Endpoint SecurityComing soon · Security Platform

Tessarac Sentinel — EDR with hardware-bound identity.

A small, fast, observable endpoint agent. eBPF on Linux, Endpoint Security framework on macOS, ETW + WFP on Windows. Hardware-bound ECDSA P-384 identity, multi-engine antivirus, and a graduated host-cordon control plane that isolates compromised endpoints in seconds — all under 100MB RAM and 1% steady-state CPU.

Get a demoRead the docs
Sentinel agent on a workstation with eBPF observation filaments and emerald shield projections.

The agent itself

One small daemon. One audited kernel touch-surface.

Sentinel owns the only kernel-touching code on the host so we can audit it tightly and ship it small. Same agent does telemetry, cordon, and host-access brokering — there is no second daemon to install, configure, or get out of sync.

  • eBPF programs (Linux), Endpoint Security framework callbacks (macOS), ETW + WFP filters (Windows) — kernel telemetry without third-party drivers
  • ECDSA P-384 keypair generated inside the host's TPM, Secure Enclave, or WPCP — private half never leaves hardware
  • Hardware-bound identity defeats the entire credential-extraction class of attack — there is no agent token sitting in a file to steal
  • Memory budget < 100MB resident; CPU budget < 1% steady-state on any production workload we have measured
  • Air-gap and edge-friendly: agent operates fully on local rules + signatures while disconnected; reconciles when connectivity returns

What Sentinel does on every host

One agent, many engines. The control plane composes them per tenant policy.

  • Concentric cordon rings with graduated isolation tiers.

    Multi-engine antivirus

    Signature-based scanning, YARA rule evaluation, on-host ML inference for unknown binaries, and cloud-sandbox detonation in your tenant's compliance region. Engines compose; verdicts roll up to a single severity score.

  • SOC analyst inspecting a stream of correlated alerts.

    Behavior-based process identity

    Every process inherits its identity from the chain that spawned it — credentials, parent, command line, opened files — and that identity travels with the audit log. Living-off-the-land binaries can't pretend to be something they aren't.

  • Append-only audit trail with hash-chained block visualization.

    5-tier graduated cordon

    Isolation from 'observe only' through 'block outbound to the internet' all the way to 'kill non-essential processes and refuse new sessions.' Ramps automatically as confidence in the verdict rises; manual override is one click.

  • Cross-cloud security posture overview with multi-provider correlation.

    Out-of-band cordon backstop

    If the agent itself is compromised, the control plane cordons via cloud APIs (security group, firewall rule, identity lockout) so isolation works even when the host can no longer be trusted.

Why this is different

The agent isn't a feature wrapper. It's the trust anchor.

Every other piece of Tessarac — privileged-access session brokering, secrets injection into running workloads, cloud workload identity — derives its trust from Sentinel's hardware-bound identity. That's the architecture decision that lets us collapse what other vendors split into three or four products.

  • Same identity unlocks SSH brokering, RDP brokering, secrets injection, and audit attestation
  • Per-host AV verdict feeds into the AI-SOC's investigation context — the analyst sees malware findings without leaving the alert
  • Cordon recommendations from the AI-SOC always carry the agent's evidence chain — what eBPF saw, when, by whom
  • Tenant-scoped ML models — your behavioral baseline isn't shared with other customers

Ready to see Sentinel in your environment?

One agent, every operating system, hardware-bound identity. Get a demo on your own fleet.

Get a demoRead the docs