Features / Stop on leak signs
When it looks like a leak, the PC stops itself.
Most breaches are found after the data is gone. ZENOS watches the ways data leaves a PC — the USB drive, the network, a burst of protected files being opened — and contains it the moment it sees a sign, before anyone has to read an alert.
from detection to containment, in a real cut on release night
the cut is deterministic and instant. Your AI can then judge the incident, and may only tighten.
officers must sign on their own devices to release a stopped PC
How it works
Detect, contain, release
Detect
A root service sees every open of a protected file and every file that reaches the USB drive, with the program that did it. A kernel-level network sensor sees every outbound send.
- Runs as root: the user cannot stop it or edit its state
- Watches the exits, not every keystroke
Contain
In milliseconds: the destination is cut, its connections are closed, the user's programs are frozen, and files that reached the exit go to quarantine.
- A full-screen notice says what happened
- Anything new the user starts is frozen within a second
Release
Only officers can lift the stop, each signing on their own phone. The operation that triggered it is cancelled, not resumed.
- More officers than opening the file needed
- The user's own approval never counts
What counts as a leak sign
Four rules, written down
Work that needs to move many files, such as an approved transfer, is filed in advance and recorded instead of stopping the PC.
A real moment
On release night we uploaded the installer image from a development PC that itself runs ZENOS. Its network sentinel saw an unapproved program sending 52 MB to one destination, cut it, and had it contained 107 ms later. Working as designed. We uploaded from another machine.
Proven, and what is not
The decisions are mathematics
Checked on every build
- A destination is cut exactly when it is not approved and the bytes sent to it reach the line
- A cut destination stays cut
- A stop is released only with enough signatures from distinct enrolled officers other than the stopped user
- The PC goes from stopped to running only through a release check that held
Tested and listed openly
- The network sensor (eBPF) and the file watcher (fanotify)
- The firewall rules themselves
- The Linux kernel and the code that gathers facts and carries out the answer
- Moves into the USB drive are seen without the program that made them
Try it in the preview
Try it yourself
Install the preview
Boot the image and choose "Install ZENOS". The disk is encrypted.
Enroll officers
Each officer makes an approval key in ZENOS Messages on their own phone.
Copy five files to the USB Drive
Within 30 seconds the PC stops. Approve on the phones to release it.