Single binary
One download. Run 1sec up and every module starts. No containers, no orchestration, no config files required.
1sec up1-SEC
Open Source Security // 2026
scroll
One binary.
Total defense.
The next generation of rapid-deployment security layers. Auditable, community-driven, and designed for immediate integration.
$curl -fsSL 1-sec.dev/get | sh→
View Source on GitHub16 Defense Modules · 6 Tiers · Automated Enforcement
One binary. Sixteen defense modules. Each module runs independently on a shared event bus — with built-in collectors, cold archiving, and configurable response to connected security signals.
Network Guardian
DDoS mitigation with volumetric flood detection and amplification/reflection attack handling. Per-IP rate limiting with configurable thresholds. IP reputation scoring with dynamic threat scoring that auto-blocks repeat offenders. Geo-fencing by country code. DNS tunneling detection via entropy analysis and DGA domain flagging. C2 covert channel detection through beaconing interval analysis. Full lateral movement monitoring covering Pass-the-Hash, Kerberoasting, Golden Ticket, DCSync, and RDP/SMB brute force. SYN scan and port scan detection with configurable sensitivity. Protocol anomaly flagging for malformed packets and suspicious traffic patterns.
API Fortress
BOLA and BFLA detection with per-user resource access tracking to catch horizontal and vertical privilege escalation. OpenAPI schema validation that flags undocumented endpoints, missing auth, and parameter type violations. Shadow API discovery that identifies undocumented endpoints receiving live traffic. Per-endpoint rate limiting with burst detection. Mass assignment protection scanning request bodies for unexpected fields. Sensitive data exposure scanning in API responses (SSNs, credit cards, tokens). GraphQL depth and complexity abuse prevention. JWT algorithm confusion and weak signing detection (none, HS256 with public key). SSRF-via-API detection for internal network probing through API parameters. Response anomaly analysis flagging unusual payload sizes and error rate spikes.
IoT & OT Shield
Inspects supplied device inventory, protocol/command, firmware, management-exposure, and network-zone events for implemented anomalies. Management access decisions can require configured source networks and exact independently verified operators when called through the authenticated API. A trusted gateway must enforce those decisions before forwarding and remove bypass routes. Protocol alerts do not automatically reject packets, disconnect equipment, or implement equipment-specific operating safety rules.
Injection Shield
Detects SQLi (union-based, blind boolean, blind time-based, error-based, stacked queries), XSS (reflected, stored, DOM-based), SSRF (internal IP, cloud metadata, DNS rebinding), command injection (shell metacharacters, backtick execution, $() substitution), template injection (Jinja2, Twig, Freemarker, Velocity), NoSQL injection (MongoDB operator injection, JavaScript execution), LDAP injection, path traversal, and Zip Slip archive traversal. Deserialization RCE detection for Java (ObjectInputStream), PHP (unserialize), .NET (BinaryFormatter), and Python pickle. All inputs pass through an 8-phase normalization pipeline: hex decoding, HTML entity resolution, backslash escape processing, null byte stripping, SQL comment removal, Unicode whitespace normalization, homoglyph mapping, and space collapsing. Canary token detection for AWS keys, GitHub tokens, Slack tokens, private keys, JWTs, and GCP service accounts. File sentinel monitors for suspicious writes, script drops, and webshell deployment.
Supply Chain Sentinel
SBOM generation and artifact integrity verification via cryptographic hash tracking. Typosquatting detection using Levenshtein distance scoring against known-good package registries (npm, PyPI, crates.io, Maven Central). Dependency confusion prevention by detecting private package name collisions with public registries. CI/CD pipeline hardening with anomalous action detection, unauthorized user flagging, and pipeline configuration drift monitoring. Known-malicious package signature matching. Build artifact provenance verification. Lockfile integrity checking to detect post-install tampering.
Ransomware Interceptor
Encryption pattern detection with configurable threshold (default: 5 files in rapid succession). Canary file monitoring with automatic deployment and instant alerting on access. Data exfiltration tracking via DNS tunneling, HTTP chunked transfer, and bulk upload detection. Wiper detection covering MBR/GPT overwrite, zero-fill disk operations, and partition table destruction. Shadow copy deletion monitoring (vssadmin, wmic, PowerShell). Backup destruction detection targeting backup agents, recovery partitions, and cloud backup APIs. Service stop sequence detection for security tools and backup services. Intermittent and partial encryption detection for evasion-aware ransomware. ESXi/hypervisor targeting detection (vim-cmd, esxcli patterns). Pre-ransomware credential harvesting correlation. Linux-specific ransomware patterns (chmod mass operations, /dev/urandom key generation). Compound attack chain correlation with MITRE ATT&CK mapping across all phases.
