Seven Detection Engines in the Agent You Already Deployed
EDR-class malware, behavioral, and integrity detection ships in the same binary as AI governance - no second install, no second console, no second invoice.
Two Agents, Two Blind Spots
The standard answer to AI risk is to add a tool: keep the EDR agent for malware, add an AI security product for the model layer. The result is two agents competing for the same endpoint, two consoles with different device lists, and a gap between them where AI-initiated threats live.
An AI agent that installs a vulnerable package, pulls down and runs an unvetted script, or modifies system startup is doing something both categories should catch and neither reliably attributes.
The Seven Engines
| Engine | Function | Method |
|---|---|---|
| AI Tool Discovery | Find every AI coding tool on every endpoint | Filesystem, network, behavioral, and deep telemetry layers |
| Secret Scanner | Detect credentials and sensitive data in AI conversations | 37+ patterns plus entropy analysis for secrets no pattern knows about |
| Native Malware Scanner | Detect malicious binaries and files | 6.5M+ malware signatures, refreshed automatically |
| YARA Scanner | Match files against YARA rules | A yara-x engine with a compiled rule bundle, built into the agent with nothing extra to install |
| IOC Matcher | Match against curated threat intelligence | File, domain, and IP indicators from continuously updated threat feeds |
| Sigma Behavioral | Detect suspicious endpoint behavior | Behavioral rules with full MITRE ATT&CK mapping |
| File Integrity Monitor | Detect modification of critical system files | Tamper baselines with real-time change alerts |
Native malware scanning
Protection is on once the agent enrolls - no setup step, no configuration. Signatures refresh automatically, downloads are scanned when they land, and scheduled quick scans plus on-demand full scans cover the rest of the disk.
YARA scanning runs on a yara-x engine with a compiled rule bundle, on macOS, Windows, and Linux.
The scanner is built to stay quiet. Signed, trusted software does not generate alerts, repeat hits on the same file are collapsed into one detection, and low-confidence matches are recorded as observations rather than raised as alerts; they stay out of the default view until you ask for them. When a rule does fire across many machines, you can select every matching detection and resolve it or mark it a false positive in one action, or flag it to monitor without closing it.
Behavioral coverage
Behavioral rules mapped to MITRE ATT&CK catch the techniques attackers actually use - malicious downloads, obfuscated commands, remote-access footholds, credential theft, and attempts to persist across reboots - whether the actor is a human or an AI agent.
Endpoint posture checks
Verified continuously across the fleet, so you always know which machines meet the bar.
| Check | macOS | Windows | Linux |
|---|---|---|---|
| Disk encryption | FileVault | BitLocker | LUKS |
| Screen lock | Lock on wake | Screen lock policy | Desktop screen lock |
| Firewall | Application Firewall | Windows Firewall (all profiles) | ufw / firewalld / iptables |
Compliance scoring
Every device carries a 0–100 score computed from engine health, signature freshness, and posture - one number that tells you whether a machine is protected.
- 80+ - compliant
- 50–79 - partial
- Below 50 - non-compliant
- Transparent breakdown - admins see per-engine point allocation and can tell exactly why two machines score differently
Device Health and Threat History
Controls This Evidences
- PCI 5.2
- Malicious software prevention - native scanner, YARA, IOC matching, quarantine
- NIST SI-3
- Malicious code protection across the fleet
- NIST SI-7
- Software, firmware, and information integrity - file integrity monitoring
- ISO A.8.9
- Configuration management - disk encryption, screen lock, and firewall posture
- HIPAA §164.312(a)(2)(iv)
- Encryption and decryption - disk encryption posture evidence
See Kraitos AIDR in Action
Enroll an endpoint and see which AI tools it runs. Stop guessing what your AI-augmented organization is doing.
[email protected]kraitos.io