Sandfly Security
Agentless Linux endpoint detection and response that investigates hosts over SSH without installing software on monitored systems.
Visit Website ↗ + Add to Compare Claim This CompanyOverview
Sandfly Security, founded in 2017 and based in Christchurch, New Zealand, makes agentless endpoint detection for Linux. Instead of deploying a kernel module or resident agent, the platform connects to hosts over SSH and runs investigative checks for compromise indicators, including hidden processes, rootkit behavior, persistence mechanisms and suspicious user activity.
Because nothing is installed on the target, it can cover appliances, embedded devices, legacy servers and air-gapped networks where agents are impractical or risky for stability. The software runs inside the customer’s own environment and does not require internet connectivity. A free tier and commercial licensing are offered.
In 2026 the company announced a Carahsoft partnership for public-sector sales and an Ericsson collaboration on an agentless EDR offering for telecom Linux environments.
Innovation Matrix Assessment
Agentless SSH-based investigation is a distinct architecture for Linux compromise detection rather than a copy of agent-based EDR.
Removes agent deployment and stability risk on fragile, embedded or air-gapped Linux systems where agent EDR is hard to run.
A Carahsoft government distribution deal and an Ericsson collaboration (2026) show partner traction, but disclosed funding and customer counts are minimal.
Challenges the assumption that Linux detection requires a resident agent or kernel module.
Public SANS ISC coverage exists, but named incident detections and independent test results are limited in what we found.
Linux and cloud workloads, appliances and telecom infrastructure remain heavily targeted and hard to instrument.
Why CISOs Should Care
Covers Linux fleets and appliances that cannot take an EDR agent, without adding a new attack surface or availability risk.
What Makes It Different
Detection is performed remotely over SSH on demand with no persistent software on the target.
The Matrix Verdict
63/100 — INCREMENTAL INNOVATOR
Sandfly scores as an Incremental Innovator at the upper end: a genuinely different agentless architecture for a hard problem, held back by small scale and limited independent efficacy evidence.
Editorial Note: Claims vs. Verified Findings
Capability descriptions come from the vendor; partnership announcements (Carahsoft, Ericsson) are third-party-visible but detection performance claims were not independently verified. CB Insights funding data appears incomplete.
Sources
Alternatives to Sandfly Security
Abnormal AI
AI-native behavioral security platform that analyzes sender identity and communication patterns, rather than message content alone, to stop…
7AI
7AI, founded by Cybereason's former CEO and CTO, deploys autonomous AI agents that triage, investigate, and correlate security…
Palo Alto Networks Cortex XSIAM
Palo Alto Networks' AI-driven 'autonomous SOC' platform that unifies SIEM, EDR, SOAR, and attack-surface data into a single…
Fenix24
Chattanooga-based ransomware recovery specialist that has restored operations after 500+ real-world incidents, including 30 Fortune 500 companies.
Sevii
CISO ReviewedAgentic AI platform positioning itself around autonomous threat elimination rather than alerting, using AI agents to investigate and…
Torq
AI-native hyperautomation platform positioning itself as an 'agentic SOC,' using a multi-agent system to autonomously execute large volumes…