Kernel-level telemetry
On Linux the kernel pushes every program start to the sensor, with parent, user and SHA-256. Connections, listening ports and logons on every platform.
Part of Postern OS · detection, prevention & recovery
Watch the small gate. That is the one they use.
Postern Cyber is the security platform that comes with Postern OS, the hardened workstation for organizations. It puts a sensor on every managed device, stops known-bad programs before they run, rolls files back after ransomware, and hands each incident to an AI analyst running on Claude Mythos 5.2 under an API key Postern installs for your organization. Your telemetry stays on your server unless you decide otherwise.
For now Postern Cyber is offered only together with Postern OS, as one product.
48built-in detections
ATT&CKtechniques mapped
2static binaries
0telemetry leaves your server by default
It watches your computers for an intruder, and helps you throw one out.
An attacker who gets into one machine leaves traces: a program that should not run, a login that should not succeed, a file that should not change. Postern Cyber collects those traces from every machine, recognises the patterns of an attack, and gives your team the means to stop it.
1
See
A small program, the sensor, runs on each computer. It reports every program started, every network connection, every login and every change to a critical file.
2
Recognise
Your server compares that activity against 48 known attack behaviours and your own list of bad files and addresses, and raises an alert when one matches.
3
Understand
Related alerts are joined into one incident, in order. An AI analyst can read it and say what happened, how sure it is, and what to do.
4
Act
From the console you stop a process, quarantine a file or cut a machine off the network. After ransomware you restore the files it encrypted.
The server is yours: one program on a machine you control, with its own database. Nothing your sensors collect goes to us unless you switch on a summary that carries no names, and you can read that summary first.
One product in two parts: the hardened workstation and the platform that watches it.
Postern OS is a hardened Linux system for desktops, phone-sized screens and the console. Postern Cyber is how an organization sees what happens on it. They are built and offered together.
The sensor is part of the system
A managed Postern OS image runs the sensor as a system service, enrolled with a token it receives as a protected credential. No installer to push, no agent to keep alive.
The system reports its own posture
Postern OS checks itself: firewall, listeners, kernel hardening, memory-only swap, locked passwords and more. Each check arrives in your console as posture, per device.
Less for an attacker to use
Postern OS starts with no remote-login service, a filtering firewall, a hardened kernel and unused network protocols disabled. The sensor watches a small surface, so what stands out is easier to see.
A monitored device says so
Monitoring a computer is monitoring the person who uses it. A managed Postern OS device cannot be built without naming the organization, a privacy contact and the legal basis, and it shows them:
- at every login, and in a notice file on the device;
- in the Postern Status window, next to the list of what is collected;
- in its own status report, which fails if the device is declared managed and the sensor is not running.
What an enterprise endpoint platform does, in a codebase you can read.
Behavioral detections
48 rules for Linux, macOS and Windows: reverse shells, web shells, LSASS dumps, malicious documents, persistence, miners, tunnelling, log tampering. Write your own in YAML.
Block before execution
On Linux the kernel waits for the sensor's verdict. A binary on your hash block list, or under a blocked path, never starts, even renamed.
Ransomware rollback
Versioned copies of the directories you protect, canary files checked every five seconds, and one action that restores the last good snapshot.
Incident storyline
Alerts on one host inside a 30-minute window join a single incident, so an intrusion reads as one case instead of ten pages.
Containment
Kill a process, quarantine a file, isolate a host from the network with nftables. Manual by default; automatic per host in protect mode.
File integrity monitoring
Account databases, sudoers, SSH keys, cron, systemd units and the dynamic linker preload are hashed and watched for change.
Indicator matching
Load file hashes and addresses. A running process or connection that matches raises a high-severity alert.
CVE matching and posture
Installed packages are matched against the public vulnerability database on your own server. Plus SSH, firewall, updates, disk encryption and Defender checks.
Third-party ingestion
Post firewall, cloud or identity logs to one API endpoint. They run through the same detections and land in the same incidents.
SSO, roles and audit
Sign in through your identity provider with OpenID Connect. Viewer, analyst and admin roles. Every action is recorded with who asked for it.
Claude Mythos 5.2 reads the case file. You sign the order.
Postern installs the Anthropic API key for your organization and your console gains an analyst. Requests go from your server straight to Anthropic. Mythos 5.2 is available to verified organizations; Postern can set any other Claude model.
Triage an incident
One click sends the alerts and the surrounding telemetry. Back comes a verdict, a confidence figure, a narrative that cites event ids, ATT&CK techniques and a list of actions to approve.
Hunt in plain language
Ask "did anything on the database hosts open a new listener this week?" The model queries your event store with read-only tools and shows every query it ran.
Draft a detection
Describe a behaviour. You get a validated rule, the reasoning behind it and the false positives to expect. It goes live only when you save it.
Built for an adversarial input
Command lines and file names are written by the attacker. The integration assumes they will try to talk to the model.
