Built for a world where the walls will fall

Stop trying to keep them out.
Make it pointless when they get in.

Every other vendor sells you a taller wall. Adaptive Defence starts from the opposite premise: assume the attacker is already inside. Assume they have a frontier model writing novel exploits. Assume the zero-day exists. Then make every one of those advantages useless at the endpoint.

Where we break the attack chain
01 / RECON
Reconnaissance
They map your surface. We don't try to stop this.
02 / DELIVERY
Delivery
Phish, supply chain, zero-day. They will get through.
03 / EXPLOIT
Exploitation
The vulnerability fires. The foothold is real.
04 / ACCESS
Initial Access
They are on the endpoint. Credentials, session, shell.
05 / ARBITER
Execution
Nothing they brought is allowed to run. The chain terminates here.
The rest of the industry
Spends every budget dollar on stages 01–04. Patches, perimeters, detection. Loses the moment one of them fails.
Adaptive Defence
Accepts that stages 01–04 will eventually fall. Builds an unconditional wall at stage 05. The attacker's tools never execute.
01  ·  The worldview

The industry is fighting the wrong war. You cannot out-patch a frontier model.

For thirty years, endpoint security has been a race: find the hole before they do, patch it before they weaponise it, detect the payload before it detonates. That race was already hard. With adversarial AI in the field, it is now unwinnable. A single operator can now generate zero-days faster than any defender can analyse them. So we stopped playing.

The industry's bet
Keep the attacker out
  • Patch vulnerabilities before they are discovered.
  • Detect payloads by comparison to known samples.
  • Build taller walls, deeper moats, wider perimeters.
  • Assume the defender can move as fast as the attacker.

“A strategy that loses the moment anyone, anywhere, finds one hole first.”

The Adaptive Defence bet
Make the breach useless
  • Assume every vulnerability already exists. Assume it is already being used.
  • Assume the attacker has a frontier model generating novel exploits on demand.
  • Assume initial access is inevitable. Make it worthless.
  • Neutralise the one thing the attacker actually needs: execution.

“It does not matter how they got in, what they brought, or what model wrote it. None of it runs.”

What a Adaptive Defence endpoint does when the attacker is already inside.

A compromised endpoint is only valuable to an attacker if they can do something with it. Every meaningful thing an attacker wants to do — run a tool, load a payload, execute a script, persist, pivot — requires execution. We make that one thing conditional. And we do not condition it on recognising the threat.

Scenario A
A zero-day drops them into a kernel-level shell.
The exploit fires. The foothold is real. They have privileged access we cannot see coming. Every other tool in your stack is now blind.
The shell can't execute anything
Scenario B
A frontier model authors a novel, polymorphic payload.
Zero samples exist in any signature database. Zero behavioural baselines recognise it. It is, by construction, invisible to pattern-matching defence.
It fails attestation regardless
Scenario C
An insider already has legitimate credentials.
There is no exploit to detect. There is no anomaly to flag. They are authorised to be here. But the binary they brought with them is not authorised to run.
Credentials don't grant execution
03  ·  Field results
99.8%+
Block rate against novel, LLM-authored payload corpora in controlled testing.
3.1ms
p99 verdict latency, measured kernel-gate to user-space ack.
<18MB
Resident agent footprint. No continuous cloud tether required.
0
Successful executions across tested post-breach scenarios and adversarial payload families.
04  ·  Architecture

Seven gates
Twelve checkpoints
Every one must say yes.

A binary does not run on a Adaptive Defence endpoint because we recognised it as safe. It runs because seven independent gates returned an affirmative verdict, in order, under a budget of milliseconds. The gates do not ask “is this known bad?” — they ask “has this proven its right to execute?” The default answer is no.

And the gates are only the front door. Behind them, an active hunter watches every grant — lineage, behaviour, anomalies, indicators — with authority to revoke trust at any moment.

At the gate
01 Kernel gate ring-0
04 Behavioural proof micro-sandbox
07 Final arbiter policy gate · veto
↓   VERDICT   ↓
Default
Deny until proven
Threat hunter
01 Live patrol continuous · sub-second
02 Lineage watch parent · child
04 Indicator sweep IOC · TTP
06 Runtime re-attest in-flight
07 Quarantine engage isolate · revoke
↓   VERDICT   ↓
Default
Watch forever

Built for regulators, auditors, and the people who brief them.

ISO 27001
In progress
SOC 2 II
Attested
IRAP
Assessed
Essential 8
ML-3 aligned
GDPR
Compliant
APP / Privacy
Sovereign
06  ·  For individuals & small teams

Protect your PC. Keep your files.
Pay for a category that actually works.

The same architecture our enterprise customers run, packaged for one machine. Install it in under sixty seconds. If nothing gets past the gate, nothing gets past the gate — whether you're a family of four or a regulated bank.

Monthly
Flexible start.
$9.95 / month AUD
  • One PC · Windows or macOS
  • Full default-deny execution gate
  • Automatic kernel updates
  • Cancel anytime — keep your data
  • No annual discount
Start free trial →
14-day trial · then $9.95/mo · cancel anytime
Running more than 10 endpoints? We do custom rollouts, compliance artefacts, and direct engineering contact.
Talk to enterprise

You cannot prevent what you cannot predict. So stop trying. Predict nothing. Permit nothing. The attacker's ingenuity becomes irrelevant the moment execution is unconditional.

From the Adaptive Defence architecture paper Section 1 — Why Prevention Failed

Your next breach is inevitable.
Your next incident is not.

Book a ninety-minute technical briefing with our engineering team. No deck. No theatre. A live walk-through of the kernel gate, the decision pipeline, and the adversarial test harness — on your hardware, against your threat model.

Book technical briefing Or start a free trial
Typical briefing turnaround · 3 business days  ·  Individuals: free trial starts instantly