What the competition cannot offer
Leading endpoint platforms already detect on the device. Correlation, hunting, and the generative AI that makes sense of an incident usually live on the vendor’s platform. In AegisAI every layer, both language models included, sits inside the endpoint.
Cloud-centred platform
Much of the understanding happens away from the machine.
AegisAI
Nothing leaves the box — and nothing needs to.
Kernel-level telemetry signed and hash-chained at the source. Detection, both language models, response, rollback and forensics all on the endpoint. A machine with no network keeps every capability. Air-gapped operation is the design, not a separate edition.
AegisAI’s own WFP callout driver blocks a connection before its first packet leaves. MiniFilter entropy signals catch ransomware-style mass encryption as it starts. The driver is developed and working, and ships in the final product once it is attestation-signed.
SigmaHQ behavioural rules, YARA on files and in memory, and ClamAV signatures give verdicts you can audit line by line. Edge models catch what no rule describes. Agreement across layers raises severity. Every rule’s author is credited, as the Detection Rule License requires. The 157 rules in this prototype become many more in the final release of the product, and they keep getting updated regularly.
The router picks the least destructive rung: Contain, Remediate, Rollback, or Forensic Lockdown. Every action is rate-limited, chained, and reversible where the operation allows. Rollback restores files and registry from shadow copies and the signed change journal. A low-confidence verdict never destroys anything.
Every incident arrives with a written storyline mapped to MITRE ATT&CK, with the rules, their authors, and the evidence. Tier-1 analysis without a SOC, delivered to the person who owns the machine.
Signed specialist feedback trains small LoRA adapters over a frozen golden model, and shadow evaluation compares the two on every high-confidence verdict before a response is taken. AegisAI adapts to what is normal on this machine, not on the average customer’s, and no data leaves to do it. The owner can drive that learning directly, from the Model fine-tuning page.
A perpetual licence with no compulsory retainer. An optional retainer, from USD 5 per machine per month, brings new rules for every engine, definitions, signatures and better fine-tuned Llama models. With no per-endpoint cloud pipeline to fund, that is a fraction of the cost of cloud XDR, fully air-gapped installs included. An update never overwrites the customer’s own rules, Sigma or any other, and never removes LoRA fine-tuning done by the customer or, in an SME deployment, by its own cybersecurity team.
The specification replaces the all-or-nothing reaction of most endpoint tools with a ladder. Rollback — the on-device equivalent of cloud storyline rollback — is the primary recovery path against ransomware-style encryption. Malicious files go into a protected, restorable store. Malicious processes are suspended, not killed, so their memory survives for analysis.
01
Contain
WFP isolation, optional process suspend. Least disruptive.
02
Remediate
Kill and quarantine. Remove persistence.
03
Rollback
Shadow copies, change journal, restore files and registry.
04
Forensic lockdown
Suspend, desktop lock, WFP block, FIDO2 unlock. Most severe.
Every rung: one-click or fully automatic, rate-limited, logged to the tamper-evident chain, reversible where possible. On any action the forensic packer seals a signed .aegis archive.
The full like-for-like comparison — detection, rollback, Purple AI, where the reasoning runs, and what it costs to own — is on its own page. It describes the finished specification, not only this prototype.
Open the comparisonA stock language model knows English, not endpoint telemetry. Sysmon event IDs, parent-child process chains, obfuscated command lines and the boundaries between ATT&CK techniques are a specialist grammar. Fine-tuning on real, labelled telemetry turns the Llama 3.2 3B triage model and the Llama 3.1 8B deep model into specialists. The AI core detection engine — the part that will catch unknown threats the rules do not name — is undergoing that fine-tuning now. It is not yet allowed to decide.
| Figure 5 | Stock general model | Fine-tuned AegisAI specialist |
|---|---|---|
| Reads telemetry | Like a well-read layperson | Like a trained analyst |
| Grounding | Fills gaps with plausible stories | Cites what the rule asserts; says “not observed” where evidence stops |
| Confidence | A number with nothing behind it | Calibrated on labelled outcomes — safe to act on |
| Every prompt carries | Instructions, format, grounding rules, and the evidence | The evidence alone, in a compact encoding |
| Output | Varies from run to run | The same structured verdict for the same evidence |
| Size it needs | Larger, to compensate | Small enough for an ordinary PC |
01
An untuned model fills gaps with plausible stories: a sibling technique instead of the right one, a command-and-control beacon inferred from a single encoded command. Trained on windows labelled against their rules and techniques, the model cites the technique the rule actually asserts and says “not observed” where the evidence stops. Whole techniques are held out of training, so this is measured on attacks the model has never seen.
02
In the finished product the triage tier sends its confident majority, about 95% of cases, straight to the response engine. That is safe only if “95% confident” means right 95% of the time. A stock model’s stated confidence is calibrated against nothing. Fine-tuning on labelled outcomes is what moves AegisAI from explaining to acting.
03
On a CPU, reading the prompt dominates the time to an explanation — about 94% of it, measured on this prototype’s deep tier. A general model must be told the instructions, the output format and the grounding rules on every call. A fine-tuned model carries them in its weights, so the prompt shrinks to the evidence alone. Every token removed is time saved, almost linearly.
04
A tuned model returns the same structured verdict — technique, severity, confidence, storyline — for the same evidence. The two tiers can be measured against each other on every incident. Quality becomes a number the product watches, not an impression.
05
Published results repeatedly show small models tuned to a narrow task matching much larger general models on that task. That is what lets the reasoning run on an ordinary PC, with no GPU and no data centre. A bigger stock model would cost memory and latency, and would still be uncalibrated on telemetry.
A cloud vendor tunes one global model on data pooled from every customer. AegisAI tunes a small adapter — tens of megabytes against gigabytes of base model — for the machine it protects, through a gated, signed loop, without a byte of telemetry leaving it. The same adapter can reach an air-gapped site on a USB stick.
