Softilo Defender

AI triages. A person approves every containment.

Cloud, identity and Linux endpoint security in one dashboard: posture scanning, Sigma detection rules, AI triage of incidents, and containment that waits for a person’s approval.

Book a demo Ask a question

For Growing organisations with cloud accounts and Linux servers

Incidents ranked by severity: reverse shells, disabled CloudTrail logging and a high-risk Microsoft sign-in.

The problem

Security signals sit in separate consoles for cloud, identity and servers, and nobody has time to read them all. Fully automatic response tools, meanwhile, can lock out the wrong person at the worst moment.

See it running

Softilo Defender on screen

Softilo Defender · WalkthroughScreen recording · demo data · no sound

What it does

6 things Softilo Defender does properly

Cloud and identity collectors

Connectors for AWS, Microsoft 365, GitHub and Cloudflare feed one event pipeline.

Linux eBPF sensor

A sensor on each server watches processes and connections from the kernel, and can isolate the host when told to.

Sigma detection

Rules written in the open Sigma format open incidents, from reverse shells to disabled CloudTrail, starting from a starter set.

AI triage

Incidents go to AI triage first, with a daily spending limit per customer. Without an API key they go straight to an analyst.

Approved containment

Isolate a host, revoke a user’s sessions or block an address, but only after a person approves it.

Posture and hunting

Posture findings per asset, with a hunt screen built on fixed, parameterised queries.

Quality bars

Rules it doesn’t break.

The AI can’t act alone: It can’t close an incident or choose a target, and rules outside the model override its verdict.
Signed sensor commands: Commands are signed by a key the gateway never holds, bound to one sensor, with an expiry and replay protection.
Tenants kept apart by the database: PostgreSQL row-level security and ClickHouse row policies mean a query with no tenant returns nothing or fails.
Deleting means deleted: Removing a tenant destroys its encryption key, which makes its locked archives unreadable. The audit log is hash-chained.

Specification

Under the bonnet

Sources: AWS · Microsoft 365 · GitHub · Cloudflare · Linux sensor
Stack: Go · Python and Temporal · Rust and eBPF · Next.js
Data: Redpanda · ClickHouse · PostgreSQL · encrypted, locked archive
Deployment: Single-host Docker Compose, suited to a pilot

Straight answers

What it doesn’t do (yet)

Testing against live services: AWS has run only on an emulator, the rest against stand-ins, so no real AI verdict has been produced yet
An independent penetration test
Endpoints other than Linux
High availability: each data service runs as a single node
A full detection library: the rules are a starter set

Need one of these now? We can build it for you as a services project.

See Softilo Defender for yourself.

Tell us a little about your business and we’ll arrange a call and a demo. No obligation, no hard sell.

Book a demo

Next product

AI fashion design studio

Softilo Atelier →