Example: three threats around a fleet of servers, one blocked, one waiting for approval, one open incident.
OverviewDemo fleet, example data
ClearOvercastStorm
Fleet score 94. Nothing needs you right now.Fleet score 78. Injection probes against shop.example.com.Fleet score 41. Incident on web-1. A block waits for your approval.
hosts
6
containers
41
blocked in 24 h
1,117
critical open
01
ClearOvercastStormBars: attacks blocked
09:0012:0015:0018:0021:0000:0003:0006:00now
Live events
Responseall hostsBlocked 203.0.113.77 on 6 of 6 hosts
Kernelshop-apiCritical Outbound connection to 203.0.113.140:4444
Kernelshop-apiHigh Shell spawned in a container
Webshop.example.comSQL injection probes from 203.0.113.77
Blockweb-2Banned 203.0.113.24 for SSH brute force
Dockerci-1Container build-runner restarted
SSHweb-1Login for deploy from a known address
No open incidents
CriticalOpenContained
Web probe, then a shell in shop-api
web-1.example.com, container shop-api
Injection probes T1190
Shell in container T1059.004
Connection to port 4444 T1571
Block 203.0.113.77 on all hosts? Waiting for your approval.Approved by you. Blocked on 6 of 6 hosts in 3 s.
Demo of the SkyShield overview with example data: six hosts, the sky over the last 24 hours, a live event feed and one incident that was
contained after an approved block.
Runs where your servers do
Linux
Windows
macOS
Docker
Proxmox
AWS
Azure
Google Cloud
Hetzner
DigitalOcean
OVHcloud
Bare metal
One platform, from the kernel to the auditor
More than twenty screens on one stream of data. The panel is grouped the way you work: watch what happens, fix what is weak, know what
you run.
One agent per machine reads what the machine already records, adds a sensor in the kernel and sends it all to your hub as one stream. In
brackets: where the data comes from.
Attacks as they happen
Streamed to your hub within seconds.
Process and file activity
Shells inside containers, reads of /etc/shadow, replaced binaries, odd outbound connections.
(the kernel, through eBPF)
Logins
Every SSH login and failed attempt, new source addresses, a success right after a run of failures.
(SSH journal)
Attack blocking
Brute force and scans already stopped, by scenario, country and network. (the machine's blocklist)
Web attacks
Injection probes, path scans and vulnerability scanners, per site and per address.
(Traefik and nginx logs)
Containers
Every start, stop, crash and restart, with the image, ports and limits of each container. (Docker)
Weak spots, before someone finds them
A quick check every 10 minutes, a full scan every night.
Vulnerabilities
Known CVEs in packages and images, ranked by real exploitation and how likely it is.
(packages, images, CISA KEV and EPSS)
System hardening
An audit of the operating system's settings, with the change to make for each finding. (system settings)
Secrets in code
API keys, tokens and passwords committed to repositories on the machine, reported redacted.
(repositories on disk)
Configuration drift
New accounts, SSH keys, open ports, cron jobs, services and packages: what changed since the last look.
The machine itself
A full disk takes a site down as surely as an attack.
Host health
Disk wear, RAID state, temperatures, the age of the last backup and TLS certificates before they expire.
Performance
CPU, memory, network and disk for every host and every container, measured against their limits.
Inside the panel
Simplified views of the panel's screens, filled with example data.
Related events become one incident
A web probe, a shell in a container and an outbound connection two minutes later are one attack, not three alerts. SkyShield joins
them into one story with a timeline, the hosts and containers involved, and the MITRE ATT&CK technique behind each step.
IncidentsExample data
Web probe, then a shell in shop-api
web-1.example.com, container shop-api, 4 events in 4 min
CriticalContained
SQL injection probes from 203.0.113.77 on shop.example.com
Example incident with four related events, their times, sources and ATT&CK techniques.
Every machine and container on one live map
Hosts, containers and the links between them, drawn from what the agents see. Pick one bundle, such as a shop and its databases, and
the rest steps back.
TopologyExample data
Example topology: four hosts with their containers. The shop bundle (traefik, shop-web, shop-api, postgres and redis) is in focus;
shop-api has an open alert.
Block an address everywhere, after you say yes
Ask to block 203.0.113.77 and every machine applies it within seconds. Nothing runs without your approval, and every request, approval
and result lands in the audit log.
ApprovalsExample data
Block 203.0.113.77 for 7 days
On all 6 hosts, through each host's blocklist. Suggested by incident 412.
ApproveDecline
Audit log
Applied on 6 of 6 hosts, last one after 3 s
Sent to web-1, web-2, db-1, ci-1, mail-1, backup-1
Approved by you
Requested by incident 412
Example approval request to block one address on all hosts, with the audit log of request, approval, delivery and result.
