Genos

Firewalls, antivirus and SIEMs look for attacks they have already seen, and AI now produces new ones faster than those lists update. Genos learns what normal behaviour looks like on each server and flags the first move that departs from it, so an attack is caught before it runs rather than after the damage.

Reactive security answers the question "is this bad?", which only works for attacks someone has catalogued. Most simulated attacks never trigger an alert, a growing share of breaches now use AI, and security teams already leave a large part of their alerts unread. By the time a known signature matches, the attacker has usually moved on.

Genos asks "is this normal?" instead. It scans a server, turns that scan into a baseline of how the machine behaves, and flags the moment it stops acting like itself. It is written in Rust with eBPF, released openly for Linux starting with Ubuntu, and built by a founder who spent six years running company servers and now works as a threat researcher.