Understand the capability. Understand its limits.

Availability at a glance

Read each capability together with its status. “Implemented in development” means code was inspected on the review branch; it does not mean the function has passed production acceptance in your environment.

Asset inventory and configuration assessment

The Linux collector dispatcher has ten families: system, users, network, services, storage, security, applications, cloud, containers and processes. Together they assemble a host-level account of the machine and the configuration it can observe.

Inventory gives reviewers context for a finding: the host’s role, services, accounts, software and surrounding workload matter when judging impact. Scope is limited by local visibility, permissions and each collector’s implementation. A cloud configuration check does not establish an authenticated inventory of a cloud account.

Periodic monitoring and change observations

A monitoring loop samples process activity, selected file integrity hashes, authentication-log data and configuration digests. Changes can be raised as observations for review alongside the assessment. The useful outcome is context about what changed between samples.

The example configuration uses a 30-second monitoring interval and a one-hour assessment interval. These are configurable examples, not measured detection latency or a service commitment. Events between samples, inaccessible logs and unmonitored files can remain unseen. Monitoring is not evidence of universal ransomware detection.

Deterministic findings and vulnerability checks

The inspected implementation uses local rules, heuristics and a small pinned advisory set for kernel, package and cryptographic posture checks. It can create structured findings with technical explanation, business impact, recommended action and a rollback description.

This gives reviewers a starting point for a decision. It is not a complete CVE intelligence feed, a malware-signature service or a demonstrated behavioural machine-learning engine. Version findings require care where distributions backport fixes. An uncertain match remains a finding to validate.

Registered remediation and operator control

The Linux implementation includes typed, registered remediation primitives and a local signed-command interface. The example configuration disables remediation. Enabling actions requires the appropriate configuration, authorisation and a supported action for the particular target.

A recommended change and an executable action are different things. A finding can recommend work that still requires an administrator. Source-level rollback structures and descriptions do not establish that every action can be safely reversed on a live system. Operational acceptance must include failure handling and preserved administrator access.

Validation and evidence review

The central development package defines checks, builds validation plans and correlates evidence. Its purpose is to make the question “did the change achieve the required result?” explicit. Result states and missing coverage matter as much as successful checks.

Windows and network production probers are unavailable in the inspected branch. The later review raises unresolved questions about accepting evidence and matching independent observers. Complete independent verification and guaranteed closure prevention are not advertised as established capabilities.

Endpoint administration and the related Remedy foundation

The separate Remedy Agent implementation has host registration, one-time pairing, installation identities, heartbeats, revocation and target allowlists. Its dashboard exposes host details, evidence, capabilities, policy and actions through service-backed routes.

Those are runtime-management features in Remedy. Their integration with AI Defence’s security findings has not been verified. A fresh heartbeat indicates recent communication; it does not mean that a host has passed a security assessment. Supported update channels, tamper controls and an AI Defence fleet rollout process require confirmation.

What is not currently offered as verified functionality

The inspected evidence does not substantiate live endpoint isolation and release, encrypted-file restoration, native SIEM connectors, a unified AI Defence analyst console, scheduled security-report delivery, SSO or MFA for AI Defence, or a managed 24-hour SOC.

The specification contains a broader assessment and protection roadmap. That catalogue remains available separately as planning material. It is not the implemented capability list.

The wider Remedy architecture

The new platform design extends beyond the inspected Linux components. The following groups are planned, with availability determined by accepted implementation and deployment evidence. They should not be confused with generally available capabilities.