AI Defence / Product status
A clear distinction between code, configuration and release.
The product evidence reviewed on 11 September 2026 supports limited Linux and central validation development work, rather than an integrated production release. The architecture expansion added on 12 September 2026 describes the intended next layers and does not change that release assessment.
Implemented source that can be inspected
The Linux review branch includes ten collector families, periodic monitoring, local vulnerability heuristics, report fields, messaging and registered remediation structures. The central package includes catalogue, planning, evidence and lifecycle components. These are positive implementation facts, subject to their stated limits.
The main branch at the time of inspection contains scaffolding. Presence on the review branch, reported tests and design documentation must not be presented as evidence of a merged, deployed or fully accepted platform.
| Capability | Availability | What to expect |
|---|---|---|
| Linux host inventory | Implemented in development | Ten local collector families. Coverage depends on permissions and the host. |
| Periodic monitoring | Implemented in development | Selected integrity, process, authentication-log and configuration observations. |
| Local vulnerability rules | Implemented, limited scope | Deterministic rules and a small pinned advisory set; no complete live CVE feed. |
| Reports and findings | Implemented in development | Structured explanations, recommendations and impact fields; no verified unified analyst console. |
| Central telemetry | Configuration required | HTTPS and signed envelopes exist in code. Example transport is disabled; receiving integration needs proof. |
| Registered remediation | Configuration and validation required | Typed actions exist; remediation is disabled in the example configuration. Live failure and reversal behaviour need acceptance. |
| Central validation | Under review | Planning and evidence packages exist. End-to-end integrity and closure concerns remain unresolved. |
| Windows and network probers | Production unavailable | Production probers are explicitly marked unavailable. Real production checks are not implemented at the reviewed ref. |
| Security console and SIEM | Not verified | The website tour is illustrative. Related Remedy host-management code is a separate implementation. |
Production validation is incomplete
Windows and network production probers are explicitly unavailable in the reviewed production-status document. A module name or manifest is not a working production check.
Later review material also records unresolved concerns involving evidence signature verification, observer matching, closure rules, cleanup persistence and audit anchoring. No later implementation and deployment evidence resolving all of these was established for this update.
The product tour and related components
The tour is a website illustration using synthetic records. There is no verified unified AI Defence analyst console in the inspected security-engine tree.
The separate Remedy implementation contains host pairing, heartbeat, scoped evidence and a service-backed runtime dashboard. Its documentation also distinguishes fake external-service tests from live integrations. Those foundations are not proof that the AI Defence engine has been integrated into an operational console.
The broader assessment specification
The retained assessment catalogue describes 25 planned areas and 330 listed checks, controls and workflow items from the original specification. They are requirements and intended scope, not a count of working security tests.
Coverage pages explain the intended evaluation questions. They are separated from the source-backed capability guide so visitors can assess both the product direction and the present implementation.
What needs to be settled for a deployment
Confirm the exact accepted build, supported host and module matrix, central integration and data delivery. Agree hosting, privacy terms, access, retention, support and which actions are permitted. Demonstrate failure handling and recovery before relying on those behaviours.
Native SIEM integrations, a live AI Defence model/data flow, endpoint isolation and release, file restoration, production SSO/MFA and a complete security console are not claimed as verified features. No fixed availability date, detection guarantee, certification or customer result is published here.
Architecture added in September 2026
Glass, Continuous Integrity certification, adaptive Network Trust, MFA/step-up integration, Deception and protected recovery orchestration are documented product directions. A design approval is not evidence that a feature has been implemented, accepted or deployed.
These pages use “planned architecture” consistently. Existing source-backed functions retain their development description, including configuration dependencies and unresolved review findings. No new general availability, release date, customer deployment or production performance claim is introduced.
| Maturity | Meaning on this website |
|---|---|
| Source-backed development | Relevant code was previously inspected; release and operational limits remain |
| In development | Implementation or validation work exists but is not accepted as a complete production service |
| Planned architecture | Documented capability direction without sufficient implementation evidence |
| Available production capability | Requires accepted release and operational evidence; not inferred from these briefs |
Questions answered
Talk directly to Altari
Bring the environment.
Start with the right questions.
Discuss a demonstration, current capabilities and a bounded evaluation with Altari Systems.