M A L P H A S

On-device antivirus for Windows. A local AI scores every file and process on your machine — the model's verdict in a fraction of a millisecond, nothing sent to the cloud.

Runs where you can't see it.
Answers to no one.

↓ DOWNLOAD ENTERPRISE
AI INFERENCE 0.15ms
FILE → VERDICT ~60ms
CLOUD CALLS 0

Timings as tested on recommended hardware specs.

MLP-01 // WHAT IT IS

It runs where you can't see it.

Malphas is antivirus for Windows that runs entirely on your own machine. Every file, download and program is checked by a local AI the instant it appears — the model's call takes well under a millisecond, a full file scan about sixty, and none of it ever contacts a server.

Timings as tested on recommended hardware specs.

Ordinary antivirus ships your files to its cloud to decide if they're safe. Malphas doesn't. The judgment happens here — then it stays here.

  • WHERE IT DECIDESON YOUR PC
  • YOUR FILES SENT OUTNONE
  • WHEN OFFLINESTILL ARMED
NOTHING LEAVES THIS MACHINE

MLP-02 // HOW IT WORKS

Three steps. No internet required.

  1. 01

    It watches

    The moment a file lands or a program starts, Malphas catches it — down at the Windows kernel, before it gets to run.

  2. 02

    It decides, on your PC

    A local AI reads it and decides on your PC — a fraction of a millisecond for the model's call, tens of milliseconds for a full file scan. No upload, no account, no server.

  3. 03

    It contains & explains

    Anything dangerous is blocked — or detonated inside a sealed sandbox — and you get a plain-English reason why.

Timings as tested on recommended hardware specs.

// BY THE NUMBERS
AI INFERENCE 0.00ms The model's own decision, once a file's features are extracted. Full file → verdict is ~60 ms.
DETECTION · AUC 0.0000 How cleanly the 2,381-feature model tells malware from safe files — 1.0 is perfect.
FALSE POSITIVES 0/ 183 Zero false alarms across 183 clean Windows binaries we tested (model holdout ≈ 2%).
CLOUD CALLS 0 Requests on the verdict path that leave your machine.
Timings as tested on recommended hardware specs — AMD Ryzen 7 8700G · 32 GB · Windows 11 · on-device, no GPU · 2026-07-12

MLP-03 // ON-DEVICE AI · NO CLOUD IN THE LOOP

The models run on your machine.

This is the part people don't expect: the AI itself lives on your PC. Three small models split the work — one decides, one reads text, one explains — and none of them ever phone home.

THE DECIDER

LightGBM

Looks at a file's structure and calls it malware or safe — the main verdict. A gradient-boosted model trained on a huge malware dataset.

  • TRAINED ON2,381 EMBER
  • ACCURACY (AUC)0.9961
  • INFERENCE~0.15 ms

THE READER

DistilBERTINT8

Reads the text of links and pages to catch phishing — but only when the decider is unsure, so it never slows down the obvious cases.

  • SIZE ON DISK67 MB
  • SPEED~15 ms
  • WHEN IT RUNSONLY IF UNSURE

THE EXPLAINER

Gemma 4E2B

Writes the plain-English reason a file was flagged. It only narrates — it's never allowed to overturn the verdict.

  • RUNS LOCALLY3.1 GB
  • ROLEEXPLAIN ONLY
  • CAN OVERRULENEVER

HOW A THREAT IS JUDGED — FASTEST CHECK FIRST

  1. CAUGHT AT THE WIREtraffic intercepted inside the Windows kernelKERNEL
  2. QUICK CHECKSfast rules catch the obvious tricks<1 ms
  3. THE AI DECIDESthe gradient-boosted classifier weighs in<3 ms
  4. ONLY IF UNSUREthe text model double-checks the gray area<20 ms
  5. VERDICTsafe or threat — with a reasonINSTANT
  6. THE "WHY"the local LLM writes the explanation afterASYNC

Timings as tested on recommended hardware specs.

MLP-04 // DETECTION · CATCH IT IN THE ACT

Caught before it ran.

Here's how a threat moves through Malphas, stage by stage — inspected, judged, boxed in, then explained. An illustrative walkthrough; scroll to step through it.

01 STATIC ANALYSIS

The file is dissected without running it — headers, imports, entropy, section layout.

