Product · Delivered to you
Svarog guards it all.
Everything Perun does for your AI agents, plus whole-computer protection. Svarog watches the machine — files, processes, the network — and the agents on it, and defends through its own AI agents. What it cannot decide alone, it brings to a person. On your own computers.
Perun, and more
One guard for the agent. One defender for the machine.
Perun — guards your agent
Stands between your AI agents and their model and stops every text and document attack: hidden text, forged roles, tool-call manipulation, the calm request that makes an agent simply obey.
Svarog — guards the whole computer
All of that — Svarog is built on Perun — and the classic threats around it: ransomware, intrusions, malicious files, network attacks. One defender for the agent and the host it runs on.
What your company gets
Why have Svarog on your machines
- One defender, not two tools. Everything Perun does for your AI agent, plus whole-computer protection — ransomware, intrusions, malicious files, network attacks — from one place.
- It tells an attack from a mistake. AI agents read intent, so an admin's slip or a backup job is not treated like an enemy — fewer false alarms, less noise for your team.
- Nothing is destroyed to defend you. A process is suspended, a file quarantined, an address blocked — all reversible. Only what cannot be undone waits for a person.
- You stay in control. By default Svarog proposes and holds; it enforces on its own only when you turn that on.
- Your data stays yours. On your own computers: no cloud, no telemetry, nothing leaves the building.
- A record you can show. Every decision is signed and append-only — for an audit, an incident review, or a customer who asks.
- Delivered done. Installation and your operators' training are included — not a download to figure out alone.
What it stops · the agent layer
Everything Perun stops
- Hidden and encoded text. Cleans it before the model reads a word.
- Forged roles. Assembles every call itself and reads what each part claims to be.
- Tampered models. With the model check option: the model is checked before it is trusted.
- Calm requests. Holds irreversible actions for a human, sharper with your declarations.
- Dangerous content. With the harm classifier option, which runs on your computer.
- Control over the reply. Assembles every call itself: your system prompt stays, and the model can refuse.
- Tool-call manipulation. Checks each action against where its words came from; a tool that changes is refused.
- Attacks through your application. Checks each destination by its kind, guards what you protect, cleans what is shown.
- Attacks hidden in images, audio and video. In development.
Svarog carries Perun whole, so the agent layer is the same: every text and document attack stopped; images, audio and video come next, as an update. The full map, or read about Perun on its own.
What it stops · the classic layer
And the threats to the machine itself
Ready
Ransomware
A program suddenly rewrites a flood of your files.
Svarog sees the burst, an agent reads it, and the program is held before it finishes.
Ready
Runaway or injected processes
One program spawns a swarm of others, the way a worm spreads.
The spawn burst is caught and the parent is suspended, not killed — reversible.
Ready
Port and network scanning
Something probes many machines on your network, looking for a way in.
The fan-out is spotted and the source is blocked; an agent says whether it is an attack or a monitor.
Ready
Password break-ins
Repeated failed logins from one source, trying to guess a way in.
Svarog counts them and blocks the source; a known-bad source trips sooner.
Ready
Malicious files
A file on disk matches a known-bad signature.
The file is moved to quarantine — never deleted — and an agent weighs it. It catches what your signature rules describe.
Ready
Network intrusions
Your network sensor raises a serious alert about traffic in or out.
Svarog blocks the source and brings the alert, in plain words, to a person. Needs the network sensor installed.
Ready
Data theft and call-home
A program reaches out to many outside destinations, the way stolen data or a beacon leaves.
The outbound fan-out is held; an agent tells a backup job from an exfiltration.
Ready
Host anomalies
The system itself behaves abnormally — a crash pattern, a tampered service.
The anomaly is caught and the process suspended while a person decides.
Honest about the edges
What Svarog does not do yet
- Linux only, for now. The sensors are Linux; Windows and macOS come later. (Perun, the agent layer, runs on Windows too.)
- It sees what your sensors see. The audit log is always on; a network sensor and a system-events sensor add more when installed; file scanning runs on demand.
- Reflexes are thresholds. A very slow, very quiet attack — below the line — leans on the AI agent to catch, and the agent is not perfect.
- Malicious files: it catches what your signature rules describe, not every possible file.
