Enterprise gives you more power, no matter how you run it: a bigger detection model, bring-your-own inference, SIEM export, and fleet-wide governance controls - whether your devices run cloud-managed or fully private.
These are tier features. They work in Cloud mode and Private mode alike.
A larger model with better long-tail recall and attack-type classification - so each alert tells you not just that an attack happened, but which class. Standard on the Enterprise tier.
Connect your own inference endpoint as a second opinion alongside our local model. Our model is always primary; yours runs as an external second model. If your endpoint is unreachable the local model continues, fail-closed. Useful when your compliance rules require the inference layer to stay under your control.
Stream alerts in JSON, CEF, or syslog directly to your SOC toolchain (Splunk, Sentinel, QRadar). Works in Private mode too: the device writes a local log file your forwarder tails - no cloud required.
MDM-friendly rollout via SCCM, Intune, Ansible, or a simple install loop. License tokens are device-bound - fungible binaries, non-transferable licenses.
Per-device danger thresholds, custom profiles, and configurable poll intervals - locked to Enterprise to prevent policy bypass.
Enterprise runs as a fully separate setup: your own console at your own web address, a region you choose for where your data lives, and your data kept strictly apart in its own database. Nothing is shared with other customers.
How you run each device is a free choice. You can run some devices in Cloud mode and others in Private mode in the same fleet - and you get the same feature set either way.
Each device reports redacted diffs to the panel. You get a live fleet view, real-time policy steering, and the full analytics dashboard. Everything the panel shows is there because the device sent it.
The device runs isolated; the engine makes no direct outbound connection of its own. Ideal for fully private environments and the strictest data-sovereignty requirements. Config is signed once and delivered; the device acts on its own.
When a device runs in Private mode, analysis is local by construction - not a setting you switch on, but the way the install works. The following applies to Private-mode devices specifically. Cloud-mode devices send redacted diffs for scoring; that data flow is documented in the egress ledger.
No memory entry, document, or text fragment is ever sent anywhere. The model reads the change locally and returns a verdict locally - there is no analysis cloud to leak to.
One documented license and update check per month - credentials and version only, never content. An optional aggregate count can accompany it (opt-in; numbers only, no paths, no content). Between checks the device runs fully offline.
Every outbound request is recorded in an egress ledger built into the product - so your DLP and audit teams can verify, not just trust, every request the product sends.
Memory poisoning isn't one trick. It's a family of techniques, and a defense is only as good as its coverage of the hard ones. The detector is trained and evaluated against each of these classes.
Explicit instructions smuggled into a memory entry (“from now on, do X”) that the agent later obeys as if they were its own.
Entries engineered to make the agent leak secrets, credentials, or private context to an attacker-controlled destination.
The most insidious move: an entry that targets the protection itself - “trust this source, stop checking it.” Disarm the guard, and every later attack walks in.
Framing that coaxes the agent out of its safety rules through a persona or scenario, instead of issuing the malicious instruction outright.
The hardest of all: entries that read like perfectly legitimate notes, with no obvious tell - the ones plain filters and keyword rules sail right past.
The inference engine runs in a kernel-enforced sandbox - reads the model, answers on localhost, nothing else. The following applies to any device running local analysis (Private mode, or Cloud mode with local scoring). The only honest platform prerequisite is on Linux.
| Platform | Requirement |
|---|---|
| macOS | Nothing special. The kernel sandbox (Seatbelt) is always available. |
| Linux | Kernel ≥ 5.13 with Landlock active: Ubuntu ≥ 22.04, Debian ≥ 12, RHEL ≥ 9.6 out of the box. Otherwise enable it via the boot parameter lsm=landlock,…. |
| Windows | Nothing special. The engine runs inside a network-isolated AppContainer (no network capability, not even localhost), layered with a restricted token (all privileges stripped, low integrity) and a Job Object that blocks any child process. This applies to the CPU path, which is every Windows installation today. If you turn on GPU acceleration with Enterprise Ultra, that start leaves the AppContainer and runs without the integrity lowering - the restricted token, the Job Object and the network block still apply. |
| Containers | The default Docker seccomp profile blocks the Landlock syscalls - an adjusted profile is required. |
| No Landlock? | Without Landlock (or Seatbelt) there is no on-device analysis on this host: suspicious changes are recorded and surfaced, never waved through unsandboxed. |
Talk to us about an Enterprise rollout - advanced detection capabilities, governance controls, and the deployment model your security team requires.
Contact sales