Sandflysecurity

Sandfly Security is a Linux security company whose product is an agentless intrusion detection, threat hunting, and incident response platform. Rather than installing software agents on protected endpoints, Sandfly works against most Linux versions that have SSH installed, including Red Hat, CentOS, Ubuntu, Debian, Fedora, Suse, Amazon AWS Linux, Linode images, and DigitalOcean images. It automates continuous searching for hackers, malware, and suspicious activity, collects forensic evidence to support incident response, and can be configured to run automated responses when threats are detected.

Capabilities marketed by the company include detection of known and unknown Linux threats, SSH key monitoring to identify stolen credentials and lateral movement, password auditing for weak credentials, drift detection for unauthorized host changes, custom modules ("sandflies") for emerging threats, and an AI-based analyst feature for alert investigation. Modules are tagged to MITRE ATT&CK techniques, and alert data is available as JSON via the interface and a REST API. The platform supports a broad range of CPU architectures, with version 4.5.0 adding a new expression language syntax for custom threat hunting modules and expanded CPU support covering IBM POWER8, 9, and 10 processors. Sandfly states it protects systems ranging from modern cloud deployments to decade-old devices regardless of distribution or CPU architecture.

The company maintains public documentation at docs.sandflysecurity.com and a GitHub organization publishing setup scripts and open-source Linux forensics utilities, including an entropy scanner for packed or encrypted binaries, kernel module and file de-cloaking tools for stealth rootkits, and SSH key security scanners.

Founding story

Sandfly was founded by Craig Rowland, who previously built intrusion detection technologies, one of which reduced false alarms by up to 95 percent and was acquired by Cisco. Before working in the private sector he spent years with the Chief of Naval Operations at the U.S. Pentagon. Observing how security teams struggled to protect critical assets, he concluded that traditional agent-based approaches were poorly suited to securing Linux, which led to Sandfly's agentless design.

Business model

Sandfly sells a commercial Linux security platform, licensed per protected host and user, with a free tier covering up to 50 hosts and 5 user accounts alongside paid professional licensing and free trial licenses. The software is customer-deployed, including as a Docker/Podman deployment or via a preconfigured DigitalOcean Droplet image.

Commercial software licensing of the Sandfly platform, with a free-of-charge tier for small deployments and trial licenses used to convert users to paid licenses.

Traction

Sandfly reports use by companies in telecommunications, manufacturing, and networking that operate critical infrastructure. Public endorsements come from the Netfilter team, a senior security engineer at the University of Massachusetts, and DigitalOcean's deputy CISO, whose company also distributes Sandfly through its marketplace. Ericsson integrated Sandfly's agentless EDR into its Security Manager XDR product. The main sandfly-setup GitHub repository has 93 stars and 15 forks, and the sandfly-entropyscan tool has 170 stars.

Latest developments

Current marketing highlights an AI-powered analyst capability for alert investigation and an announced integration of Sandfly agentless EDR into the Ericsson Security Manager XDR solution. The DigitalOcean Marketplace listing shows version 5.8.1 running on Debian 13 (Trixie).