Docs / FAQ
FAQ
Does Protet see my source code?
No. Detection operates on execve command sequences — what your build process runs — not on your source code or build artifacts.
Can I run this fully air-gapped?
Yes, on any on-prem tier. Pull a signed model bundle once, verify it against Protet's public key, and operate with no ongoing network dependency on Protet's control plane.
Is there a free on-prem trial?
No — the free tier is the cloud-hosted Otus plan: real-time detection on your CI, usage-capped, with the same production model and full-depth explainability paying customers get, and no infrastructure to stand up. The fastest way to try the real product is the GitHub Action or that cloud free tier. On-prem is a single sales-led tier, Bubo, on an annual license and deployable fully air-gapped; if you need to evaluate it in your own environment, talk to us about a pilot. Node count there is a starting point for the sizing conversation, not a hard cap enforced by the software. See Pricing for the full breakdown.
What's the difference between the cloud tiers?
All cloud tiers (Otus free, Athene, Strix, Pulsatrix) run on the same shared cloud deployment and the same production model, and get the always-computed top command on every flagged window. What changes is monthly volume — both build sessions and full attack-chain explanations are metered separately per tier, since a full attack-chain reconstruction costs substantially more compute per flagged window than raw ingest does. Higher tiers raise both the monthly session allowance and the full-attack-chain allowance. None of the cloud tiers store findings: delivery is real-time only across all of them, by design — see Security.
What does "explainability depth" mean?
hit1_command — the single command that most drove a verdict — is computed on every plan. Full-depth plans additionally get the complete attack chain: the most likely sequence of commands that together explain the finding.
Do you retrain the model on my data?
Not without a separate, explicit agreement. See Privacy.
How do I get findings into my SIEM?
Every verdict is an OCSF Detection Finding delivered via webhook or log file — see Integrations for the schema.
Something's not covered here
Email us — happy to talk through your specific environment.