Linux security without the agent risk
Sandfly protects your Linux systems without installing anything on them. No kernel modules, no reboots, no downtime. Just a ranked list of real threats, backed by machine learning and optional AI.
Linux security without the agent risk
Sandfly protects your Linux systems without installing anything on them. No kernel modules, no reboots, no downtime. Just a ranked list of real threats, backed by machine learning and optional AI.
Why Linux EDR agents are hard to deploy at scale
1. Kernel clashes
Agents hook into the kernel. When the kernel changes, things break, and sometimes it's your production systems that go down.
2. Every update is a project
Each kernel or agent update needs testing before it goes anywhere near production. Security ends up slowing down operations.
3. Blind spots you can't fix
Agents won't run on network appliances, embedded devices or older systems. Those are exactly where attackers like to hide.
4. No clear way to tell what's real
Alerts arrive without priority or context, and false positives look just like real threats. The ones that matter get buried in the noise.
What is agentless Linux EDR?
Agentless Linux EDR (endpoint detection and response) finds intruders, malware and rootkits on Linux systems without installing any software on them. Sandfly connects to each system over SSH, runs its checks, and then removes itself, leaving nothing behind.
How Sandfly works
Get up and running in minutes.
1. Connect
Sandfly connects to your Linux systems over SSH. No software to install.
2. Check
It runs fast, lightweight checks for signs of compromise, then removes itself. Nothing stays on the host.
3. See
Results from your whole fleet appear in one console, ranked by priority, whether systems are in the cloud, on-premises or both.
Less time sorting alerts. More time stopping real threats.
Sandfly ranks what it finds, so your team starts the day with a short list of real Linux threats, not a queue of maybes.
Host triage that ranks what's real
Findings on each host are grouped into artifacts and ranked by priority, with real threats on top. Your team covers more without adding headcount.
One artifact for every host
Suspicious users, files and processes are grouped in one view, so you can see what matters across every host at a glance.
Machine learning that catches new implants
Every binary gets a threat score, including implants no one has seen before. It runs agentlessly on all supported architectures, with no performance impact.
Optional AI triage, with your own model
Connect any AI model, in the cloud or on-prem, for a plain-English summary of why each alert matters. Need more detail? Run a full AI analysis on any artifact. AI is off by default, and everything else works without it.
Less time sorting alerts. More time stopping real threats.
Sandfly ranks what it finds, so your team starts the day with a short list of real Linux threats, not a queue of maybes.
How Agentless stacks up
A side-by-side look at Sandfly and traditional agents.
| Feature comparisons |
Sandfly Security
|
Agents
|
|---|---|---|
| Architecture: Ephemeral binary pushed via SSH. Executes and then removes itself. | Included | Not included |
| Stability Risk: Runs in user-space. Extremely low stability or performance risks. Proven on critical infrastructure globally. | Included | Not included |
| Compatibility: Legacy, IoT, Cloud, On-Prem, AMD, Intel, MIPS, ARM support, etc. Can run on just about any Linux based system. | Included | Not included |
| Performance Impacts: Extensively tested in latency critical applications and shown to have little to no discernible performance impacts. | Included | Not included |
| Kernel Conflicts: Does not tie into the kernel and is not affected by kernel updates or customizations. | Included | Not included |
| Deployment: No installation required. Point it at systems and go. | Included | Not included |
| Evasion Resistance: Non-persistent presence on host makes it harder to target for disabling or blinding. | Included | Not included |
| Detection Style: Tactics Hunting. Hunts compromise tactics (rootkits, persistence, lateral movement risks). Designed from the ground up for Linux attack detection. | Included | Not included |
| Machine Learning Everywhere: Every binary gets a threat score, including malware implants no one has seen before. Runs agentlessly on all supported Linux architectures, including embedded devices and custom builds, with no performance impact. | Included | Not included |
| Triage Across Every Device: Findings are ranked by priority across your whole environment, including network appliances, OT, and IoT devices that agents can't run on. | Included | Not included |
| AI on Your Terms: Optional AI triage or deep dive analysis that works with any model you choose, in the cloud or on-prem for privacy. Off by default, and everything else works without it. | Included | Not included |
| Incident Response: Can be deployed during live incidents to investigate hosts without introducing new risks to an already stressful situation. | Included | Not included |
| Monitors Network Appliances and IoT: Supports most CPU architectures of Linux which means it can easily watch a server, network switches, or even a low-powered IoT device like cameras. | Included | Not included |
| Total Cost of Ownership (TCO): With no kernel dependencies, reliability testing is easy and fast. No need to touch or maintain agents on each endpoint. | Included | Not included |
- Included Architecture: Ephemeral binary pushed via SSH. Executes and then removes itself.
- Included Stability Risk: Runs in user-space. Extremely low stability or performance risks. Proven on critical infrastructure globally.
- Included Compatibility: Legacy, IoT, Cloud, On-Prem, AMD, Intel, MIPS, ARM support, etc. Can run on just about any Linux based system.
- Included Performance Impacts: Extensively tested in latency critical applications and shown to have little to no discernible performance impacts.
- Included Kernel Conflicts: Does not tie into the kernel and is not affected by kernel updates or customizations.
- Included Deployment: No installation required. Point it at systems and go.
