Skip to content
SPECIFICTION
Get listed

AEGIS

github.com

Free plan Open source WebWindowsmacOSLinuxAPISelf-hosted
Visit github.com
Spec score 9.1 #2 of 22 in Ransomware Protection Software

What it is

AEGIS is an open-source, self-hosted cybersecurity platform for detecting, analyzing, and responding to threats. Its listed detections include SQL injection, XSS, path traversal, command injection, brute force, port scans, credential theft, lateral movement, and C2 beacons. The project describes a five-layer detection pipeline and reports an 11/11 detection score, as well as 18-microsecond latency for its middleware layer. Deception options include SSH and HTTP honeypots, credential traps, and attacker interaction profiling. AI features can use OpenRouter, OpenAI, Anthropic, or Ollama; Sigma rules and playbooks can operate without an AI API key. The free plan is self-hosted with Docker Compose and supports up to 20 nodes, 100 assets, and 3 users. It is described for individuals, homelabs, and small teams, and is offered under the AGPL-3.0 license. Enterprise adds unlimited nodes, assets, and users, an SLA and dedicated support, plus a compliance dashboard covering ISO 27001, NIS2, and SOC 2 and SAML or OIDC single sign-on. Enterprise pricing is custom.

Spec sheet

What it does
AEGIS is a self-hosted autonomous defense platform for real-time ransomware, lateral-movement and intrusion detection.Read 14 Oct 2026 · github.com
Purpose
AEGIS is an open-source, self-hosted cybersecurity defense platform for detecting, analyzing, and responding to threats.Read 29 Sep 2026 · alejadxr.github.io
Intended users
The free plan is described for individuals, homelabs, and small teams; Enterprise is for companies seeking advanced features and scale.Read 29 Sep 2026 · alejadxr.github.io
Platforms
The free plan includes a dashboard and Rust endpoint agent; the repository says the agent builds for macOS arm64, Linux x64, and Windows x64.Read 29 Sep 2026 · github.com
Integrations
The site names OpenRouter, OpenAI, Anthropic, and Ollama as AI providers and describes shared threat intelligence.Read 29 Sep 2026 · alejadxr.github.io
License
AEGIS is offered as open source under the AGPL-3.0 license.Read 29 Sep 2026 · github.com
AI and offline use
The site says AEGIS can use OpenRouter, OpenAI, Anthropic, or Ollama for AI features, while deterministic Sigma rules and playbooks work without an AI API key.Read 29 Sep 2026 · alejadxr.github.io
API authentication
API endpoints require an X-API-Key header or a JWT Bearer token.Read 14 Oct 2026 · github.com
API surface
The deployment includes a FastAPI backend with more than 140 endpoints across 25 API routers.Read 14 Oct 2026 · github.com
Changelog release
Changelog version 1.6.1 is dated 2026-05-14 and adds ransomware defense and cloud-native CVE coverage.Read 14 Oct 2026 · github.com
Changelog security coverage
The 1.6.1 changelog lists detections for React2Shell, Next.js, Vite, Marimo, vLLM and pickle-related CVEs.Read 14 Oct 2026 · github.com
Company identity
The maker is identified publicly by the GitHub account name alejadxr.Read 14 Oct 2026 · github.com
Deception
AEGIS offers SSH and HTTP honeypots, breadcrumb credential traps, and attacker interaction profiling.Read 29 Sep 2026 · alejadxr.github.io
Deployment components
The Docker stack contains an API container, a Next.js dashboard container and PostgreSQL 16.Read 14 Oct 2026 · github.com
Detection
The site describes a five-layer detection pipeline and reports an 11/11 detection score.Read 29 Sep 2026 · alejadxr.github.io
Detection performance
The repository states that rule evaluation uses an indexed lookup taking less than 1 millisecond per event.Read 14 Oct 2026 · github.com
Endpoint agent platforms
The Rust endpoint agent is described as building for macOS arm64, Linux x64 and Windows x64.Read 14 Oct 2026 · github.com
Enterprise additions
The enterprise page lists smart honeypots, quantum-entropy and C2 detection, SBOM scanning, compliance dashboards, SSO and advanced reports.Read 14 Oct 2026 · alejadxr.github.io
Enterprise support
The Enterprise plan lists an SLA and dedicated support.Read 29 Sep 2026 · alejadxr.github.io
Firewall requirement
Real pfctl or iptables enforcement is optional, requires root or sudo and is disabled by default in favor of an in-memory firewall.Read 14 Oct 2026 · github.com
Free tier limits
The free plan is listed for up to 20 nodes, 100 assets, and 3 users.Read 29 Sep 2026 · alejadxr.github.io
Initial setup
There are no default credentials; a setup wizard at /setup creates the first administrator account.Read 14 Oct 2026 · github.com
Install method
The documented quick start clones the repository, copies .env.example and starts the stack with docker compose up -d.Read 14 Oct 2026 · github.com
Licence
AEGIS is licensed under GNU Affero General Public License version 3.0.Read 14 Oct 2026 · github.com
Limit: enterprise scale
The comparison section says AEGIS trades unlimited enterprise scale for deterministic detection and zero licensing cost.Read 14 Oct 2026 · github.com
Limit: entropy analysis
The README labels entropy analysis for mass encryption as still in development.Read 14 Oct 2026 · github.com
Limit: recovery maturity
Process termination and snapshot recovery are marked as in development and gated by AEGIS_REAL_RECOVERY=1.Read 14 Oct 2026 · github.com
Limit: unintegrated CVEs
The changelog says several kernel, runc and systemd CVEs are not yet integrated because they need kernel or eBPF telemetry.Read 14 Oct 2026 · github.com
Maker repository activity
The maker profile lists AEGIS as its primary public repository and shows three public repositories in total.Read 14 Oct 2026 · github.com
Middleware performance
The product site reports 18-microsecond latency for its middleware detection layer.Read 14 Oct 2026 · alejadxr.github.io
Offline operation
With AEGIS_AI_MODE disabled, deterministic rules, templates, MITRE mapping and firewall blocking continue without external AI calls.Read 14 Oct 2026 · github.com
Performance testing
The changelog reports a 10,000-events-per-second benchmark on its test host for the mixed-type event test.Read 14 Oct 2026 · github.com
Phantom module
The Phantom module provides SSH and HTTP honeypots plus breadcrumb credential traps.Read 14 Oct 2026 · github.com
Ransomware detection
The project documents ransomware rules for shadow-copy deletion, mass encryption, canary files, ransom notes, LOLBins, RDP, SMB and WinRM activity.Read 14 Oct 2026 · github.com
Response module
The Response module blocks confirmed threats permanently and gives unconfirmed blocks an automatic expiry.Read 14 Oct 2026 · github.com
Response speed
The site reports 18-microsecond detection latency for its middleware layer.Read 29 Sep 2026 · alejadxr.github.io
Security and compliance
Enterprise includes a compliance dashboard for ISO 27001, NIS2, and SOC 2, plus SSO using SAML or OIDC.Read 29 Sep 2026 · alejadxr.github.io
Security reporting
The repository links a SECURITY.md responsible-disclosure policy for vulnerability reports.Read 14 Oct 2026 · github.com
Self-hosting
The free plan is self-hosted with Docker Compose and the site instructs users to clone the repository and run docker compose.Read 29 Sep 2026 · alejadxr.github.io
Surface module
The Surface module performs attack-surface management with nmap and nuclei scans, scheduling and CVSS history.Read 14 Oct 2026 · github.com
System requirements
The full stack requires Docker and Docker Compose, with 2 GB RAM minimum and 4 GB recommended.Read 14 Oct 2026 · github.com
Threat detection
Listed detections include SQL injection, XSS, path traversal, command injection, brute force, port scans, credential theft, lateral movement, and C2 beacons.Read 29 Sep 2026 · alejadxr.github.io
Threat intelligence
The RaaS feed combines RansomLook and CISA data and refreshes every six hours with attacker infrastructure and ransomware artifacts.Read 14 Oct 2026 · github.com
WebSocket
Real-time event streaming is exposed through a WebSocket at /ws.Read 14 Oct 2026 · github.com

