The autonomous, auditable action layer for security operations.
Detection is solved. Response is not. An alert fires, lands in a queue, and at 2am nobody is home. When someone does act, no one can reconstruct afterward what was done or why. Teams bought detection and were left alone with the hard part.
Vyrox acts on the alert and proves it. We triage every EDR alert, take action on the ones that are real, and write every action to a tamper-evident log the customer owns.
[EDR alert] -> [Ingest] -> [Heuristics] -> [LLM triage] -> [Decide] -> [Act] -> [Audit]
- Ingest - CrowdStrike, SentinelOne, Defender, and a field-mapped generic adapter post alerts to a per-tenant webhook, authenticated with HMAC-SHA256.
- Triage - A deterministic heuristics engine clears the obvious noise in milliseconds. Only the genuinely ambiguous alerts reach an LLM, which writes verdict fields and never executes anything.
- Decide - Human approval by default. Autonomous only where the customer has turned it on and the action is reversible.
- Act - Approved containment runs through a small, hardened Rust proxy: signed, rate-limited, and built to fail closed.
- Prove - Every action lands in a SHA-256 hash-chained audit log the customer owns, ready for an auditor or an insurer.
Sold MSSP-first: one analyst runs many client tenants from a single console and can prove every action to each client's auditor. Lean in-house teams that own security but have no 24/7 SOC come in through the inbound door.
The execution proxy is MIT licensed. If a piece of software can isolate a production host, the people running it should be able to read exactly what it does before they trust it. The heuristics corpus and the orchestration core stay private: that is the product, and handing detection logic to attackers helps no one.
| Repo | What it is | License |
|---|---|---|
| vyrox-proxy | Rust containment proxy, the audited execution boundary | MIT |
| vyrox-docs | Public architecture, API contracts, threat model, audit-chain spec | Proprietary |
| vyrox-simulator | Deterministic alert simulation for exercising the pipeline | MIT |
| vyrox-www | Public product site | Proprietary |
- Website: vyrox.dev
- General: hello@vyrox.dev
- Security: security@vyrox.dev (see SECURITY.md and the PGP key)
Alpha. Shipping today: the Rust proxy, ingestion, two-stage triage, human-approved containment, and the SHA-256 audit chain. In active build: the operational console, graduated autonomy, and the evidence engine.
 keirsalterego |
 starkalterego |
Total unique contributors: 2
Built for analysts who deserve real signal, not 300 false positives a shift.