The industry consensus on “modern security” is: install our agent, let it stream every process / file event / network connection back to our cloud, where AI looks at it and decides. The agent gets better as more data flows. The vendor gets a moat. Customers get a GDPR headache and a single point of compromise.
We do the opposite. Vloud’s signature feeds, threat intelligence, and YARA rule packs are packages, signed monthly, fetched securely, applied locally. Detection happens on your host with the data we shipped you. We never see your processes, your files, your network, your anything.
Why this works
Detection signal is mostly stable. New malware families appear constantly, but the shape of detection — file hashes, byte patterns, behavioral indicators — moves at human speed, not real-time. A monthly cycle catches 99% of what matters. The remaining 1% is the “zero-day, this hour” tier, which isn’t a problem your control panel solves anyway — that’s an EDR product.
What we trade off
The sales pitch for telemetry-based security is “we see what’s happening across thousands of customers, so we can correlate and catch threats faster.” That’s true. We can’t do that. Our threat intel is downstream of public feeds + our own research, not downstream of your traffic.
We’re comfortable with that trade. Most customers we talk to are not willing to feed their production traffic into a vendor’s correlation engine. The compliance risk and the data-egress risk together outweigh the marginal detection win.
The agent is a single point of compromise
Worse than the data egress: every telemetry agent is a giant attack surface running as root on your host. When the agent is compromised, the attacker has telemetry’s exfil channel and root. We’ve watched it happen. We didn’t want to ship that risk.
What we ship instead
Static signatures. Hash-pinned. Signed by our release key. Fetched over HTTPS from a CDN. Verified by your engine. Applied in-process. No daemon, no socket, no listener. The detection happens; the data stays.
Decision wasn’t easy. Once you’ve gone static-signature you can’t do “we noticed across our fleet” headlines. We’re at peace with that. Our value-prop is your data stays put, even when it costs us the ability to say things.