sector clear · AI on watch

EVOLVE INTO
THE FUTURE

AI-powered endpoint detection and response that watches every device, explains every alert in plain language, and never acts without your approval. One console. Full fleet. Zero terminal.

// capability grid

One connected workflow, not five disconnected tools.

Telemetry, trust, correlation, explainable alerts, and guided remediation — wired into a single chain instead of bolted together.

AUTO MODE

Three-tier autonomy

From advisory to guided to auto-approved playbooks — you decide how much SHERIFF handles on its own. Every escalation is one tier, never a leap.

TRUST ENGINE

Continuous ZTNA scoring

Each endpoint carries a live 0–100 trust score that drives network access automatically. Drop below a tier and access tightens; recover and it opens back up.

SHADOW MODE

Watch before you enforce

Run detection silently against real traffic to measure false positives before a single rule blocks anything. Confidence first, enforcement second.

DETECTION

Five-layer hybrid stack

MITRE ATT&CK rules, Isolation-Forest anomaly ML, an AI analyst, YARA + entropy file scanning, and a noise gate — layered so a miss in one is caught by the next.

// live console

Your whole fleet, on one screen.

Trust scores, active threats, and endpoint health update in real time over WebSocket — no refresh, no digging. Below is an illustrative snapshot of the admin console.

endpoints
128
protected
threats
3
need review
avg trust
81
fleet score
kra-till-04linux
92
reception-win11win
74
cafe-node-17linux
48
acct-laptoplinux
88
// pricing

Priced for a cyber café. Built for an enterprise.

Cyber Café

Shared machines, tight margins, full protection.

200–250
KES / device / mo
  • Up to 20 endpoints
  • 5-layer detection
  • Trust-based network isolation
  • Plain-English alerts
most popular

SME

Growing teams that need a real SOC without the headcount.

500–670
KES / device / mo
  • Up to 200 endpoints
  • Everything in Cyber Café
  • Auto Mode playbooks
  • AI threat analyst + hunting
  • Compliance reporting

Enterprise

Fleet-scale deployments with your own controls.

Custom
talk to us
  • Unlimited endpoints
  • Everything in SME
  • Dedicated onboarding
  • SLA + priority support
  • On-prem / air-gapped options
// download

Install once. It protects forever.

The agent installs silently, starts on boot, and recovers on its own. No terminal after setup.

🐧

Linux

available now
.sh · deb · rpm

One command. Debian, Ubuntu, and Kali tested.

Windows

beta · 10 / 11
.exe installer

The Windows agent is in validated beta. Grab the installer or join the beta list to get build notifications.

▲ release assets pending first public build — links resolve to the latest GitHub release once published.

// reviews

Teams that stopped fighting their tools.

Sample reviews shown for preview. Filter by rating, or leave one to see how it lands.

4.7
★★★★★
6 reviews
AO
Achieng O.
IT Lead · SME, Nairobi
★★★★★

The plain-English alerts are the difference. My non-technical staff actually understand why a device got restricted, and the revalidation flow means fewer tickets to me.

BK
Brian K.
Owner · Cyber Café, Nakuru
★★★★★

Priced so I can actually afford it per machine. Installed once on all 18 stations and never touched a terminal again. Trust scores flag the odd customer USB instantly.

WM
Wanjiru M.
SecOps Analyst
★★★★

The five-layer stack catches things our old AV missed, and Shadow Mode let me measure false positives before enforcing. Docked one star — I want more SIEM export options.

DN
David N.
Sysadmin · County Gov
★★★★★

Human-in-command sold it to our board. Nothing auto-executes without an approval click, and every AI suggestion shows its reasoning. Compliance loved the audit trail.

FC
Faith C.
MSP Consultant
★★★★

Rolling this out to clients is genuinely one command on Linux. The ZTNA trust tiers just work — low-trust boxes drop to a visitor network automatically. Windows beta is promising.

SW
Samuel W.
Head of IT · Logistics
★★★★★

One console for the whole fleet, live over WebSocket. I watch trust scores recover after a rebaseline in real time. The Auto Mode tiers let me dial risk exactly where I want it.

Leave a review

▲ preview only — posted reviews stay in your browser, nothing is sent.