🛡️
SecAdvisor
Partly built- What it is:
- A hypervisor-based security monitor that runs at Ring -1 — one privilege layer below the operating system. The OS runs as a guest VM, and SecAdvisor watches from beneath: raw memory, CPU state, DMA and I/O. The OS cannot detect it, and malware cannot hide from it.
- Who it is for:
- People and fleets that need to see what happens below the OS — including what a Ring 0 rootkit hides.
- Where to get it:
- Partly built — the installer-side panel ships today; the Ring -1 monitor itself is not built.
Details
A hypervisor-based security monitor that runs at Ring -1 — below the operating system. The OS runs as a guest; SecAdvisor watches raw memory, CPU state, DMA and I/O from beneath, where malware cannot hide. Today the installer-side panel ships; the monitor itself is not built.
Use cases
- •See what happens below the OS — including what a Ring 0 rootkit hides
- •Fleet visibility into what your machines are actually running (planned)