SMEs without a security team
They need the explanation and the next step, not a console. AegisAI gives tier-1 analysis on every machine and, in the SME Edition, a company-internal fleet console — at a price an office can afford.
Why AegisAI is a disruptor
The opposite bet from the cloud platforms.
Endpoint protection is dominated by a handful of large platforms that all made the same bet: send every endpoint’s telemetry to the vendor’s cloud, understand it there, sell generative AI to the customer’s analysts as a premium layer, and charge per endpoint, every year. It is a strong model for a large enterprise with a security operations centre. For almost everyone else it means paying for an analyst console nobody watches, for a data pipeline the customer would rather not have, and for AI the customer can neither see, nor shape, nor own.
AegisAI makes the opposite bet, and every part of its architecture follows from it.
01
The AI runs on the machine it protects — nobody else does this
Two Llama language models read and explain every incident on the endpoint itself, on an ordinary CPU, with no GPU and no network. The established AI products put their language models in the vendor’s cloud and point them at an analyst. On-device AI in today’s market is limited to classic machine-learning detection models and, in consumer products, narrow NPU features such as deepfake detection. A per-incident language-model analyst inside the endpoint is new to the category.
02
The owner takes part in training the AI — a first for the market
AegisAI ships both models extensively fine-tuned and keeps them current with regular updates. With the Model fine-tuning page the end user, or an SME’s own security team, adds its own knowledge on top, as and when it needs to: upload a policy, review what AegisAI extracted, train a LoRA adapter on your own hardware, test it against held-back examples, switch it on, and go back with one choice. Every established vendor trains its models centrally and ships the same model to every customer. None of them lets the customer take part. With AegisAI the AI becomes partly the customer’s own.
03
Threats defined by you, not by the average customer
A cloud model knows what is malicious across all customers. It cannot know that your accounting PC must never run PowerShell, or that the 2 a.m. script is your backup. AegisAI’s tuned models, and in future its personal Sigma, YARA and signature rules, detect what is wrong for this machine and this company — insider misuse, policy breaches and unusual-for-us behaviour that no global model and no generic rule set can define.
04
Not one-size-fits-all, at any layer
Choose which engines scan and in what order, the dual-LLM pipeline among them. Decide how far the response may go on its own, from one-click approval to fully automatic per severity. Add your own detection content beside AegisAI’s. Keep the models AegisAI ships, or teach them your environment. The same product fits a single professional’s laptop, a 20-person office, and a 250-endpoint SME fleet with its own console, without a byte leaving the company.
05
Price: a structural advantage, not a discount
A cloud XDR subscription funds a per-endpoint data pipeline, a data lake, retention and GPU inference for its AI assistant, every year. AegisAI has none of those costs. The language models run on the customer’s own CPU, nothing is stored by the vendor, and the cost of protecting one more endpoint is close to zero. That lets AegisAI sell a perpetual licence with no compulsory retainer — the optional retainer for updates starts at USD 5 per machine per month — and still be profitable, at a small fraction of what the market charges, while competitors cannot follow without dismantling the cloud model their revenue depends on.
06
Sovereign and private by default
Data residency, GDPR and sector regulation are pushing buyers away from sending endpoint data abroad. Where incumbents answer with separate on-premise or air-gapped editions, AegisAI is air-gapped by construction: full capability with no network at all, no data retention, and models and adapters that reach an isolated site on a USB stick.
07
Open and auditable
Detection rests on open, community-reviewed content — SigmaHQ rules with every author credited, YARA and ClamAV — beside the local models. Every verdict can be traced to the rule, the engine and the evidence behind it, and every action is signed, chained and reversible. That is what auditors, insurers and regulated buyers ask for, and what black-box proprietary engines cannot show.
08
Riding the hardware wave
Every new business PC ships with an NPU and enough memory to run small language models locally, and small models tuned to a narrow task keep closing on large general ones. The cost of on-device AI falls every year. The cost of cloud AI per endpoint does not. AegisAI is built for the hardware buyers are already purchasing.
Who buys first
Regulated and air-gapped sites
Defence, government, healthcare, finance, critical infrastructure and industrial networks, where endpoint data may not leave the site and cloud AI is not an option at all.
Professionals and privacy-conscious users
Lawyers, doctors, accountants, journalists and anyone who wants enterprise-grade protection without sending their machine’s activity to a vendor.
MSPs and integrators
A product they can tune per client — each client’s policy in its own adapter, its own rules beside AegisAI’s — with no per-endpoint cloud bill eating their margin.
The feature-by-feature market matrix, prices, and sources are on the comparison page.