Deep Runtime Security

eSAF Guardian

eSAF Guardian is a kernel-level runtime security software built for OT edge devices and AI industrial robots. Optimized for ARM-based controllers and RTOS, it delivers lightweight protection with real-time precision.

Need to consult with our expert? Leave us a message

eSAF Guardian Overview

Purpose-built for ARM-based controllers and RTOS, overcoming IT security limitations.

Operates with lower CPU overhead and less memory, preserving real-time precision.

Observe, Enforce, Respond - Monitors, enforces kernel policies, and auto-terminates threats instantly.

Delivers full audit trails, forensic logs, and automated reporting for industrial standards.

The OT Cybersecurity Landscape: Coverage and Blind Spots

Runtime monitoring within edge Linux remains a blind spot for existing security solutions.

Solution	Core Strengths	Common Blind Spot
OT/CPS NDR	Passive Traffic Monitoring, Asset Topology, CVE Prioritization	Lacks visibility into internal endpoint processes and file access.
Industrial IPS/Segmentation	Inline Protection, Allowlisting, Virtual Patching	Cannot identify which process initiated a network connection or abnormal file access.
Secure Remote Access	MFA, Just-in-Time (JIT) Access, Session Recording & Auditing	Only controls communication channels without monitoring runtime behavior.
Robot Endpoint	Structured Protection for Robot Systems	Limited commercial information, and support for heterogeneous platforms remains unverified.
ROS/Ecosystem	Long-Term Maintenance, Vulnerability Remediation, Ecosystem Integration	Maintenance and patching are not a substitute for runtime threat detection.
SBOM/Firmware Analysis	Supply Chain Risk Management, Pre-Release Static Analysis	Focuses on build-time security and does not cover runtime attacks.
AI Secutiry	Model Scanning, AI Lifecycle Risk Management	Does not correlate file, network, and process activities on edge Linux.

Linux Runtime Security Layer

Why eSAF Guardian

"eSAF Guardian is not another OT NDR solution. It provides deep behavioral monitoring inside endpoints and is purpose-built for industrial edge environments."

Runtime Visibility

Delivers correlated visibility across processes, file access, and network activities with deep kernel-level inspection.

Productized Agent

Provided as a ready-to-deploy .deb package, integrating Watchdog for self-healing, Policy Loader for policy deployment, and Event Exporter for event forwarding.

Field-Ready

Designed for field deployment with support for offline installation and version rollback. Supports NVIDIA Jetson Thor/Orin (ARM64) and Intel x86 platforms.

Monitoring-Ready

Retaining detailed event logs while exporting only essential metrics to prevent monitoring systems from being overwhelmed by high-frequency event streams.

What eSAF Guardian Sees Beyond

Scenarios	Existing OT Solutions	Visibility Added
Edge Devices Outbound Connections	IP connecting to an external IP	Precisely identifies processes and binary files, detecting whether the connection was initiated by shell, curl, or wget.
Sensitive File Access	Typically not visible	Monitors who accessed or modified `/etc/shadow`, SSH keys, and OT recipes.
AI Edge Model Security	May detect outbound traffic only	Correlates AI model and credential access with anomalous outbound connections to prevent model exfiltration.
Robot Compromise Detection	Device alerts or anomalous network traffic	Provides correlated runtime evidence across processes, files, and network activities.