The security agent that fights back.
Most security tools warn you when something's wrong. Inner Warden runs its own AI deep inside your server, decides what's a real threat, and stops it. No team to react, no cloud needed. Open-source, you decide where your data goes.
curl -fsSL https://www.innerwarden.com/install | sudo bash- setup
- automatic
- mitre
- 65 techniques
- default
- dry-run
Five jobs. One agent inside your server.
A guard. Inside your server.
Not a tool watching from outside. Not an alert in someone else's dashboard. Inner Warden runs inside your server, watches what every program does, and decides what to do. All without leaving the box.
What happened on this server today? Did anyone try to log in? Is that process supposed to be running? Ask in plain English, get an answer in plain English. No grep, no log files, no SIEM query.
When a malicious command runs on your server, Inner Warden sees it before the kernel does. Suspicious shell, blocked. Privilege escalation, killed. The attacker types, but nothing executes.
It's 2 AM. Someone brute-forces your SSH. You're asleep.
Here's what Inner Warden does while you don't notice.
Threat contained. 4 seconds.
8 failed SSH logins in 300 seconds from 203.0.113.42. Inner Warden catches the pattern, the local AI confirms brute-force with 0.90 confidence. No cloud call, no data leaving the server. Firewall deny rule added via ufw. Logged for the morning summary. Your phone stays quiet.
They came back. Inner Warden remembered.
Same attacker, different IP. Behavioral fingerprinting recognizes them: same commands, same targets, same timing window. The new IP is treated as a known threat from the start. Then they hit the honeypot. Fake SSH session, real capture. Every command logged.
Session ended. IP blocked. Full transcript logged.
Start safe. Scale up when ready.
Every feature is off by default. Enable what you need, when you need it.
- SSH brute-force detection
- Credential stuffing detection
- Real-time monitoring
- Full audit trail
- Multi-channel notifications
- Dry-run mode by default
- Auto-block malicious IPs
- AI-powered confidence scoring
- Actions require your approval
- Cloudflare WAF integration
- AbuseIPDB reporting
- nginx rate limiting
- Cross-IP attacker tracking (DNA)
- Neural anomaly detection (daily retrain)
- 47 cross-layer correlation rules
- SSH honeypot trap
- AI command validation for agents
- DDoS shield with adaptive rate limiting
innerwarden system scanScans your server, detects what's running (SSH, Docker, nginx, Suricata, osquery...), and tells you exactly what to enable.
What if it makes a mistake?
Designed for regulated environments.
Inner Warden ships with the controls auditors look for. Hash-chained audit trails, admin action logging, session management, configurable retention, and GDPR data subject commands. Everything included, Apache-2.0 licensed. Built in from day one.
Designed to meet ISO 27001 Annex A controls (A.9, A.10, A.12, A.16, A.18). Read the full privacy and data protection documentation.
Yes, it's curl | bash. Here's what it does.
curl -fsSL https://www.innerwarden.com/install | sudo bash- Downloads a single SHA-256 verified binary (~7 MB) to /usr/local/bin
- Creates a dedicated service user with minimal permissions
- Starts sensor + agent via systemd (Linux) or launchd (macOS)
- Begins in dry-run mode. No firewall changes until you say so.
Want to read the script first? innerwarden.com/install
Talk to your server. In plain English.
Daily summary in the morning, urgent alerts only when something actually needs you, and a conversational AI that answers questions about your server's security. Telegram, Slack, webhook, syslog. Your choice of channel.
/status/threats/decisions/blocked/doctor/guard/watch/askinnerwarden config alertsInteractive wizard. Telegram, Slack, webhook, or syslog. Pick one or stack them.
Attack one node. Protect them all.
Inner Warden nodes form a mesh network. When one detects a threat, all others block the attacker automatically. Like birds that fly when one hears danger.
Every threat signal is cryptographically signed. Tampered signals are rejected instantly.
Tit-for-tat reputation. New peers start skeptical. Trust grows with confirmed signals, drops with false ones. 3:1 asymmetry.
No signal causes permanent action. Everything is scored and staged. Blocks auto-revert if not confirmed locally.
New nodes start at trust 0.1. Rate-limited to 50 signals/hour. Malicious nodes get quarantined automatically.
innerwarden config mesh enableinnerwarden config mesh add-peer https://peer-server:8790That's it. Identity generated automatically. Peers discovered via ping. Trust builds over time as signals get confirmed.
Your server should defend itself. Let it.
40 kernel hooks. 49 detectors. 65 MITRE techniques covered. Local AI on your hardware. Behavioral DNA tracking attackers across IPs. Dry-run by default.