Origin Story
Why We Built Inner Warden
A first-person manifesto about why a single-binary autonomous EDR for Linux is needed in 2026. The pain that pushed us out of MDR contracts and DIY Wazuh stacks.
5 min read
ReadProject
Architecture and Contributors
Why Inner Warden exists, how the codebase is shaped, how to contribute safely, and the engineering choices behind the agent.
15 articles in this hub
Thesis
The Autonomous EDR Thesis
Defining autonomous EDR precisely: detection without a human in the loop, AI confidence-gated response, dry-run safety. Why this is the inevitable shape of endpoint security.
8 min read
ReadVision
InnerWarden: The Self-Defending Server
From the deepest hardware layer to user applications, in one Rust binary. 40 monitors, 82 detectors, 69 correlation rules, behavior learning, mesh network. The full picture.
7 min read
ReadArchitecture
Inner Warden Architecture: A 30-Minute Tour
The workspace map for a new contributor. Sensor, agent, ctl, the JSONL contract, SQLite as source of truth, slow_loop ticks, dashboard reads. With file paths.
12 min read
ReadTutorial
Your First Inner Warden Detector in 50 Lines
Walk through writing a custom detector for `wget | sh` patterns. File location, the trait, registration, unit test, validation via make replay-qa.
9 min read
ReadContributing
Contributing Your First PR to Inner Warden
Walk-through of make test, make check, make replay-qa, make heap-budget. Style points, the gates a PR has to clear, friendly enough to set the bar without scaring people off.
7 min read
ReadOrientation
Where to Start Hacking on Inner Warden
Three contributor tracks: add a detector or Sigma rule, add a notification sink, add an integration recipe. With a what-NOT-to-start-with list.
6 min read
ReadEngineering
Why We Switched to jemalloc (and How glibc malloc Was Eating 1GB RAM)
The story of how glibc malloc fragmentation caused our Rust daemon to grow to 1.3GB under bot traffic, and how jemalloc fixed it with 3 lines of code.
7 min read
ReadeBPF
Aya, eBPF, Rust: Lessons From Shipping 40 Hooks to Production
Real lessons from running 40 eBPF hooks (tracepoints, kprobes, LSM, XDP). #![no_std], CO-RE/BTF, ring buffer with epoll, common verifier failures, debugging.
10 min read
ReadValidation
We Ran MITRE Caldera Against Our Own Product. Here's What We Found.
5 rounds of adversary emulation with Caldera v5.3.0. From 36% detection to 67% of testable techniques. The argv truncation fix, 15+ false positive cleanups, and why mapped is not detected.
14 min read
ReadManifesto
Endpoint Security for the Rest of Us
How PostgreSQL, Linux, and Let's Encrypt democratized previously-elite tech. Endpoint detection is next. A freelance dev's VPS deserves the same defenses as Goldman Sachs.
6 min read
ReadVelocity
Ship Now, Secure Now: You Can't Pick One Anymore
AI codegen made shipping faster. Attacker tooling made exploitation faster. The old ship-first-harden-later loop is dead. The case for security that defaults on.
6 min read
ReadOpinion
Why Default-Deny Is the Wrong Default
A security tool that ships with auto-block ON locks operators out and gets uninstalled. The case for dry-run-first: detect everything, log everything, escalate on confidence.
7 min read
ReadArchitecture
Agent vs Agentless Monitoring: When Each Wins
Network IDS vs cloud APIs vs eBPF on host. Encrypted traffic, runtime visibility, fleet-scale config audit. When you'd choose each, not a settled debate.
7 min read
ReadArchitecture
Collaborative Defense: How Game Theory Protects a Security Mesh Network
Ed25519 signed signals, tit-for-tat trust evolution, staging pools with TTL auto-reversal. How Inner Warden nodes share threat intelligence without letting anyone abuse the network.
9 min read
Read