Fix these ten first
Hundreds of CVEs, sorted by what attackers actually use: known exploitation from CISA KEV, likelihood from EPSS, and how many machines
carry each one. The panel shows how much of your risk each fix removes, so the top of the list does most of the work.
VulnerabilitiesExample data
These 10 fixes remove 80 % of the risk
312 open CVEs on 6 hosts and 41 containers
CVE
Package
Exploited
EPSS
Hosts
CVE-2021-44228
log4j-core
KEV
94 %
2
CVE-2021-4034
polkit
KEV
86 %
3
CVE-2023-4911
glibc
KEV
71 %
4
CVE-2023-44487
nginx
KEV
62 %
2
CVE-2022-0847
linux
KEV
45 %
1
and 5 more in the plan
Example fix plan: the first five of ten CVEs that together remove 80 percent of the risk score.
Health and performance next to security
A worn disk, a degraded RAID, a certificate that expires on Sunday or a container near its memory limit are risks too. They sit next
to the security findings, per host and per container.
HealthExample data
web-1.example.com
Disk nvme0 wear37 %OK
RAID md0cleanOK
CPU temperature54 °COK
Last backup7 h agoOK
TLS shop.example.com12 days leftRenew
Memory against limit
shop-api1.7 of 2 GB
postgres2.4 of 4 GB
shop-web220 of 1024 MB
traefik92 of 512 MB
Example health checks for one host, all fine except a TLS certificate with 12 days left, and memory use of four containers against
their limits.
How it works
Install one agent per machine
One command on each server. The agent connects out to your hub; it opens no ports.
Docker, the system journal, proxy logs and the kernel, all from the host. Nothing to install or change inside your containers.
The hub keeps it, you watch it live
Events land in a fast event store on your hub, findings and state next to them. The panel streams new events as they arrive.
web-1agent
db-1agent
ci-1agent
Docker
journal
eBPF
proxy logs
scanners
outbound only
Hubevents, state, rules and incidents
live stream
Panelin your browser
Diagram: an agent on each machine sends events outbound to the hub, which stores them and streams them live to the panel in your
browser.
Light on your servers
The agent stays out of the way of the services the machine is there for. Measured on a hypervisor and on a Docker host running 110
containers:
Agent memory
70–85 MB
slows at 1 GBstops at 1.5 GB
Agent CPU
0.5–2.5 % of one core
quota 30 %1 core
Kernel sensor memory
90–125 MB
1.5 GB
Full scans
nightly, lowest priority
02:300006121824
These are typical numbers, not guarantees: they grow with the number of containers and the volume of events. Limits come from the agent's
systemd unit (CPU quota 30 %, memory slowed above 1 GB and stopped at 1.5 GB). Full scans run at 02:30 local time at nice 19 and idle I/O
priority, inside the same memory ceiling; a quick check without the heavy scanners runs every 10 minutes.
Plans and pricing
Priced per server. Every plan has every sensor; plans differ in how many servers you watch, how long the history goes back and what you
can do with it.
Vulnerabilities and findings, each with a fix and an undo
Yes
Yes
Yes
Yes
Nightly full scan
Yes
Yes
Yes
Yes
Block and unblock attackers after approval
No
Yes
Yes
Yes
Re-scan on demand to confirm a fix
No
No
Yes
Yes
Prove
Approval log: who blocked what, and when
No
Yes
Yes
Yes
Compliance reports (CIS, ISO 27001, SOC 2, NIS2, PCI DSS) as PDF and CSV
No
No
Yes
Yes
Separate environments (production, staging…) with their own views
No
No
Yes
Yes
Run
Hosted hub
Yes
Yes
Yes
Or on your servers
Support
Community
E-mail, next business day
Priority, 4 business hours
Named engineer
Prices in US dollars, before VAT. A server is any machine with the agent: a VPS, a bare-metal host or a VM. Containers on it are never
counted, and there is no minimum.
SkyShield and the competition
Enterprise EDR is ahead on kernel-level prevention, managed hunting and Windows. SkyShield is for teams with a handful of Linux servers
running Docker who want to see everything and decide for themselves.
SkyShield
Enterprise EDR e.g. CrowdStrike Falcon, SentinelOne
DIY open source Wazuh or Elastic, plus scripts
Docker and container awareness
Yes
Every container, its image, ports and events, read from the host.
Yes
Usually through a separate cloud or container workload module.
Partial
Docker events are there; tying them to hosts and alerts is up to you.
Host health and performance
Yes
Disk wear, RAID, temperatures, backups, certificates, CPU and memory per container.
No
Outside their scope; you run a monitoring tool next to it.
Partial
Add Prometheus and Grafana or similar, and wire the alerts yourself.
Vulnerabilities with priorities
Yes
Ranked by CISA KEV, EPSS and how many machines carry them.
Yes
Mature, often sold as an add-on module.
