Endpoint protection where no single server can act alone.
Prismara Endpoint Security is SovSec's replacement for Microsoft Defender for Endpoint and Defender XDR. A sensor on each device detects and blocks attacks, and an XDR hub holds alerts and incidents for every client. It can run alongside Defender first and replace it later by policy. It is in early development, Linux first.
See it working
Taken from the working demo, using sample data.
What Prismara Endpoint Security does
Kernel-level telemetry
eBPF probes record process, network and kernel-module activity on Linux kernels 6.8 and later.
Prevention
BPF LSM programs block execution and protect the sensor from tampering.
XDR hub
Alerts and incidents for every client live in the hub, like Defender XDR.
SOC integration
For clients with Prismara SOC, signed and pseudonymised data flows to SOC, which acts as the SIEM, with incidents synced both ways.
Approved response
Isolating a device or quarantining a file needs an operator's passkey approval. Automatic actions run only from playbooks signed by the custodian quorum.
Your analysts see names
Your own analysts see real identities. SovSec operators see pseudonyms unless you grant access.
How it's secured
Prismara Endpoint Security follows the engineering rules shared across the suite, plus these product-specific measures.
Custodian quorum
Three hybrid Ed25519 and ML-DSA-65 custodian keys; two must sign every policy bundle.
Hub only relays
The hub passes approved actions on but cannot create them.
Post-quantum sealing
Data is sealed with hybrid ML-KEM-768 and X25519.
Want SovSec to run it for you?
SovSec provides managed security, SOC and Microsoft 365 services for organisations in the UK and DACH region, and can run Prismara as part of that service.