Custom Endpoint Agent Development and Hardened Images

Hardened images
Bespoke agents
Air-gapped
Legacy OS

In plain terms

Some machines cannot run normal security software — they are disconnected from the internet, run an operating system nobody supports any more, have almost no memory, or the manufacturer forbids installing anything. We write custom security software for exactly those machines, and we give you the source code so your own team can maintain it.

Some endpoints will never run a commercial agent — air-gapped systems, tactical hardware, ruggedised field devices, legacy control systems under vendor warranty. Those are the ones we build for.

When an off-the-shelf agent is the wrong answer

No egress. The platform assumes a cloud control plane. Your network has no route to one and is not going to get one.
Unsupported OS. Embedded Linux, a vendor-locked RTOS, or a Windows build the vendor dropped support for years before you are allowed to replace the hardware.
Resource ceiling. The device has 256 MB of RAM and a duty cycle that cannot tolerate a scan.
Supply-chain scrutiny. You need to know exactly what the agent does, because someone will ask you to prove it.

What we deliver

Hardened operating system images

Custom Linux and Unix builds stripped to the services the role actually needs, with kernel hardening, mandatory access control, verified boot and a documented package manifest. The image is reproducible — you can rebuild it and get the same bytes.

Purpose-built endpoint agents

Written against the constraints of the target: fixed memory ceiling, defined CPU budget, store- and-forward telemetry for links that are intermittent or deliberately one-way. Source is delivered to you, not held hostage.

Tactical and field builds

For deployments on government hardware and mobile platforms, agents that tolerate power loss, degraded links and physical capture — including anti-forensic handling of cached telemetry.

What you get at the end

Source code, build pipeline, signing process, threat model and the test suite. If CerbaCore disappears tomorrow, your team can still build, sign and ship the agent. We consider a custom agent you cannot maintain yourself to be a failed engagement.

When we build rather than deploy

Constraint	Why commercial agents fail	What we build
No egress	Cloud control plane is mandatory	Local policy store, offline content by signed media
Unsupported OS	No build exists for the kernel	Agent compiled against that kernel, or userspace-only sensor
32–64 MB RAM	Minimum footprint is 10× that	Fixed-allocation agent, no dynamic growth
Vendor warranty	Any install voids support	Network-side sensor, nothing on the device
Provenance audit	Binary is opaque	Source delivered, reproducible build, SBOM
One-way link	Assumes bidirectional	Store-and-forward with bounded local spool

Supply chain and build

Reproducibility is the difference between trusting a supplier and verifying one.

Hardened image contents

A hardened Linux image we ship is defined by what was removed as much as what was added.

Layer	Decision
Package set	Minimal root filesystem; every package justified in a manifest. No compilers, no package manager, no shell utilities beyond the role's need.
Kernel	Modules compiled in, module loading disabled at runtime. Unused subsystems removed from the config, not blacklisted.
Mandatory access control	SELinux or AppArmor in enforcing mode with a policy written for the role, not the distribution default.
Filesystem	Read-only root with a signed dm-verity hash tree; writable state confined to a defined, mounted-noexec partition.
Boot	Verified boot chained to the hardware anchor — see router and firmware hardening.
Accounts	No default credentials. No interactive login on the production image; console access is a separate, signed maintenance image.

Worked example — agent for a disconnected tactical enclave

Constraint set: 180 ruggedized Linux endpoints, no route to the internet ever, 64 MB RAM available to security tooling, telemetry may only leave by physically escorted media on a weekly cycle, and every binary must be attributable to reviewed source.

ArchitectureAll detection logic local. No cloud dependency of any kind — not for verdicts, not for content, not for licensing. Licensing that phones home is an immediate disqualifier and rules out most commercial options before the technical evaluation starts.
FootprintFixed 48 MB allocation claimed at start. No dynamic allocation in the steady-state path, so the agent cannot contribute to memory pressure under load.
TelemetryRing-buffered to a 2 GB encrypted local spool with defined overwrite policy. At observed event rates that is 11 days of history against a 7-day collection cycle — the margin absorbs a missed pickup.
Content updatesSigned bundles on removable media, verified against a key in the device's secure element. The device refuses unsigned content even from a local administrator.
Capture resistanceSpool encrypted at rest with a key held in the secure element and destroyed on tamper detection. A captured device yields the agent binary — which we assume the adversary can obtain anyway — and no readable telemetry.
HandoverSource, cross-compilation toolchain, signing ceremony documentation and the test suite. Their team has since shipped two releases without us, which is the intended outcome.

What "you own it" means concretely

Git repository with full history, transferred to your organization
Containerized build environment — one command, byte-identical output
Signing key ceremony documented; keys generated in your custody, never ours
Threat model, architecture decision records, and the reasoning behind each rejected alternative
Test suite including the regression cases from every defect found during development

Custom Endpoint Agent Engineering