What each edition does, and what is ready.
SILO.RED comes in two shapes: a standalone client that watches the agents on one machine, and Cortex, a control plane your own fleet reports to. The tables below say what each includes, on which operating system, and the status of every row today.
The same agent on macOS, Linux and Windows.
Detection and response are the same on every platform. Where they differ, it is because each operating system offers its own mechanism, and SILO uses that one.
| Capability | macOS | Linux | Windows |
|---|---|---|---|
| Supported systems | macOS 26, Apple silicon | Ubuntu 22.04–26.04, Debian 12 | Windows 11 |
| Architectures | arm64 | arm64x86-64 Early Preview | ARM64, x64x64 installer Early Preview |
| Package | .pkgnotarised by Apple | .deb | MSI |
| Kernel event source | Endpoint Security | eBPF | ETW |
| Agent recognition and trust deficit score | ✓ | ✓ | ✓ |
| Canary credentials | ✓ | ✓ | ✓ |
| Exfiltration (outbound volume) | ✓ | ✓ | ✓ |
| Ransomware burst detection | ✓ | ✓ | ✓ |
| Data provenancewhether a file came from outside | ✓ | Early Preview | ✓ |
| Memory injection scan | ✓ | ✓ | Early Preview |
| Stop and terminate an agent | ✓ | ✓ | ✓ |
| Restrict and isolate from the network | Early Previewpf | ✓nftables | ✓WFP |
| Hardware-held key | Secure Enclave | TPM 2.0 | TPM 2.0 |
| Anti-tamper (the Guardian) | User-space protectionmacOS has no third-party kernel route | Kernel module | Early Previewkernel driver, awaiting Microsoft signing |
| Boot measurement (the EFI Guardian) | — | Early Preview | Early Preview |
| Hardware monitor | Planned | ||
Personal and Professional, for one or two machines.
The standalone client runs on its own, with its own console and no Cortex. Both editions see and score everything; the difference is what they may do about it.
| Feature | Personal | Professional |
|---|---|---|
| Machines | 1 | 2 |
| Trial | 7 days | 14 days |
| Watch agents and score their behaviour | ✓ | ✓ |
| Observe and restrictwarn, rate-limit, confine | ✓ | ✓ |
| Isolate from the network | — | ✓ |
| Terminate a process | — | ✓ |
| Approval step before a hard response | — | ✓ |
| Local console, agent map, guardrails and alerts | ✓ | ✓ |
| Canaries, ransomware rules, self-protection | ✓ | ✓ |
| Sign-in with a passkeyTouch ID, Windows Hello | ✓ | ✓ |
| Analysis by the built-in, on-device model | ✓ | ✓ |
| Analysis by a cloud model | — | ✓ |
| Runs as a background service | — | ✓ |
| Command-line tools | — | ✓ |
| Local API | Rate-limited | ✓ |
| Event history | 7 days | Unlimited |
A standalone licence does not license a Cortex, and a Cortex licence does not license a standalone client. A lapsed licence withholds the licensed features and nothing else: SILO never stops watching over a billing state.
Business and Enterprise: one control plane, two sizes.
Both run the same Cortex, self-hosted in your data centre or your own cloud account. Business is the core platform for a small fleet. Enterprise adds the larger fleet, federation and the enterprise integrations.
