Why VPS servers are targeted
Public VPS servers are easy to discover. Every provider's address ranges are known, and scanning them is cheap, so a new server receives its first SSH attempts within minutes of boot, before its owner has finished the first login. Attackers are not looking for you in particular; they are looking for anything exposed, weak or outdated, and a VPS is the place all three most often coincide, because one person owns every layer of it.
- SSH with password authentication still enabled, or a root login allowed.
- Admin panels and database ports reachable from the whole internet.
- Web applications and plugins a version or two behind a disclosed vulnerability.
- Packages that were current at install and never updated since.
- A Docker API, a forgotten test service, a staging copy nobody remembers.
- A WordPress install that is the real target, with the VPS as the prize.
What SecAI adds to a VPS
- SSH visibility: every failed and successful login, the source behind it, and repeated credential attacks counted per address.
- Hostile address blocking: on a server set to Automatic, an address is blocked after three attempts in thirty minutes through fail2ban, CrowdSec, CSF, firewalld or iptables, whichever the VPS runs, and the block expires after 24 hours.
- Host monitoring: the process table, listening ports, outbound connections, cron and systemd units, and the files that decide who can do what.
- CVE context: installed packages matched against public vulnerability data, with the pending update where there is one.
- Security audits: a weekly, evidence-backed review of the server's posture, and one on demand.
- Response workflows: proposed fixes with the reason and the undo, applied with a copy kept on the server and rolled back if the service breaks.
Built for small footprints
A VPS often has one or two virtual CPUs and a few gigabytes of memory, and the application is what they were rented for. SecAI's agent is a single statically linked Rust binary of a few megabytes, with no kernel module and no interpreter, that reads /proc and the kernel's own tables on an interval and sends metadata, not contents. No public benchmark figures are published yet, so this page does not claim any; the design goal is low overhead, and the Trust Center says what the agent does and does not do with the machine.
Survival matters on a small box too. When the server itself is being exhausted, a fork bomb, memory pressure, a flood, the agent is protected from the OOM killer, keeps a record without the platform, and, if you have set the server to Protect, caps or freezes the one process group responsible and undoes it when the episode ends. It never touches the web server, the database or a live login session.
Where the VPS meets the provider
A VPS lives behind the provider's network, and providers differ in what they filter for you. Some hand over a bare instance with every port open; some enable an OS firewall in the image; some offer a cloud firewall that does not filter private-network traffic at all. SecAI works at the host, where those differences become visible: the listening ports it reports are the ones actually reachable from the address the attacker sees, and the blocks it applies are in the firewall on the machine, whichever provider is in front of it.
The first hour on a new VPS
Continuous monitoring is the last step, not the first. Before installing anything, a new VPS deserves an hour of basics, in this order, because each one removes a whole class of attacks the monitoring would otherwise have to catch:
- Create a non-root administrative account with sudo and stop logging in as root.
- Put an SSH key on it, then turn off password authentication and root login in sshd, and confirm with sshd -T that the running daemon agrees.
- Bring the packages current and switch on unattended security updates.
- Enable the firewall with a default-deny inbound policy and open only the ports the server serves.
- Check what is listening with ss -tlnp, and close or bind to localhost anything that should not face the internet.
- Then install the agent, so the baseline it captures is the server you meant to run.