An air-gapped Windows defense engine that detects high-entropy file encryption bursts in
< 1.80ms, freezes offending thread trees via NtSuspendProcess,
carves symmetric AES keys from process RAM before termination, and restores modified blocks
via VSS.
Scrub or step through the 1.44ms autonomous interception sequence below to inspect the exact kernel syscall, Shannon byte-entropy spike, and RAM key schedule extraction.
Hidden canary sentinel ~$cyzog_canary_01.docx registers an
unauthorized write notification from unsigned process PID 8842. High-priority file watcher routes the modified 4,096-byte buffer directly to the local ONNX + Shannon entropy analyzer with zero .sys kernel driver BSOD risk.
Every subsystem operates 100% locally with < 25 MB resident RAM and < 0.5% baseline CPU overhead.
Real-time desktop telemetry console displaying active tripwire status, VSS snapshot pool health, resident memory (< 25 MB RAM), and ONNX inference latency.
Executes a safe, isolated ransomware burst simulation in temporary RAM, verifying sub-millisecond thread freeze and exporting an HTML audit certificate.
Scans suspended process memory segments for active AES-256 and ChaCha20 session key schedules prior to process termination.
Intercepts and blocks child processes attempting vssadmin delete shadows, wmic shadowcopy delete, or bcdedit /set recoveryenabled no.
Maintains a protected local pre-write snapshot journal, reversing any file blocks modified during the sub-millisecond detection window with 1 click.
1-click containment switch that drops outbound network interfaces to sever C2 key exfiltration and halt lateral SMB encryption.
Statically inspects .xlsm, .docm, .ps1, .vbs, and .bat payloads for obfuscated Base64 stagers and high-entropy shellcode prior to execution.
Automatically plants canary tripwires on newly mounted USB volumes and sweeps for packed executables and malicious LNK shortcuts.
Evaluates local endpoint posture against CIS benchmarks: RDP port 3389 exposure, VSS service state, PowerShell execution policy, and UAC enforcement.
.env & Ransomware Benchmark
Don't take our word for it. Run cyzog-mcp-audit locally on your Windows PC, macOS laptop, or Linux/NAS server. It audits Claude/Cursor/VS Code MCP over-privileges, unignored .env & SSH keys (values redacted in RAM), and runs a safe ephemeral Zero-Day 7.98-Bit Entropy Fire Drill to prove whether your current AV stops behavioral encryption — generating a CSP-locked offline HTML Scorecard.
_socket & _ssl hard-locked to None in RAM & stripped from the .exe.
tempfile.mkdtemp & purges 100% of test bytes.
One-time acquisition with lifetime v4.x updates. No recurring annual renewals or per-seat cloud telemetry fees.
Workstation, Laptop & Homelab
Complete standalone anti-ransomware engine with pre-kill RAM key recovery, 1-click VSS rollback, and sandbox fire drill certification.
Linux Servers, Synology, TrueNAS, Unraid & Proxmox
Headless Linux eBPF & fanotify kernel daemon engineered for NAS appliances, ZFS/Btrfs pools, hypervisors, and production Linux hosts.
Air-Gapped Infrastructure & SCADA
Multi-node offline deployment with signed .nsupdate threat packs
Multi-node fleet defense for air-gapped data centers, Windows Server clusters, and sovereign Linux fleets.
Engineered for deterministic operation in disconnected, high-security environments without external network calls.
Inspect NeuralSentinelPersonal.exe or the Linux neural-sentinel daemon
under Wireshark, Sysinternals TCPView, or ss -tupn: zero cloud sockets are bound and runtime egress remains 0.00
KB/s.
Acquire the standalone Personal Pro installer immediately or contact engineering for air-gapped enterprise evaluations.
Verify your downloaded release offline using PowerShell (Get-FileHash) or Linux (sha256sum) prior to installation: