ProsentriqAutonomous protection you can prove is safe before it blocks anything.
Prosentriq attaches a kernel-level eBPF probe in one command and starts scoring real traffic in minutes, in a mode that cannot drop a single packet. Every decision is explained and recorded, and you turn autonomy up one level at a time, with audit evidence generated along the way.
No reboot One-click undo Kill-switch on every host
Enforce low-risk
- Would have blocked 185.220.101.7 +150 login after 12 failures, +150 SSH on port 2222, +50 port scan
- Waiting for approval 45.155.205.233 Suggested a block. Nothing happens until someone approves.
- Blocked for 7 days 193.142.146.149 On two threat feeds and hit a honeytoken. Undo any time.
Earn autonomy one level at a time
The path from a cold host to autonomous protection, with proof at every step and a way back at every level.
-
Level 1: Observe
Install observe-only
The installer confirms your enrollment key before touching the host, installs from a signature-pinned repository and attaches
prosentriq_observe.o: a probe whose only return path isXDP_PASS. It cannot block traffic even if told to. -
Level 2: Suggest
Read what it would have done
Every decision lands in a counterfactual ledger: "would have blocked X because Y", with the safety checks it ran. On day 7 a Trial Value Report shows the attackers, credential-guessers and scanners it would have stopped.
-
Level 3–5: Enforce
Turn the dial when the evidence says so
Level 2 suggests and waits for approval. Level 3 enforces only known-bad sources: threat feeds, honeypot and honeytoken hits. Levels 4 and 5 add high-confidence and behavioural blocks. Per host, reversible, audited.
Every block comes with its reasons
Each score increase is a plain-language sentence with the evidence behind it and its MITRE ATT&CK technique, stitched into one storyline per attacker. This is the console, not a mock-up.
One brain, thin sensors
Sensors report and enforce locally, and keep failing safe when offline. The control plane scores, explains and decides for the whole fleet, hosted or self-hosted.
- Linux XDP/eBPF engine (x86_64, ARM64)
- Kubernetes DaemonSet with pod attribution
- Syslog, CEF and Suricata relay
- AWS VPC Flow Logs & CloudTrail collector
- Your own sensors via the open event schema and SDK
- Local circuit breaker and kill-switch
- Explainable detection & incident storylines
- Autonomy Dial and decision ledger
- Event Egress and signed SOAR actions
- Compliance evidence & auditor portal
- Collective Immunity Network
Built for the team that has no security team
Everything below is in every paid plan, including SSO and self-hosting.
An Autonomy Dial with five safety mechanisms
Counterfactual ledger, blast-radius checks (DNS resolvers, cloud and CDN ranges, your allowlist and gateway are never blocked), canary rollouts for new rules, a circuit breaker that drops back to observe, and one-click undo.
Deeper than IP blocking
Honeytokens (decoy AWS keys, canary URLs, watched decoy files), ransomware tripwires with process freeze, credential-attack chains, per-process egress baselines and host isolation.
Audit evidence, generated
SOC 2, PCI DSS, HIPAA, ISO 27001, NIST CSF, NIST 800-53, CIS v8, NIS2 and DORA mappings computed from what actually happened, Ed25519-signed, with gaps shown rather than hidden.
Fits the stack you have
Slack, Teams, PagerDuty, Opsgenie, signed webhooks, syslog (CEF/JSON), Splunk, Elastic, Sentinel, Jira, ServiceNow and OpenTelemetry, with retries and dead-lettering. Import Sigma and Falco rules.
Collective immunity, done safely
Indicators only, never traffic. An attacker is shared only after three independent organizations report it, reporters lose weight when they're wrong, every entry expires, and the feed is signed.
Looking after other people's servers? It's built in.
MSPs get the same product their customers would buy, plus customer organizations, a cross-customer fleet view, their own branding and wholesale pricing. It's in every plan, with nothing to unlock.
Prosentriq for MSPs- One login, every customer. Separate organizations, isolated in the database, each with its own Autonomy Dial and audit trail.
- Fleet view, worst first. Critical incidents, tripped circuit breakers and silent hosts across all customers.
- Your brand. Your product name and logo in the console your customers' users sign in to.
- Wholesale. List price minus 35% on every customer node, and observe-only trials on prospects' servers cost nothing.
- A private Immunity hub. Self-host it across your customers, and federate with the global network if you choose.
Built to fail safe, on purpose
A security tool that takes production down, or silently turns itself off, is worse than none. These are design constraints, not features.
- If the control plane is unreachable, the host keeps its last confirmed state and its own circuit breaker; nothing switches off.
- When in doubt the loader attaches the observe-only probe: a missing or unreadable mode never means "drop".
- The local dashboard API requires a per-install token; updates only install packages signed by our pinned key.
- Every privileged change is written to a hash-chained audit log you can verify.
One public price per enforcing host
Observe-only hosts are free. Every feature is in every paid plan.
Start in two minutes
Create your organization, then copy the one-line installer from the console. Nothing on a host changes until your key has been confirmed.
You'll be asked to agree to the Terms of Service and to read the Privacy Policy when you create your account.