Telemetry flows up. Decisions, lockdowns and policy updates flow down. When a threat is confirmed, AegisAI contains it, remediates it and rolls the damage back — automatically, or after one-click specialist approval — and escalates anything uncertain to a human review queue.
ETW and Sysmon, signed and chained at the collector. AegisAI’s WFP driver is built and held back until it is signed.
Adds WFP network blocking before a packet leaves, MiniFilter ransomware-entropy signals, and a PID-controlled adaptive filter.
Edge AI
Two ONNX scorers: supervised behaviour and unsupervised novelty.
Isolation Forest, autoencoder, INT8 sequence model, and a GNN process-graph scorer under Windows ML, on the NPU where there is one.
Language models
Llama 3.2 1B triage and a fine-tuned Llama 3.2 3B. In this prototype they explain and do not decide; in the final product they decide too, and find 0-day threats nothing else detects today.
Always-loaded Llama 3.2 3B triage at about 80 ms. Llama 3.1 8B on demand. Their verdict and confidence drive the response, and both can be fine-tuned by their owner on the owner’s own policy and incidents.
Detection content
157 curated Sigma rules, YARA rules and ClamAV signatures. The 157 rules in this prototype become many more in the final release, and they keep getting updated regularly.
Many more rules than this prototype’s 157, kept current by regular updates, plus the customer’s own Sigma, YARA and other rules and signatures, which no update ever overwrites.
Response
Restorable quarantine and process suspension behind a safety floor, plus pause, close, force-kill and kill-tree controls offered only when they can work, and a Declare Safe that reverses what was done to a file.
A graduated ladder — Contain, Remediate, Rollback, Forensic Lockdown — one-click or automatic, per severity.
Recovery and evidence
Detection journal and an action audit, append-only except for files a user declares safe.
Surgical rollback from shadow copies and the signed change-journal. Sealed, signed .aegis forensic archives.
Learning
Fixed models, shipped with the product. The Model fine-tuning page is present; its controls are not yet live.
A gated self-learning loop: signed specialist feedback, LoRA adapters over a frozen golden model, shadow evaluation of every high-confidence verdict — and direct fine-tuning by the owner from the Model fine-tuning page.
Fleet
One endpoint.
AegisAI grows into a full fleet tool for SMEs: an optional on-premises console for up to 250 endpoints, FIDO2-gated, over endpoint-initiated mTLS. Everything stays inside the company. Endpoints lose nothing when the console is unreachable.
Layer 5
Management & notifications
This build. WinUI 3 already explains every behavioural incident on the machine, for the person at the keyboard. The Model fine-tuning page is in the app: it shows what owner training is for and how it will work. Its controls are not live in this proof of concept — no document is read, no training file is built, and no model is changed.
Finished product. WinUI 3 settings UI, an alert dispatcher with templated and sanitised payloads, a DPAPI credential vault, and the live Model fine-tuning page plus personal Sigma, YARA and signature rules. Alerts and status move between this layer and the response engine. The owner chooses engines and their order, how far response may go on its own, and what both language models have been taught.
Layer 4
Autonomous response & SOAR
This build. Restorable quarantine and process suspension behind a safety floor. Each incident offers only the actions that can work at that moment: pause, resume, close, force-kill, or kill-tree — children first, and the whole tree refused if Windows needs any member. A file can be quarantined, restored, deleted together with the files the program wrote (every path listed), or declared safe, which reverses what was done and removes the incident from the journal, the audit and the logs. A signed program a behavioural rule matched cannot be declared safe.
Finished product. A confidence-and-severity router picks a graduated ladder — Contain, Remediate, Rollback, Forensic Lockdown — one-click or fully automatic, per severity. Low confidence diverts to a human review queue. Every rung is rate-limited, written to the tamper-evident chain, and reversible where the operation allows. On any action the Forensic Packer seals a signed .aegis archive.
Layer 3
Local AI core & storage
This build. A stock Llama 3.2 1B gives every behavioural incident a first read within seconds. A deterministic router ranks the work. A Llama 3.2 3B fine-tuned for AegisAI writes the authoritative explanation, mapped to MITRE ATT&CK. In this prototype they explain and do not decide. That is a deliberate rule: models not yet trained on real endpoint telemetry cannot override a detection, a severity, or a response.
