gapped workstation keeps every capability. Air-gap is the design, not a separate edition.
Local intelligence. Zero cloud.
EVOLVING INTELLIGENCE
THAT YOU OWN
AND CONTROL
AegisAI is fully local Windows endpoint protection. Five layers detect, explain, contain and recover on the machine. Nothing is uploaded. Air-gap is the default.
- 100% LOCAL
- NO CLOUD
- GUIDE THE AI TRAINING TO BETTER FIT YOUR NEEDS
Click anywhere on these five layers to make them interactive.
Layer 5 is shown below until you do.
Layer 5
Management & notifications
This build. WinUI 3 already explains every behavioural incident on the machine, for the person at the keyboard. The Model fine-tuning page is in the app: it shows what owner training is for and how it will work. Its controls are not live in this proof of concept — no document is read, no training file is built, and no model is changed.
Full specification. WinUI 3 settings UI, an alert dispatcher with templated and sanitised payloads, a DPAPI credential vault, and the live Model fine-tuning page plus personal Sigma, YARA and signature rules. Alerts and status move between this layer and the response engine. The owner chooses engines and their order, how far response may go on its own, and what both language models have been taught.
- Plain-English incident, mapped to MITRE ATT&CK, for the person at the machine
- Rules, authors, and evidence travel with the narrative
- Owner fine-tuning and personal rules sit here — an industry first, switched on in the finished product
Cloud-centred platform
- Analyst console — people investigate and decide
- Vendor platform, usually its cloud — data lake, correlation, threat hunting, generative assistant
- Endpoint agent — on-device detection and enforcement
Much of the understanding happens away from the machine.
AegisAI
- Plain-English incident, for the person at the machine
- Graduated response, rollback, signed forensic archive
- Triage Llama 3.2 3B + deep Llama 3.1 8B, fine-tuned by AegisAI and by you
- Rules, signatures, edge AI, sub-100 ms
- Signed, chained telemetry and WFP enforcement
Nothing leaves the box — and nothing needs to.
Privacy by design
No data retention. Telemetry is signed and hash-chained on the machine. The models run on the CPU.
You take part
In this prototype the rules decide and the models only explain. In the finished product you add your own policy, and the fine-tuned models also decide.
Safety floor
Quarantine is restorable. Processes are suspended, not killed. Critical processes and validly signed binaries are left alone.
AegisAI — Your intelligence. Your infrastructure. Your control.
Why it can disrupt
AI on the machine, trained with the owner, priced as a perpetual licence. The optional retainer starts at USD 5 a month.
Beside the market
SentinelOne first, then the platforms that come closest — and the gap none of them fill.
Download the prototype
Windows 10 and 11 installer, plus the preparation guides. Sandbox or virtual machine only.