- Images, audio and video (the agent layer’s ninth attack): in development, same as Perun.
- The fleet (several computers as one) is in beta and not yet security-reviewed. Use the standalone 1.0 for production.
We would rather tell you the edges than oversell. As Svarog is proven on real machines, this list shrinks — and the numbers that replace these words will be published.
How it defends
Defended by AI agents, with a person in the loop
- Sensors see, agents reason, governance decides. Svarog's sensors watch files, processes and the network. Fast reflexes catch the clear cases at once; an AI agent reads the rest and tells an attack from an accident — an admin's slip, a drifting-not-hostile program, a bad update.
- It proposes and holds; it does not fire blindly. By default Svarog proposes and waits — nothing is enforced on its own. You turn on automatic containment when you want it.
- Reversible first, nothing deleted. A process is suspended, a file quarantined, an address blocked — all reversible. Anything that cannot be undone waits for a person.
- It tells an enemy from an accident. A real attack is contained and the source marked; a mistake is handled gently, without branding anyone. When unsure, Svarog chooses the gentler hold and asks.
- Honest about itself. Svarog's own units are watched for the same balance it watches everything else for, so the defender does not over-block or fall asleep.
Built from
- Care Invariant
- Units
- SHARED_LIB
- Physician
- Guardian
- Held for a human
- Sealed record
Svarog is designed and written by Andrej Ristić, on the same PSE engine as Perun and every free tool. It carries Perun inside it as its agent layer.
The balance it keeps
Honest about itself, too
Svarog's own units are watched for the same balance it watches everything else for — between self, others and the field. A defender that drifts is caught like anything else.
- Your agent works in balance.
- An invoice carries a hidden order. The agent starts to simply obey.
- Svarog sees the drift and holds the action for a person.
- Your operator answers. The agent goes on with its work.
Versions
Svarog 1.0 is out.
Svarog 1.0 23 October 2026
Everything in Perun 1.0, plus whole-computer protection: ransomware, intrusions and malicious files watched by Svarog’s own AI agents, which run under Perun themselves. Sensors, fast reflexes and a governed response, with a hardened operator console; it guards one computer on its own, no network needed. Verified end to end on our own networks, on Ubuntu.
Svarog 1.1 — fleet Networking, in beta
Optional: several computers as one fleet, one boss, one shared memory. The networking is in beta and not yet security-reviewed; the 1.0 standalone release is the one for production.
For production, use the 1.0 standalone release. The fleet networking in 1.1 is not yet security-reviewed. Next for the agent layer: attacks carried in images, audio and video, as an ordinary update. Three design-partner places are open; the totals from those runs are published here as partners share them.
Design partners
Three places. Sixty days with us. Half price for a year.
Perun and Svarog are new, and we want them proven on real systems first. Run either with us: we install it, train your operators and stay on a direct line. You get half price for the first year, and your results shape what comes next.
- Who it is for
- A team with an agent that acts — it sends email, moves files, pays or calls tools — or a machine you want guarded, in production or close to it.
- What you get
- Perun or Svarog installed with you, your setup written with you, your first operators trained, a direct line to the founders, updates included, and half price for the first year if you stay.
- What we ask
- Thirty minutes a week, and the totals: how many calls were let through, cleaned or stopped, and how many alarms were false. The record stays on your computers; you send us only the numbers.
- What it costs
- Nothing for sixty days. Then half price for the first year if you stay — Perun Start at $1200 CAD, Svarog Start at $1800 CAD — and a case study or your logo on this site only if you want it.
Delivery and price
From $3600 CAD for the first year. Installation included.
Svarog is delivered to you, not downloaded, for Ubuntu. Every delivery includes installation with you, your setup written with you, the training of your first operators, and a 30-day pilot. Svarog Start — one computer — is $3600 CAD for the first year and $1800 CAD a year after that. Teams, organisations and anything with an SLA or an audit: ask us, and a founder replies within two hours. Want only the agent layer? Perun is that, on its own.
One forwarded contracts folder costs more.
Contact
Guarding a machine that runs agents?
Tell us what runs on it and where it can act. A founder will reply.
NDA available for commercial discussions · Toronto, Ontario, Canada