Endpoint Defense Platform — Unified EPP + EDR

This is a product, not a project. Where our engineering services build you something bespoke, the Endpoint Defense Platform is the system we already own, maintain and deploy — and the one our managed service runs on.

Where this sits, precisely

CerbaCore publishes two platforms and one relevant service, and they are easy to confuse. The distinction is worth thirty seconds:

Offering	What it is	Choose it when
Endpoint Defense Platform (this page)	Our productized EPP + EDR agent and console	You want proven endpoint security software you can deploy now
Adaptive AI engine	The behavioral model ensemble that produces this platform's verdicts	You want to understand how detection decisions are actually made
Custom EPP/EDR engineering	A bespoke build for constraints no product satisfies	Air-gapped, embedded, unsupported OS, or you need to own the source

The engine is not sold separately and the platform is not sold without it. They are one system described from two angles, because buyers ask two different questions about it.

One agent, one kernel footprint

Prevention and detection share a single driver, a single update channel and a single configuration. Two security agents on one host is not defense in depth — it is contention over the same kernel hooks, and on older Windows builds it is a bugcheck. Everything below is delivered by that one runtime.

The EPP layer — seven prevention gates

Prevention is layered and ordered by cost. Each gate only evaluates what the previous one could not decide, which is what keeps behavioral analysis affordable across a large fleet.

#	Gate	What it stops	Where it is weak
1	Device and media control	Unapproved USB storage, Bluetooth transfer, unsigned mounts	Nothing, if policy is set to audit rather than block
2	Application control	Anything not on the allow-list — by publisher, path or hash	Environments where users legitimately run unknown binaries
3	Reputation and signature	Known-bad hashes, revoked certificates, indicator feeds	Anything never seen before — by definition
4	Static machine learning	Novel files whose structure resembles malicious families	Living-off-the-land, where the binary is genuinely legitimate
5	Exploit mitigation	Return-oriented programming, heap spray, stack pivot, unbacked execution	Logic flaws that need no memory corruption
6	Script and interpreter inspection	Malicious PowerShell, macros, JScript — content inspected after de-obfuscation	Interpreters without a scan interface on that OS
7	Behavioral runtime	Sequences that are malicious regardless of which binary performs them	Activity that closely resembles your legitimate normal

Gates 1 and 2 are the two most organizations never enable, and they are the two that stop the most with the least cleverness. We turn them on in audit mode during the pilot precisely so the argument about enabling them is settled with your own data.

The EDR layer — what is recorded and how

Eight classes of event are collected and bound into a process tree at the point of capture, not reassembled later by a query. The tree is the product. A flat event log can tell you a process ran; only a lineage can answer what it did next, which is the question every investigation actually asks.

Signal	Why it is collected
Process create, exit, command line	The spine of every investigation
Image and module load	Catches search-order hijacking and unsigned modules in signed processes
File create, write, rename, delete	Ransomware staging, tooling drop, log destruction
Registry, launchd, cron, systemd unit writes	Persistence, across all three OS families
Network connect, DNS, listening sockets	Command-and-control, lateral movement, exfiltration
Authentication and token use	Credential theft and misuse, which rarely involves malware at all
Memory region protection change	Injection, hollowing, execution from unbacked pages
Script block content, post-de-obfuscation	The actual script, not the encoded wrapper

Retention, and why it is an architecture decision

Hot storage of 30 days is queried instantly. Warm storage to one year is queried with latency. Cold retention is set by your policy, and in regulated estates by your regulator. What you can answer during an incident was decided months earlier by this setting — which is why we treat it as an architecture question at design time, not a storage-cost question at renewal.

Response — eight actions, every one reversible

Automation is authorized per rung and per asset class, never globally. A workstation may be isolated automatically at high confidence; a domain controller or an infusion pump never is. That granularity is the difference between automation that survives its first false positive and automation that gets switched off in week two.

Host isolation keeps the agent connected while cutting everything else, so an analyst can still investigate and release the machine remotely. Isolation that also cuts your own access forces a desk visit and gets used far less than it should be.

Platform coverage — including where it is weaker

Capability	Windows	macOS	Linux	Embedded / IoT
Prevention gates 1–7	All seven	1–5, 7	2–5, 7	3, 7 only
Kernel-level telemetry	Driver	System extension	eBPF	Userspace sensor
Script inspection	Full (AMSI)	Partial	Shell only	Not available
Memory scanning	Full	Restricted by the OS	Full	Not available
Host isolation	Yes	Yes	Yes	Network-side only
Typical footprint	250 MB	250 MB	180 MB	32 MB

macOS restricts what any vendor may do in memory, and no product should imply otherwise — parity claims across operating systems are a reliable sign a datasheet was written by marketing. On embedded targets we run a sensor rather than an agent, and pair it with network-side enforcement.

Deployment

The agent decides locally in every topology. Losing the console degrades reporting and content updates; it never degrades protection. A platform that needs a cloud round trip to reach a verdict fails exactly when an adversary cuts the link — which is the first thing a competent one does.

Performance envelope, contractually

Target	Memory	CPU steady	CPU scan	Telemetry per day
Workstation	250 MB	< 1%	< 15%, capped	40–120 MB
Server	400 MB	< 1%	< 10%, capped	100–400 MB
Embedded sensor	32 MB	< 2%	no scanning	2–8 MB

These are contractual, not aspirational. An agent over its envelope is a defect, because the first thing an overloaded team does is uninstall whatever is making machines slow.

Protecting the agent itself

• Tamper protection. Service stop, driver unload and file deletion are blocked including for local administrators, with an audited break-glass path for the legitimate cases.
• Signed content. Detection content and agent updates are signature-verified against a key the agent holds. Unsigned content is refused even from your own console.
• Ringed updates. Content ships in rings exactly like the agent rollout, and the last known-good content set is retained locally for rollback without a network round trip.
• Fail-open kernel path. If the kernel component cannot load, the host boots and works — degraded and loudly reported. A security agent that bricks a fleet has caused a worse outage than the threat it was bought for.

Integrations

Layer	What it does
SIEM / data lake	Normalized event export, so your correlation rules keep working
Network access control and routers	Drives VLAN quarantine — see segmentation
Identity provider	Session revocation and account disablement as response actions
Ticketing	Detection to ticket with the process tree attached, not a bare alert ID
Vulnerability pipeline	Installed-software inventory feeds reachability scoring

What it does not do

How to evaluate it properly

1. Bring your own samplesTest against malware you supply, not a curated corpus we chose. Ask every vendor for this and note who hesitates.
2. Measure false positives in your environmentTwo weeks in detect-only on a representative ring — not just IT laptops. Your build servers and developer machines are where the noise lives.
3. Time an actual detectionExecution to verdict, measured on the host. Sub-second for local decisions, or ask why the cloud is in the path.
4. Cut the network mid-testConfirm protection and telemetry continue. This single test eliminates a surprising number of products.
5. Read one verdict end to endHave an analyst explain why the platform scored something as it did. If nobody can, you cannot defend it to an auditor either.
6. Exercise the release pathIsolate a host and release it. If that is awkward in a pilot, it will not happen at 3am.