// Product
Interdict
Endpoint Detection & Response
The same detection depth on every operating system.
Every blind spot declared. Every command signed.
// The Problem
Your EDR Has Blind Spots. It Just Doesn't Tell You Where.
Plenty of EDR products were built for Windows first. Rich coverage there, thinner on Linux, thinner still on macOS. The gap rarely shows up in the datasheet. It shows up during an incident, when the timeline you need was never collected on the server that got hit.
And the agent itself is a risk. It runs in the kernel, on every machine you own, with the power to kill processes and cut hosts off the network. An EDR that crashes the endpoint, or takes orders from whoever holds the other end of the connection, isn't a defense. It's a single point of failure with root.
// The Solution
One Core. Native Sensors. No Silent Gaps.
Interdict is an EDR agent and self-hosted backend built around one rule: a capability that exists on one platform must exist on all of them, either implemented or explicitly declared unsupported, with the reason written down. That isn't a documentation habit. It's enforced by the type system, so a gap can't be shipped quietly.
Each operating system gets its own kernel-level sensor: eBPF on Linux, Endpoint Security on macOS, ETW on Windows. All three feed one shared core for events, rules, spooling and response. Linux comes first, and it's running today. The parity target is edr-telemetry.com's public scoreboard, not a list we wrote ourselves.
An EDR that hides what it can't see is more dangerous than one that admits it. Interdict publishes its limits, proves every claim on a real kernel, and degrades instead of crashing, because the worst thing a security agent can do is take down the machine it was installed to protect.
Declare the gap. Never break the endpoint.
Measured, not asserted.
Measured on Real Kernels
We boot the vendors' own cloud images and run the full kernel test suite on each one. No inferring support from a version string, because enterprise distributions backport features under old version numbers. RHEL 8's 4.18 kernel has eBPF features the upstream 4.18 never had.
Linux sensor figures as of October 2026. Partially collected features are marked as partial, with the reason recorded for each one.
// Capabilities
What Interdict Brings to Your Fleet
Kernel-Level Linux Telemetry
eBPF tracepoints and LSM hooks capture process creation and exit, file activity, network connections, DNS queries, logons, account and service changes, kernel module and eBPF program loads, process access, and raw disk reads.
Watches Where Payloads Must Pass
A payload can arrive over any protocol and through any encryption, but before it runs, the kernel has to make that memory executable. Interdict reports every executable-memory grant, which is the one step in-memory loaders can't skip.
Every Gap Declared, With a Reason
Each capability on each platform is supported, partial, or unsupported, and the last two must carry a reason. The type system won't accept them without one. You get a register of what the agent can't see before you depend on it.
Degrades, Never Crashes
If a sensor can't attach, the agent still enrolls, reports health, and says exactly what it's missing. On a kernel without BPF LSM it still collects 19 of 26 features instead of going dark or taking the host down.
Signed, Expiring Commands
mTLS authenticates the connection. An Ed25519 signature authenticates the instruction. Every response command must be signed, carry an expiry, and pass policy before the agent will act on it. A compromised gateway or proxy can't task your fleet.
Identity From the Certificate
Each agent gets its own client certificate at enrollment, and its tenant is read from that certificate, never from the request body. The built-in CA ignores whatever a signing request asks for and decides the certificate's contents itself.
Detections That Ship Complete
A rule won't load without an ATT&CK mapping, a severity, a confidence, false-positive notes, a runbook, and true-positive and true-negative test fixtures. Every technique ID is checked against MITRE's catalog. Bring existing Sigma rules with the built-in importer.
Self-Hosted, Start to Finish
The backend runs on your infrastructure: ClickHouse for telemetry, PostgreSQL for the control plane, and an analyst console rendered by the Rust API server. No Node, no npm, and no vendor cloud between you and your data.
// Why Interdict
What Makes It Different
Parity Is a Contract
The sensor interface is the same for every operating system. A new capability has to be answered for all three platforms before it compiles, so Linux and macOS can't quietly fall behind Windows.
Scored Against an Outside List
Coverage is counted against the categories edr-telemetry.com uses to compare vendors, not a feature list we picked ourselves. The same list will score our macOS and Windows sensors.
Chokepoints Over Signatures
We monitor the step an attacker can't avoid instead of where a threat was first described. Executable memory, not TLS plaintext. A block device's inode, not a list of device paths that a new device node sidesteps.
Fail-Safe by Design
A failing sensor is isolated. A kernel program the verifier rejects disables only its own capability and reports it, rather than retrying in a loop. Taking the endpoint down is treated as the worst defect an EDR can have.
Reversible by Default
The default policy grants only reversible actions. Killing a process needs an explicit, audited grant that names that action. Automated response is opt-in for each action type, never on out of the box.
Response Paths Treated as Attack Surface
An EDR's cleanup routine is a privileged write primitive, and attackers know it. Interdict's rule for quarantine, delete and restore: resolve the path, then refuse symlinks, junctions, and anything that escapes its directory.
Rust, Agent to Backend
Memory-safe Rust across the agent and every backend service. In userspace, unsafe code is limited to a single named crate with documented invariants, and untrusted-input parsers are fuzzed.
Every Gate Proven to Fail
Each quality gate must show it can catch a deliberately planted defect, or it isn't treated as a gate. Clean runs go into a hash-chained ledger with RFC 3161 timestamps, so you can check that a build passed rather than take our word for it.
Your Data, Your Audit Trail
Self-hosted first. Telemetry stays in your own data stores, every response action is attributed to a rule or a named person, and the audit trail is yours to keep. A SaaS tier may come later, but it will never be required.
Where Interdict Stands Today
Interdict is in active development, and we'd rather you hear the details from us. The Linux sensor runs and has been measured on real RHEL 8, RHEL 9 and Debian 13 kernels. The command pipeline already verifies signatures, expiry and policy. The response actions themselves (kill, isolate, quarantine) are still being built and tested on Linux before they ship. Resource budgets are ship-blocking: the agent doesn't release until it meets them. The macOS and Windows sensors come next, in that order.
Linux first. Every limit written down. Nothing claimed that hasn't been measured.
// How It Works
From the Kernel to Your Alert Queue.
The agent turns native kernel events into one portable event model, evaluates rules against them, and streams results to a backend that runs on your infrastructure. Every event the sensor drops under load is counted where it's dropped, so a quiet host always means a quiet host.
1. Enroll the Agent
Each host enrolls with a token and receives its own mTLS client certificate. From then on, that certificate is the agent's identity and decides which tenant its data belongs to.
2. Observe at the Kernel
The sensor attaches through eBPF. Anything the kernel can't support is declared, and the agent tells you why, so you never mistake a missing feature for a quiet host.
3. Triage in Your Console
Rules run on the endpoint. Alerts reach a tenant-scoped queue over gRPC and mTLS, and every rule behind them carries an ATT&CK mapping and a runbook, so whoever is on call knows what to do next.
One Event Model, Three Operating Systems
Linux is running now. macOS (Apple's Endpoint Security framework) and Windows (ETW plus kernel callbacks) are next, and each will be scored against the same public list and held to the same rule: implement it, or say why not.
Know Exactly What Your EDR Can See
Interdict is in active development, starting with Linux. If you run RHEL or Debian servers and want an EDR that's upfront about its coverage, request early access. Design partners get to test it on their own fleet and shape the roadmap.