Auth Fortress
Brute force detection with per-IP and per-username lockout thresholds. Credential stuffing detection via unique credential pair velocity tracking. Password spray detection across distributed source IPs. Impossible travel detection using haversine distance calculation between login locations. Session hijack detection via user-agent fingerprint changes and concurrent session anomalies. MFA fatigue detection (rapid repeated push notifications) and MFA bypass tracking. OAuth token abuse monitoring including consent phishing, excessive scope requests, and suspicious redirect URIs. Adversary-in-the-middle (AitM) proxy detection via TLS fingerprint analysis and authentication relay patterns. Passkey/FIDO2/WebAuthn monitoring with auth downgrade detection (fallback from passkey to password). Stolen token reuse detection across geographic regions. Password spray correlation across time windows.
Deepfake Shield
Audio deepfake detection via prosodic analysis (spectral flatness, spectral entropy, zero-crossing rate, pitch variance), MFCC trajectory analysis for temporal consistency, phase coherence checks between frequency bands, and bitrate consistency scoring. Video forensics using frame-difference analysis to detect GAN artifacts, temporal inconsistency scoring across frame sequences, and error level analysis (ELA) for compression artifact detection. AI-generated phishing detection with writing style analysis, urgency scoring, and authority impersonation patterns. Expanded Unicode homoglyph detection covering Cyrillic, Greek, Armenian, and mathematical symbol lookalikes. Punycode domain spoofing detection. Business email compromise (BEC) pattern tracking with sender behavior baselining. High-value request verification for wire transfers, credential resets, and access grants triggered by voice or video.
Identity Fabric Monitor
Synthetic identity scoring using disposable email domain detection (1000+ known providers), name generation heuristic analysis (entropy, character distribution, common pattern matching), and high-entropy field detection across registration data. Privilege escalation tracking with role-change velocity monitoring and admin grant alerting outside change windows. Service account behavioral baselining with anomaly detection for dormant account reactivation, unusual access patterns, and off-hours activity. Identity lifecycle monitoring covering creation, modification, and deletion anomalies. Cross-system identity correlation to detect the same synthetic identity across multiple services.
LLM Firewall
Local rule-based analysis of supplied prompt, output, retrieval, and tool events. Includes prompt-injection patterns, selected jailbreak/encoding checks, sensitive-output indicators, session tracking, and structural inspection of supported multimodal content. Rule matches and citation-like patterns are heuristic signals, not verified factual accuracy or complete jailbreak coverage. Core checks do not require an external LLM classification request; they still consume local CPU and time. An application must supply the relevant inputs and enforce any release decision.
AI Agent Containment
Monitors supplied agent actions, tool definitions, goals, memory writes, delegation context, web fetches, and payment events. Includes a built-in blocked-tool/sensitive-target policy, MCP metadata poisoning/hash-change/name-collision checks, goal/action mismatch indicators, retry/loop tracking, and selected memory/session heuristics. It is not an OS sandbox or a configurable per-role tool allowlist. Trusted framework instrumentation is required. Alerts do not themselves stop tool calls or payments; actual enforcement needs an authorized executor or gateway. The vps-agent response preset requires careful review of targets, permissions, approval bypass, and recovery.
Data Poisoning Guard
Inspects supplied dataset changes, retrieval content, inference statistics, model-download metadata, and web-content integrity events. Includes hash/change tracking, RAG instruction-pattern checks, selected model-format/supply-chain indicators, and confidence-distribution drift analysis. These observations do not prove training-data truth, model-weight integrity in every format, or safe retrieval. No automatic vector-store repair or universal model-download block is implied. Integrations must emit the actual content and provenance and enforce any rejection decision.
Quantum-Ready Crypto
Cryptographic inventory scanning across your entire stack identifying every algorithm, key size, and cipher suite in use. PQC migration readiness scoring with per-component assessment against NIST post-quantum standards (ML-KEM, ML-DSA, SLH-DSA). TLS configuration auditing flagging deprecated versions (TLS 1.0/1.1), weak cipher suites, and missing forward secrecy. Certificate expiry monitoring with configurable warning thresholds. Weak cipher and key size detection (RSA < 2048, ECC < 256, 3DES, RC4, MD5, SHA-1). Harvest-now-decrypt-later (HNDL) detection identifying bulk encrypted traffic capture patterns targeting quantum-vulnerable key exchanges — attackers recording encrypted sessions today for decryption when quantum computers become available. Crypto-agility assessment scoring how quickly your infrastructure can rotate to new algorithms.
