37 MB on the endpoint. Zero Trust on every connection. £5 per endpoint, per month.
{
"rule": "Mimikatz Execution",
"severity": "critical",
"mitre_technique_ids": ["T1003"],
"host": "acme-dc-02",
"detected_at": "2026-08-30T14:07:41Z"
}Everything a SOC needs. Nothing it doesn't.
LightEDR is three tightly-integrated capabilities - detection, response, and telemetry - delivered through a single lightweight agent and a multi-tenant console.
Detection & investigation
A curated ruleset mapped to the MITRE ATT&CK techniques that matter, extended with your own Sigma rules and no DSL to learn. Every alert walks back to root cause in one process-tree view, with process, network, file and auth events deduplicated at the agent and queryable for 90 days.
Response & multi-tenancy
Isolate a host, kill a process or quarantine a file in under 500ms, from the console or the API. Every tenant runs on its own data plane - no shared indices, no noisy-neighbour risk - so an MSSP gets the isolation it needs without an enterprise price tag.
The lightweight agent
Under 40 MB on disk, under 1% CPU at steady state, no kernel module on Linux. The agent stays clear of your events-per-second budget instead of eating into it.
The only EDR with Zero Trust built in.
Every competitor trusts an agent once at enrolment. LightEDR scores every active connection continuously - five signals, four trust levels, instant revocation via Redis pub/sub. NIST SP 800-207 PDP/PEP architecture. Private key never leaves the endpoint.
AI-native from day one. Bring your own model.
The MCP server (pip install ledr-mcp) gives Claude, Cursor, or any MCP client 9 named tools for triage and response, and webhook channels wake your own agent when a rule fires - no polling. See how the AI integration works
Authentication that never stops.
Other EDRs issue a token at enrolment and trust the agent forever. LightEDR scores every active connection across five independent signals. Drop below threshold and the session degrades automatically - no manual intervention, no grace window.
What is Zero Trust EDR?- Private key never leaves the endpoint.
Enrolment uses a certificate signing request. The triage engine signs and returns only the cert - the private key is generated locally and stays there, chmod 600.
- Mutual TLS on every connection.
Every WebSocket is mTLS. Every auth frame carries a unique nonce checked against Redis to block replay attacks.
- Crypto challenge-response every 5 minutes.
The triage engine challenges each active agent with a random nonce. The agent must sign it with its private key - proving the key is still on that specific disk, not stolen.
- Instant revocation via pub/sub.
Revoking a cert closes the agent's WebSocket immediately through Redis pub/sub. No reconnect wait. No polling window.
- Tamper-evident audit log.
Every auth event is hash-chained - each record stores a SHA-256 of the previous record. A chain-walk job detects any gap or modification.
AI agents get the same tools your analysts do.
LightEDR exposes everything an AI agent needs to detect, investigate, and respond - through the Model Context Protocol and a battle-tested REST API. You bring the model. We provide the platform.
Connect in two config lines
The LightEDR MCP server gives your AI assistant named, described tools for querying alerts, investigating context, hunting events across the fleet, and taking response actions - no prompt engineering required.
pip install ledr-mcp
Bring the model you trust
We don't ship a bundled AI agent. You bring the model you trust - Claude, GPT, or your own. LightEDR provides webhook triggers, scoped service account keys, and an API that gives the agent everything it needs. Swap models any time without touching your security stack.
Event-driven, not latency-bound
Autonomous agents that poll for alerts waste tokens and introduce latency. LightEDR calls your agent when a rule fires - POST to your endpoint, the agent investigates and responds, then goes back to sleep. HMAC request verification and exponential backoff included.
Alert fires, agent wakes, threat resolved
Alert fires
A detection rule matches. LightEDR enriches the alert with threat intelligence, runs AI triage analysis, and POSTs the payload to your registered webhook endpoint.
Agent investigates
Your agent calls get_alert_context for the full picture - surrounding events, trust score, TI enrichment, similar past alerts. It calls investigate_alert to trigger LLM-assisted triage if needed.
Agent acts
Acknowledge with a note, escalate to a case, or isolate the host - all through the same MCP tools or REST API. Every action is written to the immutable audit log. The analyst sees everything.
Built around the analyst workflow.
Detections that actually fire
A curated ruleset, maintained weekly, mapped to MITRE ATT&CK. Bring your own Sigma rules without a DSL tax.