Finished product. Always-loaded Llama 3.2 3B triage at about 80 ms and about 1.7 GB, handling about 95% of promoted events. Deep Llama 3.1 8B on demand, about 4.5 GB and about 1.2 s cold start, for uncertain and novel cases. Their verdict and confidence drive the response. Both can be fine-tuned by the owner on the owner’s own policy and incidents. DuckDB, a custom policy engine (RAG), a GNN graph scorer, and a gated self-learning loop sit beside them. The pipeline also finds 0-days nothing else detects today, and threats defined by this machine or, in SME Edition, by company policy.
Layer 2
On-device edge AI
This build. Two ONNX scorers: a supervised behaviour model and an unsupervised novelty model. A threat missed by one layer can be caught by another. Agreement across layers raises an incident’s severity.
Finished product. Windows ML and ONNX Runtime: Isolation Forest, autoencoder, INT8 LSTM/TCN sequence model, and an ONNX GNN scorer, in under 100 ms, on the NPU where there is one. Signed events come up from the collector; feature vectors go up to the language models.
Layer 1
Data collection
This build. A .NET collector ingests ETW and Sysmon, signed and hash-chained at the source. AegisAI’s own WFP callout driver is developed and working, and held back until Microsoft attestation signing is in place. Until then the prototype observes network connections through Sysmon — observation, not enforcement.
Finished product. .NET 10 collector: ETW providers for process, file, registry, image and PowerShell, Sysmon ingestion, and the WFP callout that blocks before a packet leaves. Two-stage adaptive filter and a Telemetry Integrity Module (Ed25519 signing and chain). The finished product adds MiniFilter ransomware-entropy signals and a PID-controlled adaptive filter.
A dual-LLM pipeline that explains today — and will decide once trained
In this build the two Llama models only explain. That is a deliberate rule, not a limit of the design: models that have not yet been trained on real endpoint telemetry should not be allowed to override a detection, a severity or a response, and here they cannot.
First read of every behavioural incident, within seconds.
Authority · fine-tuned Llama 3.2 3B
Writes the explanation, mapped to MITRE ATT&CK. A deterministic router ranks the work. Neither model can override a detection, a severity, or a response.
Finished product — decide when earned
Triage · Llama 3.2 3B, always loaded
About 1.7 GB RAM · about 80 ms · about 95% of events. Own LoRA. Frozen golden baseline.
Deep · Llama 3.1 8B, on demand
About 4.5 GB · about 1.2 s cold start. Own golden model and LoRA. Used only for low confidence or novel cases.
From layer 2 — promoted events and feature vectors
Triage tier — always loaded
Returns a natural-language verdict and a confidence score. Shadow-compared with the frozen golden model before any response.
No — about 5% · low confidence or novel
Deep tier writes the longer attack storyline
If confidence stays low, the case goes to the human review queue. A low-confidence verdict never destroys anything.
Yes — about 95%
Straight to the response engine
One-click mode prepares the action for a specialist. Automatic mode acts only once confidence is calibrated.
Layer 4 — verdict, confidence, and the attack storyline
Deciding is earned, and the finished product fences it in. Learning happens only through signed specialist feedback that passes a Feedback Integrity Gate, or through the owner’s own fine-tuning on the Model fine-tuning page, where every adapter is tested on held-back examples before it is used. Base weights are never modified, only LoRA adapters layered over a frozen golden model. On every high-confidence detection the golden and fine-tuned models are compared, and a divergence is flagged before any response is taken. A low-confidence verdict never destroys anything — it falls back to containment and the human review queue.
Figure 6 — two specialists, one gated learning loop. Nothing already learned is forgotten.
Triage — Llama 3.2 3B
Fine-tuning buys speed and calibrated confidence. The gatekeeper.
Deep — Llama 3.1 8B
Fine-tuning buys grounding and storyline fidelity. The specialist.
01Real incidents — labelled windows from the machine
02Feedback integrity gate — signed specialist feedback, or the owner’s own reviewed items
03LoRA training — base weights frozen
04Held-out test — unseen techniques and a benign holdout
05Shadow evaluation against the frozen golden model
