Detect
On-device detection with community Sigma rules and behaviour rules: suspicious process chains, shells on the network, new persistence items, kernel modules, malware signatures, mass file encryption.
Endpoint detection and response
See attacks on your devices early. Stop them in one click.
Endpoint Shield watches Windows, macOS and Linux devices for attacker behaviour — malware, ransomware, credential theft, tampering, persistence — and lets your team respond from one console. Built for small and medium businesses and the managed security providers who look after them.
What it does
Respond
Stop a process, quarantine a file, isolate a device from the network, collect a triage package. Every command is signed by your console and checked by the device before it runs.
Prevent
Block programs by hash or path, block programs started from temporary folders, automatic containment of reverse shells, ransomware protection with decoy files and file restore on Windows.
AI coding agents
Watches AI coding agents and the tools they start: credential files read, connections to unexpected hosts, risky commands, secrets in files an agent read — reported without the secret itself.
Exposure
A security-settings score per device: firewall, disk encryption, antivirus, updates, administrator accounts, remote access — with an alert when a setting gets weaker.
For service providers
Manage many client organisations from one place, each fully separated; signed agent updates rolled out in stages with automatic halt on failures.
Platforms
- Windows 11 — event tracing, Windows App Control, Microsoft Defender management (ARM64 tested; x64 in testing).
- macOS 13 and later on Apple silicon — Apple's Endpoint Security events; deployed through MDM.
- Linux: Ubuntu 24.04 — eBPF sensor, no kernel module (arm64 tested; x86_64 and other distributions in testing).
Your data, in short
- Detection runs on the device. File contents never leave it.
- Secrets (passwords, tokens, keys) are found on the device and reported only as a type, a line number and a fingerprint — never the value. Command lines are sent with secrets removed.
- No keystrokes, screenshots, browsing content or personal files are collected.
- Each customer's data is separated from every other customer's, and kept for a limited time (alerts 90 days, activity 30 days).
- Optional features that send data to a third party — such as the AI triage assistant — are off until the customer turns them on.
Contact
Questions, pilot requests or security reports: namcf1988@gmail.com.