AI on the protected machine
Two Llama language models on the endpoint’s own CPU explain every incident and, in the finished product, decide on it. Competitors run their AI in their own cloud, for an analyst.
Your environment
Protection that evolves with the way you actually work.
Most endpoint products learn the average customer, because that is all a cloud model can see. AegisAI is built the other way around: one machine and one owner first, then a company, and the owner stays inside the loop — defining what is allowed, teaching the models, and deciding how far the product may act.
Cloud-centred platform
- Analyst console — people investigate and decide
- Vendor platform, usually its cloud — data lake, correlation, threat hunting, generative assistant
- Endpoint agent — on-device detection and enforcement
Much of the understanding happens away from the machine.
AegisAI
- Plain-English incident, for the person at the machine
- Graduated response, rollback, signed forensic archive
- Triage Llama 3.2 3B + deep Llama 3.1 8B, fine-tuned by AegisAI and by you
- Rules, signatures, edge AI, sub-100 ms
- Signed, chained telemetry and WFP enforcement
Nothing leaves the box — and nothing needs to.
Where the intelligence lives. A cloud-centred platform detects on the device and understands in its own platform. AegisAI detects, understands, responds, recovers and learns on the machine it protects.
Where comparable products cannot compete
You take part in training the AI
As and when you need to, you add your own knowledge — your policies, your environment, incidents you have reviewed — to both models on the easy LoRA training page. It only adds to what they detect. It builds on the extensive fine-tuning AegisAI provides and keeps current with regular updates. It never replaces it.
You take part in defining threats
Your own Sigma, YARA and signature rules sit beside AegisAI’s and define the threats and incidents that matter on your machine or in your company, breaking out of the industry’s one-size-fits-all standard.
Explained to you, air-gapped by design
A plain-English storyline mapped to MITRE ATT&CK for every incident. Full capability with no network, and nothing sent to a vendor.
Yours to shape, open to audit
Choose the engines, their order, and how far the response may go on its own. Every verdict traces to an open rule. Every action is signed and reversible.
Not one policy for every customer
A professional’s laptop
Your own sanctioned tools, your own hours, your own files. The explanation is written for you, not for a console you do not have.
A 20-person office
The nightly backup, the IT script, the folder your software actually lives in. Behaviour you have already sanctioned stops looking like an incident.
An SME fleet, up to 250
AegisAI Local — SME Edition reads the company’s security policies. An optional on-premises console, FIDO2-gated, over endpoint-initiated mTLS. No cloud. Endpoints lose nothing if the console is unreachable.
Coming next — your own rules and signatures
Personal Sigma, YARA and signatures, beside the trained models
The same ownership extends to every detection engine. The user, or an SME’s security team, will add personal Sigma behavioural rules, YARA rules for files and process memory, ClamAV-format signatures and other detection content — written in place or imported — test them on the machine against its own telemetry before they are switched on, and keep them apart from AegisAI’s own updates, so that no update ever overwrites them.
Together with the trained models, that makes AegisAI the first endpoint product whose detection logic and whose AI are both shaped by the customer. Threats defined by the organisation’s own set-up and policies are detected by its own rules and understood by its own models.
- Your own Sigma rules
- Your own YARA rules
- Your own signatures
- Never overwritten by updates
Taking part in the model itself — the six-step LoRA page, what stays fixed, and why a 100% local EDR specialist you help train is an industry first — is on the fine-tuning page.