Docs / FAQ

FAQ

Does Protet see my source code?

No. Detection operates on execve command sequences — what your build process runs — not on your source code or build artifacts.

Can I run this fully air-gapped?

Yes, on any on-prem tier. Pull a signed model bundle once, verify it against Protet's public key, and operate with no ongoing network dependency on Protet's control plane.

What's the difference between the trial and paid on-prem tiers?

Tyto is a free 14-day trial of the real product — the same production-gated model and full-depth explainability paying customers get, not a held-back preview. What limits it is the 14-day term, not capability. Paid on-prem tiers add a longer license, and at the top tier, dedicated support and early access to new detectors. Node count is a starting point for the sizing conversation, not a hard cap enforced by the software. See Pricing for the full breakdown.

What's the difference between the cloud tiers?

All three cloud tiers (Otus free, Strix Starter, Strix Growth) run on the same shared cloud deployment and get the always-computed top command on every flagged window. What changes is monthly volume — both build sessions and full attack-chain explanations are metered separately per tier, since a full attack-chain reconstruction costs substantially more compute per flagged window than raw ingest does. Otus and Starter get a limited monthly allowance of the full attack chain; Growth's allowance is large enough for regular use rather than an occasional sample. None of the cloud tiers store findings: delivery is real-time only across all of them, by design — see Security.

What does "explainability depth" mean?

hit1_command — the single command that most drove a verdict — is computed on every plan. Full-depth plans additionally get the complete attack chain: the most likely sequence of commands that together explain the finding.

Do you retrain the model on my data?

Not without a separate, explicit agreement. See Privacy.

How do I get findings into my SIEM?

Every verdict is an OCSF Detection Finding delivered via webhook or log file — see Integrations for the schema.

Something's not covered here

Email us — happy to talk through your specific environment.