Lightweight EDR for SOC Teams
Endpoint detection without the overhead - Zero Trust native, <40 MB agent, from £5/endpoint/month.
Everything a SOC needs. Nothing it doesn't.
LightEDR is three tightly-integrated capabilities - detection, response, and telemetry - delivered through a single lightweight agent and a multi-tenant console.
Real-time behavioural detection
A ruleset tuned for the MITRE ATT&CK techniques that matter. Supplement with your own Sigma rules - no DSL to learn.
One-click containment
Isolate a host, kill a process, quarantine a file. Response actions execute in under 500ms - from console or API.
Signal, not noise
Process, network, file, and authentication events - deduplicated at the agent, enriched at ingest, queryable for 90 days.
Process-tree forensics
Walk any alert back to root cause in a single view. Lateral movement, persistence, C2 - visible at a glance.
Tenant-isolated by design
Every tenant gets its own data plane. No shared indices, no noisy-neighbor risk. Multi-tenant by design from day one - the architecture MSSPs need without the enterprise price tag.
Lightweight, honestly
Under 40 MB on disk, under 1% CPU at steady state. No kernel module on Linux. Your EPS will thank you.
The only EDR with Zero Trust built in.
Every competitor trusts an agent once at enrolment. LightEDR scores every active connection continuously - five signals, four trust levels, instant revocation via Redis pub/sub. NIST SP 800-207 PDP/PEP architecture. Private key never leaves the endpoint.
AI-native from day one. Bring your own model.
LightEDR is the platform your AI agents operate on. The MCP server (pip install ledr-mcp) gives Claude, Cursor, or any MCP-compatible client 13 named tools - list alerts, investigate, hunt events, isolate hosts. Webhook channels wake your agent when a rule fires; the agent investigates and responds without polling. LLM-assisted triage works with Anthropic, OpenAI, Azure OpenAI, Gemini, or local Ollama. All of it is optional - every other feature works without a provider configured.
Authentication that never stops.
Other EDRs issue a token at enrolment and trust the agent forever. LightEDR scores every active connection across five independent signals. Drop below threshold and the session degrades automatically - no manual intervention, no grace window.
What is Zero Trust EDR? →- Private key never leaves the endpoint.
Enrolment uses a certificate signing request. The triage engine signs and returns only the cert - the private key is generated locally and stays there, chmod 600.
- Mutual TLS on every connection.
Every WebSocket is mTLS. Every auth frame carries a unique nonce checked against Redis to block replay attacks.
- Crypto challenge-response every 5 minutes.
The triage engine challenges each active agent with a random nonce. The agent must sign it with its private key - proving the key is still on that specific disk, not stolen.
- Instant revocation via pub/sub.
Revoking a cert closes the agent's WebSocket immediately through Redis pub/sub. No reconnect wait. No polling window.
- Tamper-evident audit log.
Every auth event is hash-chained - each record stores a SHA-256 of the previous record. A chain-walk job detects any gap or modification.
Built for AI agents. Not bolted on.
LightEDR exposes everything an AI agent needs to detect, investigate, and respond - through the Model Context Protocol and a battle-tested REST API. You bring the model. We provide the platform.
Connect in two config lines
The LightEDR MCP server gives your AI assistant named, described tools for querying alerts, investigating context, hunting events across the fleet, and taking response actions - no prompt engineering required.
pip install ledr-mcp
Model-agnostic by design
We don't ship a bundled AI agent. You bring the model you trust - Claude, GPT, or your own. LightEDR provides webhook triggers, scoped service account keys, and an API that gives the agent everything it needs. Swap models any time without touching your security stack.
Event-driven, not latency-bound
Autonomous agents that poll for alerts waste tokens and introduce latency. LightEDR calls your agent when a rule fires - POST to your endpoint, the agent investigates and responds, then goes back to sleep. HMAC request verification and exponential backoff included.
Alert fires. Agent wakes. Threat resolved.
Alert fires
A detection rule matches. LightEDR enriches the alert with threat intelligence, runs AI triage analysis, and POSTs the payload to your registered webhook endpoint.
Agent investigates
Your agent calls get_alert_context for the full picture - surrounding events, trust score, TI enrichment, similar past alerts. It calls investigate_alert to trigger LLM-assisted triage if needed.