- Included Evasion Resistance: Non-persistent presence on host makes it harder to target for disabling or blinding.
- Included Detection Style: Tactics Hunting. Hunts compromise tactics (rootkits, persistence, lateral movement risks). Designed from the ground up for Linux attack detection.
- Included Machine Learning Everywhere: Every binary gets a threat score, including malware implants no one has seen before. Runs agentlessly on all supported Linux architectures, including embedded devices and custom builds, with no performance impact.
- Included Triage Across Every Device: Findings are ranked by priority across your whole environment, including network appliances, OT, and IoT devices that agents can't run on.
- Included AI on Your Terms: Optional AI triage or deep dive analysis that works with any model you choose, in the cloud or on-prem for privacy. Off by default, and everything else works without it.
- Included Incident Response: Can be deployed during live incidents to investigate hosts without introducing new risks to an already stressful situation.
- Included Monitors Network Appliances and IoT: Supports most CPU architectures of Linux which means it can easily watch a server, network switches, or even a low-powered IoT device like cameras.
- Included Total Cost of Ownership (TCO): With no kernel dependencies, reliability testing is easy and fast. No need to touch or maintain agents on each endpoint.
- Not included Architecture: Ephemeral binary pushed via SSH. Executes and then removes itself.
- Not included Stability Risk: Runs in user-space. Extremely low stability or performance risks. Proven on critical infrastructure globally.
- Not included Compatibility: Legacy, IoT, Cloud, On-Prem, AMD, Intel, MIPS, ARM support, etc. Can run on just about any Linux based system.
- Not included Performance Impacts: Extensively tested in latency critical applications and shown to have little to no discernible performance impacts.
- Not included Kernel Conflicts: Does not tie into the kernel and is not affected by kernel updates or customizations.
- Not included Deployment: No installation required. Point it at systems and go.
- Not included Evasion Resistance: Non-persistent presence on host makes it harder to target for disabling or blinding.
- Not included Detection Style: Tactics Hunting. Hunts compromise tactics (rootkits, persistence, lateral movement risks). Designed from the ground up for Linux attack detection.
- Not included Machine Learning Everywhere: Every binary gets a threat score, including malware implants no one has seen before. Runs agentlessly on all supported Linux architectures, including embedded devices and custom builds, with no performance impact.
- Not included Triage Across Every Device: Findings are ranked by priority across your whole environment, including network appliances, OT, and IoT devices that agents can't run on.
- Not included AI on Your Terms: Optional AI triage or deep dive analysis that works with any model you choose, in the cloud or on-prem for privacy. Off by default, and everything else works without it.
- Not included Incident Response: Can be deployed during live incidents to investigate hosts without introducing new risks to an already stressful situation.
- Not included Monitors Network Appliances and IoT: Supports most CPU architectures of Linux which means it can easily watch a server, network switches, or even a low-powered IoT device like cameras.
- Not included Total Cost of Ownership (TCO): With no kernel dependencies, reliability testing is easy and fast. No need to touch or maintain agents on each endpoint.
It works everywhere:
If it runs Linux, Sandfly can protect it
Servers, cloud workloads, network switches, cameras, and industrial devices, and systems that are up to 10+ years old.
Red Hat, Ubuntu, Debian, SUSE, Rocky, Alma, CentOS, Fedora, Arch, Gentoo and custom builds.
It works everywhere:
If it runs Linux, Sandfly can protect it
Servers, cloud workloads, network switches, cameras, medical and industrial devices, and systems that are 10 years old.
Red Hat, Ubuntu, Debian, SUSE, Rocky, Alma, CentOS, Fedora, Arch, Gentoo and custom builds.
Frequently Asked Questions
Agent-based EDR installs software inside the kernel of every system it protects. Agentless EDR like Sandfly connects remotely, runs its checks and leaves, so there's nothing to install, update or break.
Yes. Sandfly runs in user space and doesn't touch the kernel, so it won’t conflict with system updates. It's used on critical infrastructure globally.
No. Sandfly runs continuously across your Linux environment. Rather than on a predictable schedule, it runs at random making it difficult for attackers to pinpoint.
Sandfly only needs SSH access to the systems you want to protect. Nothing is installed on them.
Yes. Sandfly doesn't touch the kernel, so it won't conflict with other tools.
Each agent has to be installed, tested against every kernel version you run, and updated on every host. Across a large or mixed Linux fleet, that becomes a constant project, and some systems, like appliances and older servers, can't run agents at all. Touching every endpoint for install and continuous updating is risky and requires careful planning and testing at scale. This deployment risk often leaves Linux systems unmonitored and exposed to attackers that can linger for a very long time.
No. AI is optional and off by default. Every other feature works without it. Enterprises that adopt AI systems in the future can deploy AI features at any time, and completely privately, as Sandfly supports not just cloud providers, but on-prem models as well.
By integrating Agentless EDR into the Ericsson Security Manager XDR solution, we enhance our customers' detection capability and security visibility where traditional endpoint agents are unsuitable - strengthening security while preserving operational continuity.
Keijo Mononen, Head of Security Solutions, Ericsson
Full Linux visibility. Nothing installed.
No agents, no kernel modules, nothing left behind. See how Sandfly hunts for intruders across your environment without touching production.