Capabilities
Eight features, with their limits.
Each one shows what it does and where it stops. No invented metrics, no detection-rate claims.
System and process visibility
Sign-ins, new processes, services, removable drives and startup entries — each one explained, not just labelled.
How it works
Silent Tears documents monitoring of system and process information together with security-relevant activity: sign-ins, new processes, services, removable drives, and startup entries. Each event is explained rather than reduced to an unexplained severity label.
The documented security engine includes 14 detectors, and code-signature verification reports an explicit "cannot be established" outcome when a signer cannot be confirmed rather than guessing.
This is application- and platform-level visibility, not complete kernel-level coverage. It reads the signals it documents and states what it could not read.
Limit · This is not kernel-level visibility and is not equivalent to a full endpoint detection and response (EDR) agent. Coverage depends on which signals and permissions are available.
Illustrative preview · demo data
Process lineage and command de-obfuscation
Not only that a process appeared, but who spawned it — with common command obfuscation unwrapped.
How it works
Process lineage adds parent and grandparent context: not only that a process appeared, but who spawned it. An Office document that spawns a shell is a different story from a shell you opened yourself.
The documented de-obfuscator unwraps certain common command obfuscation patterns — for example base64-encoded commands and string-building tricks — so a hidden command can be read in full.
Limit · The de-obfuscator covers documented common layers and patterns. It is not able to decode every possible obfuscation scheme.
Illustrative preview · demo data
Network monitoring and beacon-like patterns
A program calling the same address at intervals too tidy to be human may be flagged as a beacon-like pattern.
How it works
Silent Tears documents local connection visibility and detection logic for call-home behaviour inferred from timing regularity. A program contacting the same address at intervals too tidy to be human may be flagged as a beacon-like pattern.
The wording is deliberate: a regular pattern is not proof of malicious intent. Legitimate updates, cloud synchronisation, and time services can be regular too.
Limit · Periodic sampling may not observe very fast beacons, and legitimate services can produce regular traffic. A beacon-like pattern is a pattern that may warrant investigation, not a confirmed command-and-control channel.
Illustrative preview · demo data
Persistence inspection
The places a program can use to start again — with any location that could not be read named, not hidden.
How it works
The product inspects documented Windows locations where a program can arrange to start again — startup entries, scheduled tasks, services, and a broader set of documented persistence points.
The panel names which locations failed to read. An inspection that could not read a location is reported as incomplete, never silently presented as clean.
Limit · Some locations may be inaccessible due to permissions or operating-system constraints. An incomplete result is not proof that the system is free of persistence.
Illustrative preview · demo data
File integrity and offline scanning
SHA-256 fingerprints for critical paths, and PINDAI: an offline scanner whose best verdict is "no signs we know".
How it works
Silent Tears keeps SHA-256 fingerprints for configured critical paths so that a file that changed, appeared, or vanished can be surfaced. Its offline scanner, PINDAI, reads the shape of a file — structure and metadata signals — without a signature feed and without a cloud lookup.
Because it has no signature feed, its best verdict is "no signs we know" — not "safe". Findings can be quarantined through a reversible workflow that requires explicit confirmation before the file is moved.
Limit · There is no malware-signature database and no cloud reputation service. A clean scan result means no known signs were found, not that a file is safe. Quarantine is reversible and subject to confirmation gates.
Illustrative preview · demo data
Attack-chain correlation
Related events joined into one case, with a timeline, written reasons, and MITRE ATT&CK references.
How it works
The correlation engine joins related events into a single case: for example, repeated failed sign-ins followed by a successful sign-in and a new account. Each case provides a timeline, the reasons behind it, and MITRE ATT&CK technique references where supported.
Confidence is a separate, bounded measure of how complete the view was. It is never presented as 100%, and it is not a calibrated probability.
Limit · Confidence expresses how complete the evidence was, not a statistical probability that an event is malicious. A case is a reasoned suspicion supported by evidence, not a verdict.
Illustrative preview · demo data
AEGIS: AI Security Analyst & Defense Agent
An analyst that reads telemetry through read-only tools. Rules decide; the optional local model only narrates.
How it works
AEGIS reads this machine's telemetry through a gateway of read-only tools. Deterministic, readable rules decide risk levels, confidence, status verdicts, and proposed actions — not the language model.
An optional local model can narrate an already-decided report, or choose one read-only tool for a question the rules do not recognise, within documented constraints. It never decides a risk level and never has access to action tools.
Limit · AEGIS is not an unrestricted autonomous agent. Destructive actions are proposals until a person confirms them, and the model cannot independently execute them. See the security page for the full boundary.
Illustrative preview · demo data
Fortress Mode, reports, and controlled response
Fortress Mode, evidence-oriented reports, and responses that run only after you confirm them.
How it works
Fortress Mode applies a documented set of defensive locks in one step and can restore the state that was genuinely open before. Reports and evidence-oriented outputs summarise findings from the logs.
Every destructive response — terminating a process, blocking an address, quarantining a file, or isolating the endpoint — is a proposal that requires explicit human confirmation through the intended control.
Limit · Fortress Mode is not risk-free and can be misconfigured; it states the cost of each lock. End-to-end isolation under UAC has not been fully validated, so isolation is not advertised as complete. Reports are not presented as third-party-certified forensics or court-admissible evidence.
Illustrative preview · demo data
Important limitations
- 01Documented, bounded features — not a guarantee of complete protection or detection.
- 02Detection is not proof of malicious intent; incomplete results are not proof of a clean system.
- 03Pre-release until release readiness is independently verified.