Origin Story
Why We Built InnerWarden
A first-person manifesto about why a single-binary autonomous EDR for Linux is needed in 2026. The pain that pushed us out of MDR contracts and DIY Wazuh stacks.
5 min read
ReadProject
Architecture and Engineering
InnerWarden is a source-available core with a small, legible architecture: a deterministic sensor, an interpretive agent, and a CLI, each doing one job. These posts are how it is built and how to build on it.
11 articles in this hub
How InnerWarden approaches this
The sensor stays deterministic with no LLM in the hot path; the agent is the only layer allowed to reason and call out. That split is deliberate, it keeps detection trustworthy and response auditable. These posts cover the design decisions, the module boundaries, and how to extend it.
Articles in this hub
Thesis
The Autonomous EDR Thesis
Defining autonomous EDR precisely: detection without a human in the loop, AI confidence-gated response, dry-run safety. Why this is the inevitable shape of endpoint security.
8 min read
ReadVision
InnerWarden: The Self-Defending Server
From the deepest hardware layer to user applications, in one Rust binary. 40 monitors, 82 detectors, 69 correlation rules, behavior learning, mesh network. The full picture.
7 min read
ReadEngineering
Why We Switched to jemalloc (and How glibc malloc Was Eating 1GB RAM)
The story of how glibc malloc fragmentation caused our Rust daemon to grow to 1.3GB under bot traffic, and how jemalloc fixed it with 3 lines of code.
7 min read
ReadeBPF
Aya, eBPF, Rust: Lessons From Shipping 40 Hooks to Production
Real lessons from running 40 eBPF hooks (tracepoints, kprobes, LSM, XDP). #![no_std], CO-RE/BTF, ring buffer with epoll, common verifier failures, debugging.
10 min read
ReadValidation
We Ran MITRE Caldera Against Our Own Product. Here's What We Found.
5 rounds of adversary emulation with Caldera v5.3.0. From 36% detection to 67% of testable techniques. The argv truncation fix, 15+ false positive cleanups, and why mapped is not detected.
14 min read
ReadManifesto
Endpoint Security for the Rest of Us
How PostgreSQL, Linux, and Let's Encrypt democratized previously-elite tech. Endpoint detection is next. A freelance dev's VPS deserves the same defenses as Goldman Sachs.
6 min read
ReadVelocity
Ship Now, Secure Now: You Can't Pick One Anymore
AI codegen made shipping faster. Attacker tooling made exploitation faster. The old ship-first-harden-later loop is dead. The case for security that defaults on.
6 min read
ReadOpinion
Why Default-Deny Is the Wrong Default
A security tool that ships with auto-block ON locks operators out and gets uninstalled. The case for dry-run-first: detect everything, log everything, escalate on confidence.
7 min read
ReadArchitecture
Agent vs Agentless Monitoring: When Each Wins
Network IDS vs cloud APIs vs eBPF on host. Encrypted traffic, runtime visibility, fleet-scale config audit. When you'd choose each, not a settled debate.
7 min read
ReadArchitecture
Collaborative Defense: How Game Theory Protects a Security Mesh Network
Ed25519 signed signals, tit-for-tat trust evolution, staging pools with TTL auto-reversal. How InnerWarden nodes share threat intelligence without letting anyone abuse the network.
9 min read
Read