M A L P H A S

On-device antivirus for Windows. A local AI judges every file and process in ~2 ms — nothing is sent to the cloud.

Runs where you can't see it.
Answers to no one.

↓ DOWNLOAD ENTERPRISE
PROCESSES JUDGED 0
VERDICT LATENCY 1.8ms
CLOUD CALLS 0

MLP-01 // WHAT IT IS

It runs where you can't see it.

Malphas is antivirus for Windows that runs entirely on your own machine. Every file, download and program is checked by a local AI the instant it appears — and a verdict comes back in under two milliseconds, without ever contacting a server.

Ordinary antivirus ships your files to its cloud to decide if they're safe. Malphas doesn't. The judgment happens here — then it stays here.

  • WHERE IT DECIDESON YOUR PC
  • DATA SENT OUTNONE
  • WHEN OFFLINESTILL ARMED
NOTHING LEAVES THIS MACHINE

MLP-02 // HOW IT WORKS

Three steps. No internet required.

  1. 01

    It watches

    The moment a file lands or a program starts, Malphas catches it — down at the Windows kernel, before it gets to run.

  2. 02

    It decides, on your PC

    A local AI reads it and returns a verdict in about two milliseconds. No upload, no account, no waiting on a server.

  3. 03

    It contains & explains

    Anything dangerous is blocked — or detonated inside a sealed sandbox — and you get a plain-English reason why.

// BY THE NUMBERS
VERDICT 0.0ms Time from spawn to verdict, on-device.
DETECTION · AUC 0.0000 How cleanly it tells malware from safe files — 1.0 is perfect.
FALSE POSITIVE 0.0% Clean processes flagged. None.
CLOUD CALLS 0 Requests that ever leave the machine.

MLP-03 // ON-DEVICE AI · NO CLOUD IN THE LOOP

The models run on your machine.

This is the part people don't expect: the AI itself lives on your PC. Three small models split the work — one decides, one reads text, one explains — and none of them ever phone home.

THE DECIDER

LightGBM

Looks at a file's structure and calls it malware or safe — the main verdict. A gradient-boosted model trained on a huge malware dataset.

  • TRAINED ON2,381 EMBER
  • ACCURACY (AUC)0.9938
  • VERDICT~1.8 ms

THE READER

DistilBERTINT8

Reads the text of links and pages to catch phishing — but only when the decider is unsure, so it never slows down the obvious cases.

  • SIZE ON DISK67 MB
  • SPEED~9 ms
  • WHEN IT RUNSONLY IF UNSURE

THE EXPLAINER

Gemma 4E2B

Writes the plain-English reason a file was flagged. It only narrates — it's never allowed to overturn the verdict.

  • RUNS LOCALLY3.1 GB
  • ROLEEXPLAIN ONLY
  • CAN OVERRULENEVER

HOW A THREAT IS JUDGED — FASTEST CHECK FIRST

  1. CAUGHT AT THE WIREtraffic intercepted inside the Windows kernelKERNEL
  2. KNOWN-GOOD? SKIPtrusted files wave straight through<1 µs
  3. QUICK CHECKSfast rules catch the obvious tricks<1 ms
  4. THE AI DECIDESthe gradient-boosted classifier weighs in<3 ms
  5. ONLY IF UNSUREthe text model double-checks the gray area<20 ms
  6. VERDICTsafe or threat — with a reasonINSTANT
  7. THE "WHY"the local LLM writes the explanation afterASYNC

MLP-04 // DETECTION · CATCH IT IN THE ACT

Caught before it ran.

Here's a real threat moving through Malphas, one stage at a time — inspected, judged, boxed in, then explained. Scroll to walk it through.

01 STATIC ANALYSIS

The file is dissected without running it — headers, imports, entropy, section layout.

  • 2,381 EMBER FEATURES
  • PACKED · ENTROPY 7.9
  • IMPORTS: 4 SUSPECT
02 LIGHTGBM VERDICT
  • LightGBM · GRADIENT-BOOSTED
  • CONFIDENCE 0.994
  • 1.8ms · FULLY LOCAL
03 SANDBOX DETONATION
  • RUN IT IN A SEALED SANDBOX
  • MEMORY: COPY-ON-WRITE
  • NOTHING TOUCHES THE HOST
04 GEMMA EXPLAINS

Posed as a system process, tried to inject, persist, and call out. Caught before it ran.

