An EDR that cannot panic the kernel,
cannot fail silent, and is not paywalled.

How an event becomes a verdict

The OS hands us a curated event stream over a documented ABI. If our agent panics, the OS reaps the process. The kernel never goes down.

Why we don't ship a kernel driver

On 19 July 2024 a single channel-file update from a kernel-mode driver crashed an estimated 8.5 million Windows machines [1]. Airports. Hospitals. Banks. 911 dispatch. Recovery required physical access and a manual safe-mode visit per machine. The driver was the most widely deployed EDR in enterprise.

That outage was not a software bug. It was a structural choice. A product whose worst-case failure mode is bricking the host it's supposed to defend made a tradeoff that, in retrospect, no operator would consent to if it were stated explicitly at purchase.

Blue uses each OS's sanctioned instrumentation API, and the actual detection logic runs in userspace on all three:

• Linux: eBPF programs run inside the kernel under the in-kernel verifier (bounded loops, no arbitrary memory access, cannot panic). The userspace agent drains events from perf-ring + BPF maps. No loadable kernel module.
• Windows: ETW (Event Tracing for Windows) for the kernel telemetry stream, the Windows Filtering Platform (WFP) for in-kernel network-egress enforcement that severs C2, and AMSI for script and in-memory scanning, all consumed from userspace. No loadable kernel driver: if the agent stops, Windows keeps running.
• macOS: Apple's EndpointSecurity System Extension. KEXT-free; runs as a userspace daemon under the System Extensions framework.

The Rust core, four cooperating crates

• nemesis-sense. Subscribes to the OS event feed. Normalizes process / file / network events into a canonical schema. Lock-free ring buffer. No GC pause.
• nemesis-detect. Three parallel passes per event. Deterministic rules (LOLBin invocation, shadow-copy deletion, mass-rename heuristics). On-device ML classifier trained on EMBER plus a private corpus. Behavioral chain matcher over a 60-second sliding window.
• nemesis-respond. Quarantine, file rollback from APFS / Btrfs / VSS snapshot, process kill, and in-kernel network-egress blocking that severs C2 the instant a destination is flagged. One-click host isolation and live remote response (RTR) drive from the cloud console. Local by default. Cloud push optional.
• nemesis-storage. Append-only hash-chained audit log. Every detection and every response carries a SHA-256 hash linking to the prior entry. Tampering breaks the chain. Verification is offline and deterministic.

Local verdict in <50ms. End-to-end neutralize-and-rollback in <1s on an M2 Air, 16 GB.

Beyond the endpoint: Kubernetes + VMware

The same engine protects the infrastructure your endpoints run on: one enrolled device per node or per hypervisor, in the same console.

• Kubernetes. A privileged DaemonSet runs the Linux eBPF agent on every node (network-egress enforcement, kernel and file sensors, malware scanning) while a cluster agent watches the API server for control-plane threats: privileged pods, node-escape hostPath mounts, dangerous capabilities, and RBAC privilege-escalation. One helm install; one device per node. Cloud Workload Protection that undercuts the incumbents on price.
• VMware vCenter / ESXi. Agentless. A read-only vCenter service account is all it needs to catch ESXi ransomware (mass VM power-off, snapshot wipe) and hypervisor tampering: SSH / lockdown / firewall changes, rogue VIB installs, login brute force. No host VIB, no VMware signing, no acceptance-level downgrade.

Both normalize to OCSF and enroll into the same console as every endpoint. Runtime detections, control-plane audit, and hypervisor alerts land in one timeline.

Tamper as alarm

The honest answer to “what if attacker kills the agent first?” is that, eventually, they probably can. So we treat silence as the loudest signal. Blue heartbeats out-of-band every 30 seconds. Missed heartbeats from an enrolled endpoint page the SOC immediately. A killed agent doesn't produce a comforting all-clear. It produces an alert.

Free tier is the full engine

The free tier ships the same rules, the same ML classifier, the same rollback. What it doesn't have is the cloud console, multi-device fleet view, and AI threat-intel triage. One device, strictly local, no telemetry leaves the machine. We monetize the cloud, not safety.

• Free1 device · full engine · local-only, no telemetryFree
• Pro5 devices · cloud sync · AI triage$39 / yr
• Family10 devices · household policy$69 / yr
• Businesscloud console · fleet policy · endpoints + workloads$4 / endpoint / mo
• MSSPmulti-tenant · wholesale, meteredcontact

Pro / Family billed yearly (or $4.99 / $7.99 per month). Business is per active endpoint, 3 minimum; pay yearly and save ~2 months.

What Blue does not claim

Blue is the wrong choice if you need the F500-tier fleet-intelligence graph that Falcon's 23,000 customers feed into. Or an integrated SOC service. We sell tooling, not a managed SOC.

What Blue claims is to be the only EDR architected from day one for the constraints above. Not retrofitted into them after a market incident. See the trust center for the threat model and residual-risk list.

See it in action

The cloud console for managing your fleet, and the endpoint app that runs on every device. Click any shot to zoom.

Questions