Process-tree forensics
Walk any alert back to root cause. Correlate process, network, file, and auth events in a single timeline.
Contain in a single click
Isolate a host, kill a process, quarantine a file - from the console or the API. Actions land in under 500ms.
Threat hunting, SQL-simple
Query 90 days of endpoint telemetry with a familiar dialect. No custom query language. No separate data lake.
AI triage and natural language hunt
Every high and critical alert gets an automatic explanation and a triage suggestion. Ask the hunt page a question in plain English - it returns the same structured result as a normal IOC search.
A process matching the Mimikatz credential dump signature ran on host web-01 under a service account showing elevated trust deviation. Technique T1003 is commonly used immediately after initial access to facilitate lateral movement.
3 open alerts share this technique on the same host within 10 minutes. The host's trust score dropped to 42 after the first alert fired.
Bring your own AI agent
Connect Claude, Cursor, Zed, or a custom agent via the MCP server or REST API. Webhooks wake your agent when a rule fires - no polling, no latency, no wasted tokens.
Show me all critical alerts from the last hour and isolate any host with a trust score below 0.5
Found 3 critical alerts. Isolated web-01 (trust 0.42). acme-dc-02 and eu-app-14 are above threshold - I've acknowledged both with investigation notes. All actions written to the audit log.
A leaner alternative, by design.
We don't try to out-feature the incumbents. We pick the features SOC teams actually use, do them well, and leave the rest out.
- Zero Trust, and no competitor ships it.
Every other EDR authenticates the agent once at enrolment and trusts it indefinitely. LightEDR scores every active connection across five signals and revokes mid-session - a NIST SP 800-207 PDP/PEP architecture the incumbents don't have.
- The price is on the website.
£5 per endpoint per month, published. Incumbent A and Incumbent B both quote by seat count and contract term behind a sales call.
- Your AI agent connects natively.
pip install ledr-mcpgives Claude, Cursor or Zed 9 named tools for triage and response. Neither incumbent exposes an MCP server.
Full feature comparison
| LightEDR | Incumbent A | Incumbent B | |
|---|---|---|---|
| Zero Trust architecture (NIST SP 800-207) | Supported Native | Not supported | Not supported |
| CSR enrolment - private key never transits | Supported | Not supported | Not supported |
| Continuous in-session trust scoring (5 signals) | Supported | Not supported | Not supported |
| Instant mid-session cert revocation | Supported | on reconnect | on reconnect |
| Tamper-evident hash-chained audit log | Supported | Not supported | Not supported |
| Behavioural detection (MITRE-mapped) | Supported Curated | Supported | partial |
| Bring-your-own Sigma rules | Supported Native | via DSL | Supported |
| ML-based anomaly scoring | opt-in | Supported | Supported |
| Host isolation < 500ms | Supported | Supported | seconds |
| Scripted response playbooks | Supported | Supported (add-on) | limited |
| Agent footprint | < 40 MB | ~240 MB | ~180 MB |
| Steady-state CPU | < 1% | 2-5% | 1-3% |
| No kernel module (Linux) | eBPF only | kmod | eBPF |
| Multi-tenant from day one | Supported Native | enterprise SKU | separate deploy |
| MSSP partner program | Licensed¹ | Supported | limited |
| Transparent per-endpoint pricing | Supported Public | quote-only | quote-only |
| AI-assisted alert triage (explain + suggest) | Supported Built in | add-on | Not supported |
| Natural language threat hunt | Supported | Not supported | Not supported |
| Automatic incident clustering | Supported | Not supported | Not supported |
| Self-hostable LLM (Ollama / air-gapped) | Supported | Not supported | Not supported |
| MCP server (Claude, Cursor, Zed) | Supported Native | Not supported | Not supported |
| Webhook-driven autonomous agents | Supported | Not supported | Not supported |
| Scoped service account keys for agent access | Supported | Not supported | Not supported |
| Full audit trail of all agent actions | Supported | Not supported | Not supported |
Scroll the table sideways for all three columns
Figures based on public docs as of Q1 2026. Vendor names anonymized - compared in good faith.
¹ MSSP managed-service use (managing endpoints for third-party clients) requires a commercial partner agreement. See FAQ
The overhead, measured.
See LightEDR on your fleet.
A 30-minute call with the people building it, tuned to your stack. We'll set up a sandbox tenant you keep for 14 days - no credit card, no sales deck.