Runtime Watcher
File integrity monitoring with SHA-256 hash baselining and real-time change detection. Container escape detection via namespace breakout, privileged container abuse, and CVE-specific exploit patterns (runc, containerd). Privilege escalation detection covering setuid changes, capability modifications, and sudo abuse. 40+ LOLBin signatures with MITRE ATT&CK IDs (certutil, mshta, regsvr32, rundll32, wmic, bitsadmin, and more). Memory injection detection: process hollowing, DLL injection, reflective DLL loading, and thread injection. Persistence mechanism tracking across scheduled tasks, WMI event subscriptions, registry run keys, startup items, cron jobs, systemd services, and launchd plists. Firmware/UEFI tampering detection with secure boot validation and bootloader integrity checks. Fileless malware detection for PowerShell, WMI, and MSHTA execution chains. Symlink attack detection. ETW bypass monitoring. Lua shellcode detection patterns.
Cloud Posture Manager
Configuration drift detection with per-resource change tracking, security degradation scoring, and automatic baseline comparison. Misconfiguration scanning for public S3 buckets, open security groups, publicly accessible databases, overly permissive IAM policies, and unencrypted storage. Secrets sprawl detection scanning application logs, config files, environment variables, and git history for AWS keys, API tokens, database credentials, and private keys. Kubernetes RBAC auditing with excessive permission detection, cluster-admin binding alerts, and admission controller policy enforcement. Container posture checks for privileged containers, host network access, and missing security contexts. Multi-cloud policy evaluation against CIS benchmarks, SOC 2, HIPAA, and PCI-DSS frameworks with pass/fail scoring and remediation guidance. Infrastructure-as-code drift detection comparing deployed state against Terraform/CloudFormation definitions.
How It Works
Shared event bus
130+ canonical event types on a durable stream. Correlate threats across layers — a brute force that triggers a supply chain scan, automatically.
1sec stream tailAI is additive
Every module works standalone with zero AI dependency. The optional analysis engine adds cross-module correlation and threat classification on top.
1sec analyze --model claude-4.6-opusAutomated enforcement
Respond to threats in real-time. Block IPs, kill processes, fire webhooks — with dry-run mode, approval gates, and tunable presets from safe to strict.
1sec ban ip 192.168.1.*Collectors + archive
Built-in log tailers for nginx, auth, pfSense, and GitHub Actions. Every event archived to compressed NDJSON — restore any time range on demand.
1sec dump --since 24hCloud dashboard
Monitor your fleet from anywhere. Enforcement history, attack chain correlations, instance health — real-time dashboard with API-key access.
1sec dashboardBefore you deploy
- What is 1-SEC?
1-SEC is an open-source cybersecurity tool with 16 defense modules in a single Go binary. It analyzes connected telemetry and supports configurable incident response.
Explore the security guides- Do I need an account or a paid plan?
The local engine is free under AGPL-3.0 and needs no website login. Paid cloud features are optional and use API keys delivered after purchase, without a separate username and password.
Compare local and cloud features- How do I connect my own applications?
Use the built-in collectors or send canonical security events from your code to the local engine API with an engine write key. Engine keys and cloud dashboard keys serve different APIs; keep both private and use the least privilege your integration needs.
Connect through API keys or code- Does installing it automatically stop every attack?
No. Detection depends on the telemetry you connect. Blocking depends on enabled policies, supported actions and operating-system permissions. To deny a request before it runs, your application or tool runner must call an enforcement gate; an event received afterward cannot undo that request.
Understand response requirements and limits- Which platforms can run 1-SEC?
Release binaries are available for Linux, Windows and macOS on AMD64 and ARM64. Capabilities vary by platform and permissions. The optional Rust packet inspector has separate build requirements; portable release binaries do not include native packet capture.
Read the deployment requirements
Check the latest release and our editorial and evidence policy for implementation details and limitations.
Ship secure. Sleep well.
1-SEC is free and open source. Reach out about Enterprise — custom deployments, dedicated support, SLA guarantees, and team management at scale.
We respond within one business day.