  • 2,381 EMBER FEATURES
  • PACKED · ENTROPY 7.9
  • IMPORTS: 4 SUSPECT
02 LIGHTGBM VERDICT
  • LightGBM · GRADIENT-BOOSTED
  • CONFIDENCE 0.994 · EXAMPLE
  • ~0.15ms · FULLY LOCAL
03 SANDBOX DETONATION
  • RUN IT IN A SEALED SANDBOX
  • MEMORY: COPY-ON-WRITE
  • NOTHING TOUCHES THE HOST
04 GEMMA EXPLAINS

Posed as a system process, tried to inject, persist, and call out. Caught before it ran.

LightGBM decides · Gemma only explains · it can never downgrade a verdict

NEUTRALIZED

Timings as tested on recommended hardware specs.

MLP-05 // DEFENSE · FOUR FRONTS

Four ways in. All of them watched.

An attack can arrive as a file, a running program, a network connection, or a foothold deep in Windows. Malphas covers all four — here's what each front does.

FILES & DOWNLOADS

Scanned the momentthey land.

Every download and new file is checked before you can open it — scored by the on-device AI in a fraction of a millisecond. Bad ones never get a first run.

  • CHECKSDOWNLOADS + FILES
  • AI CALL~0.15ms
  • FALSE ALARMS0 / 183 TESTED

Timings as tested on recommended hardware specs.

clf

EXECUTION

Detonate itwhere it can't reach.

Anything suspicious is run inside a sealed sandbox. It thinks it's on your real system — but it can't touch it. If it's hostile, it goes off harmlessly, while Malphas watches what it tries to do.

  • RUNS INA SANDBOX
  • MEMORYCOPY-ON-WRITE
  • REACHES HOSTNEVER

NETWORK

The connection diesbefore the app loads it.

Malphas reads network traffic as it happens and judges it on your machine. Known-dangerous sites are quietly blocked — allow-list first, and it fails open, so a mistake never cuts off your internet.

  • READSLIVE TRAFFIC
  • JUDGEDON-DEVICE
  • BAD SITESBLOCKED
  • ON ERRORFAILS OPEN

SYSTEM & KERNEL

Rooted deep.Almost none of it privileged.

Malphas watches from inside Windows itself, but keeps almost nothing running with full system power — only a tiny 28 KB helper. Less privileged code means less for an attacker to hijack.

  • WATCHESKERNEL EVENTS
  • STARTSAT BOOT
  • RUNS AS SYSTEM28 KB ONLY
SYSTEM · 22KB

MLP-06 // LOCAL vs CLOUD

Your security shouldn't depend on someone else's cloud staying up.

Same job, two places to do it. A cloud antivirus sends your files off to a server to decide; Malphas decides on your machine. Here's what that changes.

  CLOUD AV MALPHAS
VERDICT PATH round-trip to a datacenter ✓ on your machine
LATENCY 50–300 ms round-trip ✓ ~60 ms local scan, no network
YOUR DATA uploaded as telemetry ✓ your files never leave
IF THE CLOUD IS DOWN you are unprotected ✓ still fully armed, offline
TYPICAL CLOUD ROUND-TRIP ~50–300 ms
MALPHAS · LOCAL SCAN ~60 ms

Timings as tested on recommended hardware specs.

MLP-07 // FLEET · MALPHAS ENTERPRISE

One machine is a laptop. A thousand needs a warden.

The free version protects one machine. Enterprise adds a single console to see and manage every endpoint in an organisation — with the audit trail and signed updates a security team needs.

ADMIN DASHBOARD console preview coming soon
ONE CONSOLE · EVERY ENDPOINT

MLP-08 // DOWNLOAD

Two doors.

Same engine underneath. One machine, or the whole fleet.

MLP // MALPHAS

For your machine. Free. Private.

  • Full local detection engine
  • Download scanner + own-execution sandbox
  • On-device AI verdict & explanation
Coming soon
  • VERSIONv1.0.0
  • SIZE~4.2 GB
  • SHA-256at release
  • REQUIRESWINDOWS x64

Ships with the on-device AI models — that's why it's a big download, and why it never needs the cloud.

MLP // ENTERPRISE

For the fleet. Admin server included.

  • Everything in Malphas
  • One console, every endpoint
  • Fleet RBAC · audit log · signed updates
Coming soon
  • VERSIONv1.0.0
  • SIZE~4.2 GB
  • SHA-256at release
  • REQUIRESWIN SERVER 2019+

Everything in Malphas, plus the fleet console — models included, no cloud dependency.

WINDOWS x64 · NO ACCOUNT · TELEMETRY OFF BY DEFAULT