| Feature | Business | Enterprise | Status |
|---|---|---|---|
| Fleet | |||
| Endpoint agents includedmore in packs of 5 or 10 | 5 | 20 | Available |
| Enrolment with administrator approval, mutual TLS | ✓ | ✓ | Available |
| Hardware attestation (TPM) | ✓ | ✓ | Available |
| Self-hosted on Linux with Dockeryour data centre, or your AWS, Azure or Google Cloud account | ✓ | ✓ | Available |
| Child Cortex federationeach child holds its own licence | — | ✓ | Available |
| Multi-tenant | — | ✓ | Available |
| Detection and response | |||
| Trust deficit score and ten-dimension trust vector | ✓ | ✓ | Available |
| Response ladder: observe, restrict, isolate, terminate | ✓ | ✓ | Available |
| Approval queue; Advisor mode by defaultserious actions wait for a named person | ✓ | ✓ | Available |
| Guardrail policies, templates and groups | ✓ | ✓ | Available |
| MCP tool-call gate: hold, approve, deny by scope | ✓ | ✓ | Available |
| Canary credentials, exfiltration, ransomware and rootkit detection | ✓ | ✓ | Available |
| Docker container agent | — | ✓ | Early Preview |
| Kubernetes (k8inspector)an operator with evict, cordon and quarantine | — | Add-on | Early Preview |
| Hypervisor reader (VMware)compares a virtual machine’s memory with its own account | — | ✓ | Early Preview |
| Causal trusttests a suspected cause, records model calls, watched services and declared scopes | — | Add-on | Early Preview |
| Hunt and the SOC | |||
| Hunt: search the live feed and the stored recordpreset hunts, captured binaries, investigations, forensic scan | ✓ | ✓ | Available |
| Active hunt: pursuit that escalates with the score | ✓ | ✓ | Available |
| Attack map, kill chain and threat intelligence | ✓ | ✓ | Available |
| SOC wall displayfull-screen map with estate score, threats, breaches and approvals | ✓ | ✓ | Available |
| AI assistant and autonomous AI brain | — | ✓ | Available |
| Cloud models for analysisAnthropic, OpenAI, Gemini, Azure | — | ✓ | Available |
| Governance | |||
| Agent inventory and compliance status per agent | ✓ | ✓ | Available |
| Governance report, as PDF or through the API | ✓ | ✓ | Available |
| Incident report for an agent, a host or the estate | ✓ | ✓ | Available |
| Tamper-evident event chain | ✓ | ✓ | Available |
| Reports mapped to frameworksSOC 2, ISO 27001, PCI DSS | — | ✓ | Early Preview |
| Audit log retention | 90 days | Unlimited | Available |
| Access | |||
| Roles: viewer, operator, admin, superadmin, tool approver | ✓ | ✓ | Available |
| Single sign-on (OIDC) with MFA | — | ✓ | Available |
| Passkey sign-in | ✓ | ✓ | Early Preview |
SILO supplies evidence for the controls frameworks describe. It does not make an organisation compliant, and it is not itself certified against any of them.
Gateways, clouds, storage and the SOC.
Integrations act outside the host: they read model traffic and flow logs, and carry out Cortex’s decisions where the agent is. Most are built and tested without yet having met the real service, and the status says so.
| Integration | What it does | Business | Enterprise | Status |
|---|---|---|---|---|
| API gateways and agent frameworks | ||||
| Kong | Records model calls; rate-limits or blocks an agent at the gateway | ✓ | ✓ | Available |
| Azure API Management | A policy that sends each exchange to Cortex | ✓ | ✓ | Early Preview |
| Google Apigee | A shared flow that sends each exchange to Cortex | ✓ | ✓ | Early Preview |
| AWS API Gateway and Bedrock logs | Through Firehose to Cortex | ✓ | ✓ | Early Preview |
| Google API Gateway | Through Pub/Sub to Cortex; requests and responses, never prompts | ✓ | ✓ | Early Preview |
| MCP proxy and relay | Holds tool calls for approval and denies those outside scope | ✓ | ✓ | Available |
| Agent framework webhook | A signed webhook for agent runs and tool calls | ✓ | ✓ | Available |
| Cloud | ||||
| AWS | Security-group isolation, WAF rules, VPC flow-log correlation | ✓ | ✓ | Early Preview |
| Azure | NSG isolation, WAF, flow logs | ✓ | ✓ | Early Preview |
| Google Cloud | Firewall and network-tag isolation, Cloud Armor, flow logs | ✓ | ✓ | Early Preview |
| Storage, containers and virtual machines | ||||
| NetApp ONTAP | Audit logs, volume metrics, XCP transfers and SnapDiff changes, scored against the agent | ✓ | ✓ | Early Preview |
| Kubernetes (k8inspector) | SiloAgent, SiloPolicy and SiloTenant resources; evict, cordon, quarantine | — | Add-on | Early Preview |
| VMware Workstation and Fusion | VM events, isolation and snapshots | — | ✓ | Early Preview |
| SOC and SIEM | ||||
| Microsoft Sentinel | High and critical alerts to your own tenant | — | ✓ | Early Preview |
| Splunk, Elastic, syslog | Alerts to your SIEM | — | ✓ | Planned |
| Webhook and SOAR triggers | Starts your own playbooks from a finding | — | ✓ | Early Preview |
Not sure which you need?
Tell us how many machines run agents, where they run and who will want the record. We will say which edition fits, and whether a design partnership makes sense.