About SecAI

What SecAI does

• Monitors a Linux server continuously from one agent: SSH authentication, processes, files, outbound connections, installed packages, cron and systemd units, firewall and update posture.
• Blocks an address identified as attacking the server, on its own, on a server set to Automatic, through the firewall the server already runs; the block expires after 24 hours and the owner's own addresses are exempt.
• Keeps every deeper change behind approval, in both modes: hardening fixes, package updates, service restarts, account changes and file quarantine wait for a person, and an approved fix is verified and rolled back on its own if it breaks a service.
• Reports file changes with the hash before and after, and for persistence files (cron, sudoers, authorized_keys, systemd units) the text before and after.
• Matches installed packages against OSV.dev every twelve hours and shows the CVE, severity and fixed version per server.
• Runs an AI security audit weekly on every monitored server, and on demand, with evidence attached to every finding; OpenAI is the only AI processor used.
• Produces compliance evidence reports for UAE Information Assurance, PDPL, PCI DSS and SOX ITGC programmes.
• Supports service providers with a multi-tenant console and white-label deployment.

What SecAI is not

• Not antivirus: it works from behaviour and integrity, not a signature database.
• Not a SIEM: it does not correlate logs from everything you own; it is a Linux-server security platform for teams that do not want to operate a SIEM.
• Not a web application firewall: it blocks addresses at the host firewall and watches web roots; it does not inspect or rewrite HTTP requests.
• Not upstream DDoS protection: the host detects a flood and can drop a source; traffic that saturates the link is stopped upstream.
• Not a staffed SOC: SecAI is software. People at Tech Steps LLC answer support and sales, and the platform escalates to a person when a customer asks.
• Not a compliance certification: it produces the evidence a compliance programme needs; it does not make an organisation compliant by itself.

Who it is for

• Small infrastructure teams who own production Linux servers but not a security function.
• VPS owners, SaaS companies, web agencies, e-commerce operators and hosting providers.
• Managed security service providers and resellers who run many customers from one console.
• Organisations in the UAE and MENA that need practical security evidence for local requirements.

How it is built

The agent is a single statically linked Rust binary, security-agent, run by systemd as secai-agent. It makes outbound HTTPS connections to secai.techsteps.ae only, accepts none, verifies every release by SHA-256 and an Ed25519 signature, and updates itself the same way.

The platform is UAE-hosted. AI processing (audits, fix checks and screening of flagged files) runs with OpenAI in the United States; the Privacy Policy and the Trust Center carry the exact statement.

SecAI runs on Tech Steps LLC's own production servers, and has since before the first subscription was sold.

Name

SecAI at secai.techsteps.ae is a product of Tech Steps LLC, United Arab Emirates. It is not affiliated with other companies or products that use a similar name.