LightGBM decides · Gemma only explains · it can never downgrade a verdict

NEUTRALIZED

MLP-05 // DEFENSE · FOUR FRONTS

Four ways in. All of them watched.

An attack can arrive as a file, a running program, a network connection, or a foothold deep in Windows. Malphas covers all four — here's what each front does.

FILES & DOWNLOADS

Scanned the momentthey land.

Every download and new file is checked before you can open it — run past the on-device AI in a couple of milliseconds. Bad ones never get a first run.

  • CHECKSDOWNLOADS + FILES
  • VERDICTSUB-2ms
  • FALSE ALARMSNEAR-ZERO
clf

EXECUTION

Detonate itwhere it can't reach.

Anything suspicious is run inside a sealed sandbox. It thinks it's on your real system — but it can't touch it. If it's hostile, it goes off harmlessly, while Malphas watches what it tries to do.

  • RUNS INA SANDBOX
  • MEMORYCOPY-ON-WRITE
  • REACHES HOSTNEVER

NETWORK

The connection diesbefore the app loads it.

Malphas reads network traffic as it happens and judges it on your machine. Known-dangerous sites are quietly blocked — allow-list first, and it fails open, so a mistake never cuts off your internet.

  • READSLIVE TRAFFIC
  • JUDGEDON-DEVICE
  • BAD SITESBLOCKED
  • ON ERRORFAILS OPEN

SYSTEM & KERNEL

Rooted deep.Almost none of it privileged.

Malphas watches from inside Windows itself, but keeps almost nothing running with full system power — only a tiny 22 KB helper. Less privileged code means less for an attacker to hijack.

  • WATCHESKERNEL EVENTS
  • STARTSAT BOOT
  • RUNS AS SYSTEM22 KB ONLY
SYSTEM · 22KB

MLP-06 // LOCAL vs CLOUD

Your security shouldn't depend on someone else's cloud staying up.

Same job, two places to do it. A cloud antivirus sends your files off to a server to decide; Malphas decides on your machine. Here's what that changes.

  CLOUD AV MALPHAS
VERDICT PATH round-trip to a datacenter ✓ on your machine
LATENCY 50–300 ms + network ✓ 1.8 ms, on-device
YOUR DATA uploaded as telemetry ✓ 0 bytes ever leave
IF THE CLOUD IS DOWN you are unprotected ✓ still fully armed, offline
CLOUD ROUND-TRIP ~50–300 ms
MALPHAS VERDICT 1.8 ms

MLP-07 // FLEET · MALPHAS ENTERPRISE

One machine is a laptop. A thousand needs a warden.

The free version protects one machine. Enterprise adds a single console to see and manage every endpoint in an organisation — with the audit trail and signed updates a security team needs.

ADMIN DASHBOARD real asset pending · /assets/dashboard.* · never fabricated
ONE CONSOLE · EVERY ENDPOINT

MLP-08 // DOWNLOAD

Two doors.

Same engine underneath. One machine, or the whole fleet.

MLP // MALPHAS

For your machine. Free. Private.

  • Full local detection engine
  • Download scanner + own-execution sandbox
  • On-device AI verdict & explanation
↓ DOWNLOAD
  • VERSIONv1.0.0
  • SIZE18.4 MB
  • SHA-256a1f0…9c2e
  • REQUIRESWINDOWS x64

TODO: real binary URL

MLP // ENTERPRISE

For the fleet. Admin server included.

  • Everything in Malphas
  • One console, every endpoint
  • Fleet RBAC · audit log · signed updates
↓ DOWNLOAD
  • VERSIONv1.0.0
  • SIZE64.2 MB
  • SHA-2567b3d…41af
  • REQUIRESWIN SERVER 2019+

TODO: real binary URL

WINDOWS x64 · NO ACCOUNT · TELEMETRY OFF BY DEFAULT