Partial
CVE detection is there; ranking by real exploitation is mostly manual.
Live detection
Yes
Kernel events through eBPF, SSH logins, blocks and web logs, streamed live.
Yes
And ahead: behavioural engines and threat intelligence built over many years.
Yes
With rules you write, tune and maintain.
Blocking with approval
Yes
One address blocked on every machine, only after you approve, with an audit log.
Yes
Automatic or one-click response, set by policy.
Partial
Active-response scripts; an approval step is yours to build.
Setup time
One agent per machine and nothing inside containers. The one-line installer is coming soon.
Quick agent rollout once the contract and onboarding are done.
Quick to install, long to tune: indexer, dashboards, rules and scripts.
Price for small fleets
Free for one server, then from $99 per server a month. Containers are never counted, no minimum.
Server protection with EDR lists at about $15 to $17 per server a month. Containers, Kubernetes nodes and cloud modules usually
cost extra, and cloud platforms often start at a yearly minimum.
No licence fees; you pay in hardware and your own time.
Network flows and firewall exposure
Yes
Who talks to whom per process, and what the firewall really lets in, followed through port forwards to the container.
Partial
Network events in EDR; external attack surface is usually a separate product.
Partial
Possible with Zeek or flow exporters and your own dashboards.
Compliance evidence
Yes
CIS, ISO 27001, SOC 2, NIS2 and PCI DSS controls with pass or fail per machine, as PDF or CSV.
Yes
In cloud and posture modules, often an add-on.
Partial
Wazuh maps alerts to frameworks; the report is up to you.
Runs on your own servers
Yes
The hub can run on your own servers, and your data never has to leave them.
No
Cloud service; a few vendors sell on-premise versions to large customers.
Yes
Self-hosted by design.
Malware scanning on the host
No
Not yet. File and process detections come from the kernel sensor; signature scanning is planned.
Yes
Next-generation antivirus is the core of these products.
Partial
ClamAV or YARA, wired up by hand.
Kernel-level prevention
No
It detects in the kernel with eBPF but does not block system calls; it responds after detection.
Yes
Inline prevention on the machine is their core strength.
No
Not out of the box.
24/7 managed hunting
No
You see everything and decide yourself.
Yes
As managed services, such as Falcon Complete or SentinelOne Vigilance.
No
Not unless you hire a provider.
Windows and laptops
Partial
The scanner runs on Windows and macOS; live sensors are Linux first.
Yes
Years of maturity on Windows endpoints.
Partial
Agents exist; coverage depends on your rules.
Evidence for your auditor
SkyShield maps what it checks and records to the controls auditors ask about, shows which pass and which fail on which machine, and
exports the evidence as a PDF or CSV report.
A SkyShield report supports an audit; it is not a certificate, and some controls always need a process of your own, which the report
names. SkyShield itself has not been through a SOC 2 or ISO 27001 audit yet.
CIS Benchmarks
Docker and Linux host checks the agent evaluates on every scan, pass or fail per machine.
ISO/IEC 27001:2022
Annex A technical controls: logging, monitoring, vulnerability and configuration management.
SOC 2
Common criteria for monitoring, change management and incident response.
NIS2
Article 21 measures: incident handling, vulnerability handling, access control and logging.
PCI DSS v4.0
Requirements 1, 2, 5, 6, 8, 10 and 11 for the servers in scope.
Security of SkyShield itself
A security tool sees a lot of your systems, so it has to be careful with that access.
Read-only, with one short allow-list
The agent reads the system. The only thing it will change is a ban or unban of a public address in the machine's blocklist, after
you approve it. It checks every command itself, so even a forged answer from the hub can't make it run anything else.
Its own systemd sandbox
Lowest CPU and I/O priority, hard CPU and memory limits, no way to gain privileges, and write access to its own data folder only.
Signed and pinned tool downloads
Every scanner comes at a pinned version whose release signature was checked, and every download must match its SHA-256 before it
runs.
No inbound ports
The agent connects out to your hub. Nothing on your machines listens for SkyShield.
Secrets stay on your hub
Keys and findings travel only between your machines and your hub. Secrets found in code are reported redacted, never copied.
Open-source sensors under the hood
The sensing is done by proven open-source tools whose code and rules are public and widely reviewed.
From the agent's systemd unit
# Never compete with the services this machine runs.
Nice=19
IOSchedulingClass=idle
CPUQuota=30%
MemoryHigh=1G
MemoryMax=1536M
# A read-only sensor: it reads the system but writes# only to its own data folder.
ProtectSystem=full
ProtectHome=read-only
ReadWritePaths=/var/lib/skyshield
PrivateTmp=true
NoNewPrivileges=true
Know what happened on your servers last night.
Start free with one server and every sensor. Move to Team when your whole fleet needs watching.
