The six signals worth watching
Almost every real compromise shows up in at least one of these, and usually several. A monitoring system is only as useful as its coverage across them.
- Authentication. Failed and successful logins, new keys, new accounts, and sudo escalation. Brute force is noisy; the successful login afterwards is the one that matters.
- Processes. What is running that was not running before, and what is consuming resources it should not be. Cryptominers and reverse shells surface here.
- Files. Changes to system configuration, authentication files, web content and scheduled tasks. Persistence almost always writes something to disk.
- Network. Outbound connections to destinations the server has no reason to contact, and inbound patterns that indicate scanning or flooding.
- Packages. The installed inventory against published CVE data, because a server that was fully patched at install becomes vulnerable without anything changing on it.
- Web content. Webshells and injected files in served directories, which is the most common foothold on a server that hosts websites.
How this differs from a SIEM
A SIEM is a place logs go to be correlated. It is powerful and it is broad, ingesting from Windows, cloud services, network appliances and containers as well as Linux. It is also a system you operate: a manager to provision, an indexer to size, rules to tune, and someone whose job includes doing that.
Monitoring in the sense used here is narrower and opinionated. It targets Linux servers specifically, arrives with detection already tuned for that shape, and acts by default rather than alerting and waiting. There is no manager for you to run.
If you have a security engineer and need to correlate across Windows and cloud in one place, a SIEM is the right tool and SecAI does not replace it. If you run Linux servers and want them defended without operating a platform, the trade goes the other way. There is an honest comparison against Wazuh, the most capable free option, in the alternatives section.
How this differs from antivirus
Signature scanning asks whether a file matches something already known to be malicious. It is useful and it is inherently retrospective: novel or lightly modified code has no signature yet, and on a compromised server most of what matters is not a file at all. A cron entry, an added SSH key, a modified sshd configuration and an outbound connection carry no signature.
Behavioural monitoring asks a different question: what changed, what is running, and does it fit this server. That is why file integrity, process observation and network baselines matter more than a malware database on a server, and why SecAI is built around them.
Response, and the boundary around it
Detection that only notifies leaves the work at the moment of the incident. SecAI blocks attacking IP addresses automatically, typically within seconds, using the firewall already present on the server.
Everything beyond that is deliberately bounded. Each server runs in Awaiting Approval, where remediations wait for you, or Automatic, where safe reversible actions run on their own. Actions that could take a service down stay behind human approval in both modes. When an automatic fix is applied, the result is verified and the change is rolled back on its own if something broke, with an email explaining what happened.
Your own servers and administrator IP addresses are exempt from automatic blocking. A monitoring system that can lock you out of your own infrastructure is a liability, not a control.
AI audits, and what the AI is actually doing
Alongside continuous monitoring, SecAI runs security audits that examine the real state of a server, configuration, users, exposed services, packages and recent activity, and produce a risk score with specific remediation rather than a generic checklist.
To be precise about the role of the model: it analyses collected evidence and prioritises findings. Detection itself is deterministic. The AI is used where judgement helps, such as deciding whether a suspicious PHP file is a webshell or a legitimate plugin, and it is not the thing deciding whether an IP gets blocked.
Evidence and reporting
Continuous monitoring produces something a periodic scan cannot: a timeline. Which incidents occurred, what was done about them, and when. That history is exportable as one-click PDF reports aligned with UAE NESA and PDPL expectations.
Stated carefully, because this is often overstated in security marketing: those reports support a compliance programme by providing evidence of active monitoring. They do not make an organisation compliant, and no tool does.
What it runs on
A single static binary of a few megabytes, no kernel modules, installed with one command in about 60 seconds. It runs on current Debian and Ubuntu releases and the RHEL-compatible distributions including Rocky and AlmaLinux, on VPS, cloud and dedicated servers, with or without a control panel.