See
A small program, the sensor, runs on each computer. It reports every program started, every network connection, every login and every change to a critical file.
Postern Cyber is the security platform that comes with Postern OS, the hardened workstation for organizations. It puts a sensor on every managed device, stops known-bad programs before they run, rolls files back after ransomware, and hands each incident to an AI analyst running on Claude Mythos 5.2 through your own Anthropic API key. Your telemetry stays on your server unless you decide otherwise.
For now Postern Cyber is offered only together with Postern OS, as one product.
An attacker who gets into one machine leaves traces: a program that should not run, a login that should not succeed, a file that should not change. Postern Cyber collects those traces from every machine, recognises the patterns of an attack, and gives your team the means to stop it.
A small program, the sensor, runs on each computer. It reports every program started, every network connection, every login and every change to a critical file.
Your server compares that activity against 48 known attack behaviours and your own list of bad files and addresses, and raises an alert when one matches.
Related alerts are joined into one incident, in order. An AI analyst can read it and say what happened, how sure it is, and what to do.
From the console you stop a process, quarantine a file or cut a machine off the network. After ransomware you restore the files it encrypted.
The server is yours: one program on a machine you control, with its own database. Nothing your sensors collect goes to us unless you switch on a summary that carries no names, and you can read that summary first.
Postern OS is a hardened Linux system for desktops, phone-sized screens and the console. Postern Cyber is how an organization sees what happens on it. They are built and offered together.
A managed Postern OS image runs the sensor as a system service, enrolled with a token it receives as a protected credential. No installer to push, no agent to keep alive.
Postern OS checks itself: firewall, listeners, kernel hardening, memory-only swap, locked passwords and more. Each check arrives in your console as posture, per device.
Postern OS starts with no remote-login service, a filtering firewall, a hardened kernel and unused network protocols disabled. The sensor watches a small surface, so what stands out is easier to see.
Monitoring a computer is monitoring the person who uses it. A managed Postern OS device cannot be built without naming the organization, a privacy contact and the legal basis, and it shows them:
On Linux the kernel pushes every program start to the sensor, with parent, user and SHA-256. Connections, listening ports and logons on every platform.
48 rules for Linux, macOS and Windows: reverse shells, web shells, LSASS dumps, malicious documents, persistence, miners, tunnelling, log tampering. Write your own in YAML.
On Linux the kernel waits for the sensor's verdict. A binary on your hash block list, or under a blocked path, never starts, even renamed.
Versioned copies of the directories you protect, canary files checked every five seconds, and one action that restores the last good snapshot.
Alerts on one host inside a 30-minute window join a single incident, so an intrusion reads as one case instead of ten pages.
Kill a process, quarantine a file, isolate a host from the network with nftables. Manual by default; automatic per host in protect mode.
Account databases, sudoers, SSH keys, cron, systemd units and the dynamic linker preload are hashed and watched for change.
Load file hashes and addresses. A running process or connection that matches raises a high-severity alert.
Installed packages are matched against the public vulnerability database on your own server. Plus SSH, firewall, updates, disk encryption and Defender checks.
Post firewall, cloud or identity logs to one API endpoint. They run through the same detections and land in the same incidents.
Sign in through your identity provider with OpenID Connect. Viewer, analyst and admin roles. Every action is recorded with who asked for it.
Paste an Anthropic API key in Settings and the console gains an analyst. Mythos 5.2 is available to verified organizations; any other Claude model id works in the same field.
One click sends the alerts and the surrounding telemetry. Back comes a verdict, a confidence figure, a narrative that cites event ids, ATT&CK techniques and a list of actions to approve.
Ask "did anything on the database hosts open a new listener this week?" The model queries your event store with read-only tools and shows every query it ran.
Describe a behaviour. You get a validated rule, the reasoning behind it and the false positives to expect. It goes live only when you save it.
Command lines and file names are written by the attacker. The integration assumes they will try to talk to the model.
Passwords and tokens typed on a command line are masked on the device before upload. No file contents, keystrokes, screens, browsing history or DNS queries are collected.
Export every record of one person as a file, or erase them. Remove a retired device with everything it reported. Evidence of an incident is kept, with the person's name and commands removed.
Ordinary records expire after a period you set, 30 days by default; evidence of closed incidents and the audit log after a longer one.
The legal basis, the impact assessment and the notice to your staff are yours to decide and document. The software gives you the means; it is not legal advice.
A single binary with an embedded database and console. It writes an admin token on first start.
postern-server \ --listen 127.0.0.1:8460 \ --data-dir /var/lib/postern
Observe-only unless you grant response capabilities on that host.
postern-sensor \ --server https://console.example.com \ --enroll-token pce_… \ --response kill,isolate,prevent,rollback \ --protect /srv/data
Set the key in the console, or keep it out of the database entirely.
export ANTHROPIC_API_KEY=sk-ant-… export POSTERN_AI_MODEL=claude-mythos-5-2
Postern Cyber is in private preview. This table is the full picture, so you can judge it against the platform you run now.
| Area | In 0.2 | Open |
|---|---|---|
| Offering | Together with Postern OS, on managed Postern OS devices | Postern Cyber on its own, for other systems |
| Platforms | Linux sensor, used by Postern OS; macOS and Windows sensors exist in the codebase | macOS and Windows are not part of the current offering; Windows process and network telemetry is not yet proven on a real Windows host |
| Telemetry | Kernel-pushed process events on Linux; polling on macOS and Windows | eBPF, so the command line of a microsecond-lived process is guaranteed too |
| Prevention | Hash and path blocking before execution on Linux | Windows and macOS blocking; machine-learning verdicts |
| Ransomware | Canaries, mass-encryption detection, rollback of protected directories | Off-host copy of the vault; whole-disk snapshots |
| Exposure | CVE matching for Ubuntu and Debian; posture checks everywhere | Other distributions, Windows and macOS software |
| Cloud & identity | Log ingestion through the API | Native cloud and identity-provider connectors |
| Postern OS | Sensor as a system service, posture from the system's own report, logins from the journal; tested with server and sensor in one virtual machine | A managed image on real hardware; response actions on Postern OS; software inventory for CVE matching |
| Data protection | On-device notice, secret masking, retention, export and erasure per person, device removal, audit log, vendor summary without identities | Review by an independent auditor or a data protection authority |
| Console access | Single sign-on (OpenID Connect) and three roles | Multi-tenancy |
| Assurance | 32 unit tests, kernel tests in a container, SSO tests against a mock provider, a booted Postern OS test | Independent security audit; AI analyst run against a production key |
Postern Cyber and Postern OS are licensed together, per device and per year. Both are in private preview and not yet on general sale.