Agent acts
Acknowledge with a note, escalate to a case, or isolate the host - all through the same MCP tools or REST API. Every action is written to the immutable audit log. The analyst sees everything.
Built around the analyst workflow.
Detections that actually fire
A curated ruleset, maintained weekly, mapped to MITRE ATT&CK. Bring your own Sigma rules without a DSL tax.
Process-tree forensics
Walk any alert back to root cause. Correlate process, network, file, and auth events in a single timeline.
Contain in a single click
Isolate a host, kill a process, quarantine a file - from the console or the API. Actions land in under 500ms.
Threat hunting, SQL-simple
Query 90 days of endpoint telemetry with a familiar dialect. No custom query language. No separate data lake.
AI triage and natural language hunt
Every high and critical alert gets an automatic explanation and a triage suggestion. Ask the hunt page a question in plain English - it returns the same structured result as a normal IOC search.
A process matching the Mimikatz credential dump signature ran on host web-01 under a service account showing elevated trust deviation. Technique T1003 is commonly used immediately after initial access to facilitate lateral movement.
3 open alerts share this technique on the same host within 10 minutes. The host's trust score dropped to 42 after the first alert fired.
Bring your own AI agent
Connect Claude, Cursor, Zed, or a custom agent via the MCP server or REST API. Webhooks wake your agent when a rule fires - no polling, no latency, no wasted tokens.
Show me all critical alerts from the last hour and isolate any host with a trust score below 0.5
Found 3 critical alerts. Isolated web-01 (trust 0.42). acme-dc-02 and eu-app-14 are above threshold - I've acknowledged both with investigation notes. All actions written to the audit log.
A leaner alternative, by design.
We don't try to out-feature the incumbents. We pick the features SOC teams actually use, do them well, and leave the rest out.
| LightEDR | Incumbent A | Incumbent B | |
|---|---|---|---|
| Zero Trust architecture (NIST SP 800-207) | ✓ Native | ✗ | ✗ |
| CSR enrolment - private key never transits | ✓ | ✗ | ✗ |
| Continuous in-session trust scoring (5 signals) | ✓ | ✗ | ✗ |
| Instant mid-session cert revocation | ✓ | on reconnect | on reconnect |
| Tamper-evident hash-chained audit log | ✓ | ✗ | ✗ |
| Behavioural detection (MITRE-mapped) | ✓ Curated | ✓ | partial |
| Bring-your-own Sigma rules | ✓ Native | via DSL | ✓ |
| ML-based anomaly scoring | opt-in | ✓ | ✓ |
| Host isolation < 500ms | ✓ | ✓ | seconds |
| Scripted response playbooks | ✓ | ✓ (add-on) | limited |
| Agent footprint | < 40 MB | ~240 MB | ~180 MB |
| Steady-state CPU | < 1% | 2-5% | 1-3% |
| No kernel module (Linux) | eBPF only | kmod | eBPF |
| Multi-tenant from day one | ✓ Native | enterprise SKU | separate deploy |
| MSSP partner program | Licensed¹ | ✓ | limited |
| Transparent per-endpoint pricing | ✓ Public | quote-only | quote-only |
| AI-assisted alert triage (explain + suggest) | ✓ Built in | add-on | ✗ |
| Natural language threat hunt | ✓ | ✗ | ✗ |
| Automatic incident clustering | ✓ | ✗ | ✗ |
| Self-hostable LLM (Ollama / air-gapped) | ✓ | ✗ | ✗ |
| MCP server (Claude, Cursor, Zed) | ✓ Native | ✗ | ✗ |
| Webhook-driven autonomous agents | ✓ | ✗ | ✗ |
| Scoped service account keys for agent access | ✓ | ✗ | ✗ |
| Full audit trail of all agent actions | ✓ | ✗ | ✗ |
Figures based on public docs as of Q1 2026. Vendor names anonymized - compared in good faith.
¹ MSSP managed-service use (managing endpoints for third-party clients) requires a commercial partner agreement. See FAQ →
Quiet agents. Loud signal.
See LightEDR on your fleet.
A 30-minute call with the people building it, tuned to your stack. We'll set up a sandbox tenant you keep for 14 days - no credit card, no sales deck.