Michael · Autonomous security for every server

Attacks went machine-speed. Defence stayed human-speed.

The tools that could help cost $60 to $230 per endpoint a year, or $150k+, and are sold to companies that already have a SOC.

1,100+

attack projects run by one operator with an open-source AI agent, breaching 100+ companies at about $50 per site.

70%

of the web exposed by PHP2Shell in a single week, alongside a GitLab CVSS 10.0 and a LiteLLM credential stealer.

10M

servers with no security team. Their owners are searching “am I affected” at midnight.

Typical enterprise tools

$60 to $230

per endpoint per year, or $150k+ per year for a platform.

Michael

₦0 to ₦55,000

a month: three applications free, then a dollar an app or a bundle.

Two live. Two in design.

Guard and Pulse run in this build. Sword and Halo are in design, are not sold, and are not part of what you buy today.

Guard

Detection that acts, not alerts

Runtime, network, web, and identity coverage with autonomous response inside your policy guardrails.

# policy.yml on web_shell.detected: contain: [freeze_process, block_egress, snapshot] require_approval: false # low blast radius rollback: enabled

Sword

Authorised offence

Proves what is exploitable on your own estate, under signed authorisation. In design; the only offence that runs today is the loopback lab.

recon→exploit→proof attached

Halo

Supply chain and AI-BOM

Verifies artifacts, provenance and update channels. In design; nothing here ships yet.

Pulse

Advisory to detection, on a public clock

Every rule this deployment publishes is listed, with its state, on a page anyone can read.

npm advisories matched

PyPI and Go matched

dpkg and rpm matched

Rules first. A model only where it earns its place.

Every decision today is deterministic and costs nothing to make. The same inputs produce the same action, and the console prints the branch that fired.

Known bad

Rules

Advisory, fix availability, reachability. Instant and free.

100%

Priority

Exposure score

0.55 exposure, 0.25 CVSS, 0.20 reachability. One formula, in the open.

Many

Evidence

Explanation

The event, the advisory and the branch that fired, sealed in a hash chain.

Sealed

Roadmap

Trained model

A classifier over the same features, offline-trained and reproducible. Not shipped.

Inference bill

₦0 per server per month

There is no model call in the decision path, so a decision costs nothing and never varies between two identical events.

The proof is running now.

A deliberately vulnerable portal on the live host. Michael probes it, records real findings, applies a data-only virtual patch, and blocks the exploit through a separate proxy. The app underneath stays unpatched.

Direct to the app

302

SQL injection accepts the login. Command injection returns LAB_CMD_MARKER. Traversal reads the login source.

Through Michael Shield

403

All four vectors blocked, including a 300 KB body-cap test. Every block is written to the audit chain.

Rollback

403 → 302 → 403

Revoke the rule and the exploit works again. Re-probe and the rule is back. That is the whole lifecycle.

Read the full walkthrough

The bottom of the market is open for 18 to 24 months.

Incumbents are moving up-market. Google bought Wiz for $32B and left the people who need protection most behind.

$34B

cloud security in 2026, growing to $59B by 2031

$109B

small business security spend

$39B

managed security service providers

$10B+

serviceable per year across 8M SMBs and 150k hosts

$2.6M ARR in 3 years494 customersBreak-even month 11 to 12Gross margin above 85%CAC payback under 9 months

Five lines. The prices the billing page charges.

Three applications free, no card. Every figure is what the billing page charges, monthly, in naira and in dollars at a fixed 1,500 to the dollar. Pay a year and get two months free.

Free

₦0

Three live applications, weekly scans, containment, email alerts, seven days of history.

Start free

Metered

₦1,500 /app/mo · $1

Ten apps, ten dollars. Daily scans and request blocking, billed per live app above the free three, one invoice.

See how it adds up

Most popularGuard

₦7,500 /mo · $5

Twelve applications, daily scans, request blocking, the weekly digest, 90-day history.

Start Guard

Agency

₦55,000 /mo · $39

Sixty sites, white-label client reports, priority support, a year of history, one invoice.

Compare

Agency+

₦120,000 /mo · $79

A hundred and twenty sites on the same terms, with a named contact for onboarding.

Compare

Quiet applications sleep after seven days with no report: they stop counting against your live applications and stop being billed. One click wakes them.

Questions, answered

What happens if Michael contains something by mistake?

Every action is reversible. Each rule has a Lift button in the console that revokes it immediately, and the next report cannot bring it back while the advisory still applies. In the live lab you can watch the rule come out and the exploit return.

How do I know why it acted?

Each decision ships with its evidence and is sealed into a hash chain per application. Editing a row breaks verification at that entry, and the project page prints the head of the chain and whether it verifies.

Is the offensive side safe to run on my systems?

The only offence that runs today is the loopback lab, and it refuses any hostname that is not loopback. Estate-wide offence (Sword) is not built.

What does the free plan include?

One application, forever, with weekly scans and containment for packages that have no published fix. Paid plans add more applications, daily scans, request blocking and the weekly digest.

Can hosting providers resell it?

Not yet. The hosted plans are Free, Metered, Guard, Agency and Agency+; wholesale pricing for hosting providers is not open.

What happens when an application goes quiet?

After five days with no report you get an email. After seven it sleeps: no scans, no alerts, no bill, and it stops using one of your live slots. One click wakes it and nothing was deleted.

What if I add a fourth application on the free plan?

It is accepted, paused. Nothing is lost at the moment you installed it: pause one of the three live apps to wake it, or upgrade and keep all four awake.

Why this is possible now

0.4 ms

Request block, measured

Median block on a real Express app through the guard, p99 at 18 ms. Decisions cost nothing because no model is called.

Attack signatures

Twelve block outright, six are logged for review because a payload match alone is not proof of intent.

18–24

Months of open market

Incumbents are consolidating up-market, as Google buying Wiz for $32B shows, and the bottom is open.

An autonomous operator for every server.