Antivirus for business, with an append-only audit log and SIEM export.
For: IT teams of 5–500 people
What a business antivirus is usually asked for — and what we deliver on each point
Procurement requirements are predictable. The answer to each one has to be verifiable, not a slide promise.
Traceability: an append-only audit log with actions, actors and outcomes. It cannot be edited or deleted from the application; for compliance you export it periodically.
Access control: admin, analyst and viewer roles. Tokens are stored as SHA-256, never in clear text, and passwords use scrypt with a salt.
Integration: SIEM export over UDP or TCP, in JSON or syslog. Off by default — you enable it explicitly, with destination, protocol and format.
Resilience: the SIEM queue is bounded at 512 events. If the destination stops responding you lose old events, not process memory.
Offline operation: activation by file, with no outbound connection, for isolated networks and industrial environments.
Compliance: what the local DLP checks, with written thresholds
DLP policies run on the local file, with the bundled rule engine. There is no cloud classification service and no document is sent anywhere. Results show up in the dashboard as detections — DLP reports, it does not block business workflows.
GDPR: a threshold of 3 matches before reporting, so a single phone number does not raise an alert.
PCI-DSS: card numbers are validated with Luhn and marked critical only when they pass the check.
Secrets and keys: threshold 70, to cut the noise from configuration files.
HIPAA: threshold 62, on medical-data specific indicators.
Confidential documents: a separate category, disabled by default. Enable it only if you understand the noise volume.
Isolated networks, factories and offline environments
The package is fully offline: the runtime, the engines and the rules all live inside the installer. There is no step that needs the internet to complete.
Activation uses a file generated in the dashboard on a connected machine, then imported locally. The file is valid for a single device.
Intel packages are HMAC-SHA256 signed, with atomic staging and rename. Path traversal is explicitly rejected.
Signature updates are carried as files and imported locally. There is no “it fetches signatures from the server when it can”.
If the licence server does not respond, the product keeps running on the last confirmed licence with a 30-day grace period. Protection does not stop merely because a check could not reach the server.
The real cost, without “contact us for a quote”
One seat costs 3 EUR per year after the free first year. Prices are in EUR, VAT included, and billing goes through contact@malnox.com. There are no hidden volume tiers and no separate "enterprise" price for the same features.
One seat = one activated installation. It is not tied to hardware: move the licence to a new computer by deactivating the old device.
The first year is free for every new account, businesses included.
Licences activate online or offline, through an activation file.
What we are not, so you do not waste an evaluation
Honesty here costs us a few leads and saves us far more. If you need any of the following, Malnox is not the right choice today.
We are not an EDR with automated incident response. We do not automatically isolate a host from the network and we do not correlate attack chains across endpoints.
We are not MDR. There is no operations centre watching your alerts.
We do not yet have a multi-tenant central console for large fleets. Each installation has its own local console.
We do not have millions of signatures. We have 67 targeted YARA rules, our own signature engine and heuristics — plus an explainable verdict, which is useful in a different way than a big number on a slide.
Real-time protection watches Downloads, Desktop and Documents. For other volumes you start explicit scans or add paths in the configuration.
Frequently asked questions from IT teams
Yes, in the default configuration. We do not install a signed driver and we do not ask for global exclusions. Real-time protection is based on file write and close events, not on intercepting opens, which reduces conflicts with other resident products.
The verdict is explainable, so the conversation starts from information: you can see exactly which rule triggered the score, which engine contributed how much and what signature the file carries. If the rule is wrong you can exclude it narrowly — by hash or full path, never by file name.
Not yet. Each installation has its own local console, its own audit log and its own SIEM export. For small fleets that works; for large fleets, centralisation happens at the SIEM level, where the events arrive anyway. A multi-tenant console is on the list, not in the product.
The audit log is append-only at the application level: no edit or delete operation is exposed in the product. For evidence, export it periodically to SIEM — a copy in an external system with its own retention policies is exactly what an auditor asks for.
Yes: Windows Server 2019 or newer, alongside Windows 10 version 1809+ and Windows 11. Requirements: 4 GB RAM, 400 MB free space. The runtime is bundled.
Yes. You generate the activation file in the dashboard on a connected machine, copy it to the isolated machine and import it into the product. The result is identical to online activation, with no outbound connection.
Email support within 24 hours at support@malnox.com, plus security@malnox.com for vulnerability reports. We have no 24/7 phone line and we do not pretend to run a SOC.
Useful next steps
Try it on a file you already have.
The installer is 177 MB and asks for no account. Not convinced? Check a link above — the web engine is already running on this page.