The six signals worth watching
Almost every real compromise shows up in at least one of these, and usually several. A monitoring system is only as useful as its coverage across them.
- Authentication. Failed and successful logins, new keys, new accounts, and sudo escalation. Brute force is noisy; the successful login afterwards is the one that matters.
- Processes. What is running that was not running before, and what is consuming resources it should not be. Cryptominers and reverse shells surface here.
- Files. Changes to system configuration, authentication files, web content and scheduled tasks. Persistence almost always writes something to disk.
- Network. Outbound connections to destinations the server has no reason to contact, and inbound patterns that indicate scanning or flooding.
- Packages. The installed inventory against published CVE data, because a server that was fully patched at install becomes vulnerable without anything changing on it.
- Web content. Webshells and injected files in served directories, which is the most common foothold on a server that hosts websites.
Find unauthorized SSH keysInvestigate a suspicious processFind cron and systemd persistenceCheck listening ports and outbound connections
How this differs from a SIEM
A SIEM is a place logs go to be correlated. It is powerful and it is broad, ingesting from Windows, cloud services, network appliances and containers as well as Linux. It is also a system you operate: a manager to provision, an indexer to size, rules to tune, and someone whose job includes doing that.
Monitoring in the sense used here is narrower and opinionated. It targets Linux servers specifically, arrives with detection already tuned for that shape, and acts for itself on a server set to Automatic rather than alerting and waiting. There is no manager for you to run.
If you have a security engineer and need to correlate across Windows and cloud in one place, a SIEM is the right tool and SecAI does not replace it. If you run Linux servers and want them defended without operating a platform, the trade goes the other way. There is an honest comparison against Wazuh, the most capable free option, in the alternatives section.
How this differs from antivirus
Signature scanning asks whether a file matches something already known to be malicious. It is useful and it is inherently retrospective: novel or lightly modified code has no signature yet, and on a compromised server most of what matters is not a file at all. A cron entry, an added SSH key, a modified sshd configuration and an outbound connection carry no signature.
Behavioural monitoring asks a different question: what changed, what is running, and does it fit this server. That is why file integrity, process observation and network baselines matter more than a malware database on a server, and why SecAI is built around them.
Response, and the boundary around it
Detection that only notifies leaves the work at the moment of the incident. SecAI blocks attacking IP addresses automatically, typically within a minute or two, using the firewall already present on the server.
Everything beyond that is deliberately bounded. Each server runs in Awaiting Approval, where every change waits for you, or Automatic, where attacking addresses are blocked on their own and nothing else changes without a person. Hardening fixes, package updates, restarts and file quarantine stay behind approval in both modes. When a fix you approved is applied, the result is verified and the change is rolled back on its own if something broke, with an email explaining what happened.
Your own servers and the addresses you trust are exempt from automatic blocking, every block expires on its own, and a way back in is one click away. A monitoring system that can lock you out of your own infrastructure is a liability, not a control.
AI audits, and what the AI is actually doing
Alongside continuous monitoring, SecAI runs security audits that examine the real state of a server, configuration, users, exposed services, packages and recent activity, and produce a risk score with specific remediation rather than a generic checklist.
To be precise about the role of the model: it analyses collected evidence and prioritises findings. Detection itself is deterministic. The AI is used where judgement helps, such as deciding whether a suspicious PHP file is a webshell or a legitimate plugin, and it is not the thing deciding whether an IP gets blocked.
Evidence and reporting
Continuous monitoring produces something a periodic scan cannot: a timeline. Which incidents occurred, what was done about them, and when. That history is exportable as one-click PDF reports aligned with UAE NESA and PDPL expectations.
Stated carefully, because this is often overstated in security marketing: those reports support a compliance programme by providing evidence of active monitoring. They do not make an organisation compliant, and no tool does.
What it runs on
A single static binary of a few megabytes, no kernel modules, installed with one command; the server appears in the dashboard within about a minute of the agent starting. It runs on current Debian and Ubuntu releases and the RHEL-compatible distributions including Rocky and AlmaLinux, on VPS, cloud and dedicated servers, with or without a control panel.