Skip to main content

The platform

One agent, one console, and modules that switch on as you need them

Kayzen Security is built around a single agent installed on each device and a web console. Modules are switched on remotely, with no reinstalling, and share the same data.

Request a demoSee pricing

Architecture

How the pieces fit together

  • The agent

    A lightweight service written in Rust, with no kernel code. It applies policies, collects only what the active modules require and keeps protecting when offline.

  • The gateway

    Each agent authenticates with a certificate (mutual TLS). Commands sent down to agents are signed and protected against replay.

  • The console

    A multi-tenant web application: each customer is isolated at the database level, and every sensitive action is logged.

  • The DNS resolver

    An encrypted resolver (DoH, DoT) that applies each customer's policy and updates on the fly from signed lists.

The modules

Thirteen modules grouped into three families

Prevent

Stop the attack before it reaches the device.

Control

Reduce the attack surface and keep the fleet up to date.

Detect and prove

See, understand, respond and prove.

Design principles

What is not up for negotiation

  • Safety before speed

    No detection content must ever be able to crash a computer: analysis runs outside the kernel, with memory and time limits.

  • Ring-based rollout

    Each update goes first to a small group of devices, with an automatic stop if anything looks wrong.

  • Data minimisation

    No collection of file content, email content or keystrokes outside an explicitly enabled and documented module.

  • Transparency

    Public roadmap, real status of each module, security practices published and dated.

Roadmap

Delivery in stages, with no vague promises

The phases follow the project roadmap. Exact dates are not guaranteed; the status of each module is updated with every delivery.

  1. Phase 1: DNS, console and website

    Encrypted DNS resolver, console, signed policies, Windows agent. Pilot programme under way.

  2. Phase 2: patching, inventory, compliance, mobile

    Inventory, vulnerability database, Windows and third-party patching, hygiene reports, mobile apps.

  3. Phase 3: antivirus and ransomware

    Multi-layer scanning engine, encrypted quarantine, protection against mass encryption, managed firewall.

  4. Phase 4: EDR and privileges

    Telemetry, detection rules, action centre, on-demand privilege elevation, control of applications and peripherals.

  5. Phase 5: email, AI, MSP

    API-based email security, Copilot assistant, AI usage control, MSP portal, public API and SSO.

  6. Phase 6: industrialisation

    Independent certifications, Linux agent, extended correlation and SOC partnership.

Frequently asked questions

Your questions, our answers

Are the modules sold separately?

No: they are grouped into three offers (Essentials, Pro, Ultimate) and two options (K-Mail, K-Vault & Remote). A module is switched on from the console, without reinstalling the agent.

Does the agent slow computers down?

Strict performance targets are set for entry-level computers. They will be measured and published before the antivirus modules are commercially launched; no figure is announced before it is measured.

What happens if the computer is offline?

The agent keeps applying the latest policy and signatures it received, then resynchronises as soon as the connection returns.

Does Kayzen work with my RMM or ticketing tool?

A public API and webhooks are planned for phase 5, with integrations for the main tools used by managed service providers.

Ready to simplify your security?

Join the pilot programme or request a demo of the console. Free, no commitment, no credit card.

Join the pilot programmeRequest a demo