HodeiShield®

Signed evidence from your machines, limits in plain sight.

An agent observes the security configuration of laptops and servers and sends each check signed. The console rejects what does not verify and stops counting machines that stop reporting.

For: The CISO who needs technical evidence from their machines without building a SOC, and the MSSP partner who runs it for several clients.

Request a demoRead the agent guide (opens in a new tab)
  • Windows (.msi), macOS (universal .pkg) and Linux x86_64
  • It does not replace your EDR: it observes its state and remediates nothing

Signed observationhost-01

Sample data

Observation envelope

host
host-01
System
Ubuntu 22.04

Checks

  • System disk encryptionPass
  • Operating system firewallPass
  • SSH: root loginFail
  • Clock synchronisedPass
  • Secure bootN/A

SSG baseline · Ubuntu 22.04 · L1

87 % of applicable rules

Per-machine detail. It does not yet feed the compliance score.

SignatureML-DSA-65 · verified by the console

FreshnessLast observation 2 days ago · expires at 7

Sample data: the host, results and percentages are fictional.

What it looks at and what it does not collect

The agent is built to observe security posture, not people's activity. These two lists are the contract.

What it checks

  • Accounts and authentication: password policy and lockout after failed attempts.
  • EDR and antimalware: whether protection is active and its definitions current.
  • System disk encryption and the operating system firewall.
  • Secure boot and native protections (SIP on macOS, mandatory access control on Linux).
  • System auditing, SSH remote access, network hardening and automatic operating-system security updates.
  • Clock synchronisation.
  • Open level-L1 baselines (SCAP Security Guide, NIST mSCP, DISA STIG) on Ubuntu 22.04 and 24.04, macOS 14 and 15, and Windows 11 and Server 2022.

What it does not collect

  • File contents or browsing history.
  • Running processes or CPU and memory usage.
  • Passwords or any kind of credential.
  • The device's MAC address.

Besides each check's result, it does send minimal identification: hostname, public IP addresses and the operating system's family, name and version.

What it does, with its proof and its scope

Each claim carries, in the margin, where to check it and where it stops.

Source of proof

  • Public documentation
  • Open source
  • In the demo

Scope: what the claim does not cover

SENSE · collect evidence

Signed observations from the machine, which stop counting when they stop arriving.

  1. Every observation travels digitally signed, and the console rejects those that do not verify.1

    Docs · Endpoint agent (opens in a new tab)

    Scope. The telemetry is signed, not the installer: agent releases carry no detached signature.

  2. The agent emits 172 checks: 29 general ones and 143 baseline checks against open references (SCAP Security Guide, NIST mSCP and DISA STIG), at level L1.2

    In the demo · a machine's detail

    Scope. L1 only and only the operating systems listed; it is not «CIS Benchmark».

  3. A machine that stops reporting stops counting as compliant: the default freshness window is seven days.3

    In the demo · machine status

    Scope. The agent reports in cycles; it is not real-time monitoring.

  4. It is installed with a single-use enrolment token that an administrator generates, and revoking a machine is an explicit act in the console.4

    Docs · Installation (opens in a new tab)

    Scope. Uninstalling the agent does not revoke the machine: revoke it from the console.

Applies inMulti-framework compliance

PREDICT · quantify and simulate

Which part of what is observed counts towards the score and which is only detail.

  1. The agent's point-in-time checks feed the endpoint posture score you see in the console.5

  2. Each applicable baseline shows per machine as the percentage of rules that pass, computed on the machine itself and sent signed.6

    In the demo · a machine's baseline

    Scope. It is detail: the 143 baseline checks do not yet feed the compliance score. No L2 level and no CIS mapping.

Applies inMulti-framework compliance

ACT · propose and approve

What is done with what the agent sees, and what is not.

  1. The agent takes no remediation action on the machine: it only observes and reports.7

    Docs · Agent limits (opens in a new tab)

    Scope. It does not update itself either: to move to a new version you download the installer and reinstall, keeping the enrolment.

  2. Each major version of the agent is supported for 5 years from 1.0, and security updates remain available after a subscription lapses.8

    Docs · Support period (opens in a new tab)

    Scope. End of support is announced 12 months in advance. It sets the support period, not response times or availability.

  3. Console alerts are routed to ServiceNow, Jira, Slack, Teams, email, a signed webhook, SIEM, PagerDuty and Opsgenie according to your rules.9

    Docs · Connectors (opens in a new tab)

    Scope. It notifies or creates the ticket in your system; it does not remediate.

Applies inHodeiAI

ATTEST · prove it to third parties

What leaves the machine for the outside is a band, not a list of machines.

  1. The Trust Center attestation carries only per-framework maturity bands: never scores, amounts or per-machine detail.10

    Open source · ATTEST verifier (opens in a new tab)

    Scope. It proves integrity, origin and time, not truth, and it does not replace an audit.

Applies inTrust Center and ATTEST

SENSE feeds PREDICT; PREDICT prioritises what ACT proposes; ATTEST proves it to third parties.

What it does not do

The agent's limits, with no small print.

  • It does not replace your EDR or antivirus: it observes whether they are active and current.
  • It does not remediate, isolate machines or run actions on the system.
  • It does not update itself: a new version means downloading the installer, with no new token needed.
  • The installer carries no verifiable signature: only the telemetry is signed.
  • Baselines cover level L1 only on the listed systems; there is no L2, no CIS Controls mapping and no other distributions.
  • On Linux there is only an x86_64 installer.

How it connects to the other solutions

The agent feeds the others and depends on none.

Questions from whoever decides what gets installed

What the security team and the DPO usually ask.

Does it replace my EDR or antivirus?

No. The agent checks whether protection is active and current, along with the rest of the security configuration, and reports it to your organisation. It does not block or detect threats on its own.

What data leaves the machine?

The result of each check, signed, and minimal identification: hostname, public IP addresses and the operating system's family, name and version. It does not collect file contents, browsing history, processes, credentials or the MAC address.

What does «172 checks» mean?

It means 29 general checks and 143 open-baseline checks (SCAP Security Guide, NIST mSCP and DISA STIG, level L1). Baselines are shown as per-machine detail and do not yet feed the compliance score.

Does it update or repair itself?

No. It does not update itself and runs no remediation. To change version you download the installer and reinstall; the machine's enrolment is kept.

Which systems does it run on?

Windows (.msi installer), macOS (universal .pkg for Apple Silicon and Intel) and Linux x86_64 with systemd. Baselines cover Ubuntu 22.04 and 24.04, macOS 14 and 15, and Windows 11 and Server 2022.

What happens when I retire a machine?

Uninstall the agent and revoke the machine from the console's endpoints section. Until you revoke it, its identity stays active even if the agent is no longer installed.

See a machine from inside the console

In the demo we open a machine's detail: its checks, its baseline and its freshness, with the limits on the table.

The agent guide, with its list of what it does not collect, is public.

Request a demoRead the agent guide (opens in a new tab)