- Telemetry reaches the model as tagged data, with standing instructions to treat it as evidence and never as a request.
- The model has no tool that changes anything. It recommends; an operator approves each action in the console.
- The console escapes every value it renders, so a hostile string cannot run script in the analyst's browser.
- If a request is declined by a safety classifier, the server says so plainly and can re-run it on Anthropic's recommended fallback model.
Your team sees everything. We see a summary without names, if you allow it.
Your organization sees
Every event your sensors report
- Your organization: every event your sensors report, on your own server, under the roles you assign.
- Programs with their command lines, connections, logins, file changes, posture, alerts and incidents.
Postern sees
A summary, off by default
- Postern, the vendor: off by default. When you enable it, a report with device counts, the status of each posture check, which rules fired and how many logins failed, under device pseudonyms.
- Never in that report: host names, user names, command lines, file paths, IP addresses, alert titles.
- The console shows the exact payload before it is sent, and logs every report.
Collect less
Passwords and tokens typed on a command line are masked on the device before upload. No file contents, keystrokes, screens, browsing history or DNS queries are collected.
Answer a request
Export every record of one person as a file, or erase them. Remove a retired device with everything it reported. Evidence of an incident is kept, with the person's name and commands removed.
Keep it only as long as needed
Ordinary records expire after a period you set, 30 days by default; evidence of closed incidents and the audit log after a longer one.
Your part
The legal basis, the impact assessment and the notice to your staff are yours to decide and document. The software gives you the means; it is not legal advice.
The figures, for the people who do not live in the console.
Management and Postern staff sign in to read-only dashboards: how many devices, which Postern OS checks pass, which detections fired. Access is by invitation only.
Two views per organization
Postern OS shows the status of every system check on every device. Postern Cyber shows alerts per day and per rule, authentication counts and sensors.
Your organization, or all of them
An account invited for one organization sees only that organization. Postern staff see every organization that reports, in one table.
No names in it
The portal is built from the summaries without identities. Devices appear under pseudonyms; host names, user names and commands stay in your own console.
Sign in
Use the address your invitation was sent to. An invitation link works once and lets you choose your password.
- No invitation? Ask the administrator of your organization's Postern Cyber server, or Postern.
- A portal account cannot open the operator console or change anything.
One server, one sensor per host, one link to Postern.
Start the server
A single binary with an embedded database and console. It writes an admin token on first start.
postern-server \ --listen 127.0.0.1:8460 \ --data-dir /var/lib/postern
Enroll a sensor
Observe-only unless you grant response capabilities on that host.
postern-sensor \ --server https://console.example.com \ --enroll-token pce_… \ --response kill,isolate,prevent,rollback \ --protect /srv/data
Receive the analyst key
Enable the vendor link. Postern installs the Anthropic API key for your organization and your server collects it; nobody types a key into the console.
POSTERN_VENDOR_URL=https://… POSTERN_VENDOR_ORG=your-organization POSTERN_VENDOR_KEY=pck_…
What ships today, and what does not yet.
Postern Cyber is in private preview. This table is the full picture, so you can judge it against the platform you run now.
| Area | In 0.2 | Open |
|---|---|---|
| Offering | Together with Postern OS, on managed Postern OS devices | Postern Cyber on its own, for other systems |
| Platforms | Linux sensor, used by Postern OS; macOS and Windows sensors exist in the codebase | macOS and Windows are not part of the current offering; Windows process and network telemetry is not yet proven on a real Windows host |
| Telemetry | Kernel-pushed process events on Linux; polling on macOS and Windows | eBPF, so the command line of a microsecond-lived process is guaranteed too |
| Prevention | Hash and path blocking before execution on Linux | Windows and macOS blocking; machine-learning verdicts |
| Ransomware | Canaries, mass-encryption detection, rollback of protected directories | Off-host copy of the vault; whole-disk snapshots |
| Exposure | CVE matching for Ubuntu and Debian; posture checks everywhere | Other distributions, Windows and macOS software |
| Cloud & identity | Log ingestion through the API | Native cloud and identity-provider connectors |
| Postern OS | Sensor as a system service, posture from the system's own report, logins from the journal; tested with server and sensor in one virtual machine | A managed image on real hardware; response actions on Postern OS; software inventory for CVE matching |
| Data protection | On-device notice, secret masking, retention, export and erasure per person, device removal, audit log, vendor summary without identities | Review by an independent auditor or a data protection authority |
| Console access | Single sign-on (OpenID Connect) and three roles | Multi-tenancy |
| Assurance | 32 unit tests, kernel tests in a container, SSO tests against a mock provider, a booted Postern OS test | Independent security audit; AI analyst run against a production key |
Private preview
Offered to organizations, with Postern OS.
Postern Cyber and Postern OS are licensed together, per device and per year. Both are in private preview and not yet on general sale.