01
A file arrives
A download finishes, a USB stick is plugged in, an archive is unpacked. Guard notices new and changed files in your watched folders the moment they are written.
02
Three engines look at it
ClamAV signatures, the YARA rules of signature-base and php-malware-finder, and the secscan heuristics for web malware, secrets and vulnerable dependencies. The same engines as the secscan sandbox, on your computer.
03
A threat is isolated
Within seconds the file is encrypted into the quarantine, where it cannot run. You decide later: restore it if it was a mistake, or delete it for good.
04
You are told, wherever you are
A notification on the computer, an email to you, and the protection status of every computer in your secscan profile. Only the detection name and a checksum leave the computer, never the file or its name.