Plans and prices

Free · Open Source Free Free forever 5-layer detection pipeline · 122 Sigma rules · SSH + HTTP honeypots · breadcrumb traps · AI triage · 20 nodes · 100 assets · 3 users Read 14 Oct 2026 · alejadxr.github.io
Enterprise Priced on request Custom Unlimited nodes · unlimited assets · unlimited users · SSO · custom Sigma rules · SLA · dedicated support Read 14 Oct 2026 · alejadxr.github.io

Every AEGIS plan and price →

Strong points and limits

Strong points

  • Free open-source plan under AGPL-3.0.
  • Covers a broad list of threat types.
  • Sigma rules and playbooks work without an AI API key.
  • Deception tools include SSH and HTTP honeypots.
  • Enterprise includes compliance dashboard and SSO.

Limits

  • Free plan is limited to 20 nodes.
  • Free plan is limited to 100 assets and 3 users.
  • Self-hosting requires Docker Compose.
  • Enterprise pricing is custom.

Who it suits

The free plan suits individuals, homelabs, and small teams prepared to self-host with Docker Compose. Enterprise is aimed at companies needing scale and advanced features.

Verdict

AEGIS combines threat detection, response, and deception features in a self-hosted package. The free tier has stated node, asset, and user limits; enterprise pricing is custom.

Where Specifiction places it

Alternatives to AEGISAll alternatives →