Unlimited devices, exec0 against harmful tool calls, the bigger detection model, SIEM export and fleet-wide governance controls, whether your devices run cloud-managed or fully private.
Everything in Pro, plus:
Fixed rules and Melira AI check tool calls before they run; reading and searching are not checked.
Better recall on rare attacks.
Alerts as JSON, CEF or syslog to Splunk, Sentinel or QRadar, also from private devices via a local log.
SCCM, Intune or Ansible, device-bound licenses, and per-device thresholds and profiles.
Your own console under your own hostname, a region you choose, a separate database.
Add-ons: inject0 against prompt injection and, on request, your own model as an additional check (beta).
Devices send redacted diffs; you get a live fleet view and real-time steering, and every outbound request is in the egress ledger.
No content leaves the device; one documented check per month, config signed and delivered offline; the full console runs in your own instance.
Memory poisoning isn't one trick. It's a family of techniques, and a defense is only as good as its coverage of the hard ones. The detector is trained and evaluated against each of these classes.
Explicit instructions smuggled into a memory entry (“from now on, do X”) that the agent later obeys as if they were its own.
Entries engineered to make the agent leak secrets, credentials, or private context to an attacker-controlled destination.
The most insidious move: an entry that targets the protection itself - “trust this source, stop checking it.” Disarm the guard, and every later attack walks in.
Framing that coaxes the agent out of its safety rules through a persona or scenario, instead of issuing the malicious instruction outright.
The hardest of all: entries that read like perfectly legitimate notes, with no obvious tell - the ones plain filters and keyword rules sail right past.
The inference engine runs in a kernel-enforced sandbox - reads the model, answers on localhost, nothing else. The following applies to any device running local analysis (Private mode, or Cloud mode with local scoring). The only honest platform prerequisite is on Linux.
| Platform | Requirement |
|---|---|
| Linux | Kernel ≥ 5.13 with Landlock active: Ubuntu ≥ 22.04, Debian ≥ 12, RHEL ≥ 9.6 out of the box. Otherwise enable it via the boot parameter lsm=landlock,…. |
| Containers | The default Docker seccomp profile blocks the Landlock syscalls - an adjusted profile is required. |
Talk to us about an Enterprise rollout - advanced detection capabilities, governance controls, and the deployment model your security team requires.
Contact sales