The kernel is the most trusted code on your machine. Civilium is the first thing that doesn’t trust it.
A drop-in monitor that late-launches at EL2 — beneath an unmodified, already-running Linux kernel. It watches every write to protected kernel memory, and the instant an attacker with root tampers, the write is denied and recorded on a layer they can’t reach.
The kernel can’t watch itself. Civilium watches it from below — and records what it catches.
Why now
The industry is moving security out of the kernel. We’re already below it.
18
syscalls silently hooked by PUMAKIT, an in-the-wild Linux kernel rootkit (Dec 2024) that rewrites kernel structures to hide and persist — with 0 antivirus detections at upload. Rewriting the read-only kernel memory the OS trusts is exactly the tampering Civilium locks out, below the kernel where a rooted OS can’t reach.
Elastic Security Labs, 2024 sourced
120K+
AWS customers now run on Graviton — ARM has gone mainstream in the datacenter. ARM64 is our first target; the same primitive exists on x86.
AWS Graviton sourced
3
trillion-dollar platforms already built below-kernel integrity — Microsoft HVCI, Samsung RKP, Android pKVM — and locked each to their own OS. None serves general, unmodified Linux. That gap is the opening.
Category analysis · see the moat framing
How it works
Move the watcher below the kernel — then freeze what matters.
Civilium uses the CPU’s own hardware, not a patch to your kernel. Nothing inside EL1 can revoke it.
Late-launch to EL2
A kernel module installs EL2 vectors on every CPU and hands off to a tiny bare-metal monitor — under a system that is already running. No reboot. No new OS.
Stage-2 write-protection
Using the CPU’s second layer of translation, it locks the kernel’s trusted read-only structures at a layer the kernel itself can’t unlock — .rodata, the syscall table, LSM hooks, ro_after_init data — keyed on the physical page, so an aliased write can’t sneak past.
Tamper-evident record
Full root can still try to write; the hardware traps it to Civilium instead. Every blocked write becomes a forensic record kept below the kernel, where the compromised system can’t erase it.
A real attack, caught
Same rootkit. Run twice.
A rootkit hooks the syscall table to hand an ordinary user root. Without Civilium it works. With Civilium the identical write faults at EL2 — and lands on the record.
Without Civilium
$ ./trigger uid before: 1000 uid after: 0
root shell — system owned
With Civilium (protect_mask=2, sealed)
$ ./trigger uid before: 1000 uid after: 1000
write denied — escalation prevented
/proc/hvmon/log
ts=483309317582 cpu=1 ipa=0x54a70e50 esr=0x93d4804f region=1 action=DENY
ESR decodes to EC=0x24 data abort · WnR=1 write · DFSC=0x0f stage-2 permission fault.
The write to sys_call_table never landed; uid stayed 1000. Verified end-to-end and reproducible in the QEMU/TCG guest. sourced
Assume breach
We don’t stop the break-in. We make sure it can’t hide.
The honesty is the point — it’s what a technical evaluator trusts. Here is exactly where the line sits today, and where the roadmap takes it.
What Civilium does today
- Freezes kernel code & critical tables read-only from EL2.
- Traps & denies any write to them — even from full root.
- Records every attempt on a log the kernel can’t reach.
- Seals irreversibly: once sealed, EL1 has no path to weaken it.
What it doesn’t — yet
- Stop the initial memory-corruption bug from firing — it acts on the kernel tampering that follows, not the bug itself. by design
- Detect a use-after-free or heap corruption as it happens. roadmap · MTE
- Guard writable
.dataand device DMA. roadmap · allow-list + SMMU - Cover x86/64. roadmap · VT-x/EPT
- Replace your EDR — it sits below and beside it. by design
Why us
Everyone else is captive, or inside the kernel.
The technique is proven — Samsung, Microsoft and Google each built it, each locked to their own platform. The independents run at EL1, the same privilege as the rootkit they hunt. One quadrant is empty.
| Approach | Runs at | Blocks the write | Unmodified Linux | Edge |
|---|---|---|---|---|
| LKRG · eBPF · Falco | EL1 · in-kernel | detects | ✓ | Same privilege as the attacker — falls with the kernel it lives in. |
| HVCI · RKP · pKVM | EL2 · captive | ✓ | ✗ | Real below-kernel integrity — but only on Windows, Samsung, or Android. |
| Invary | attestation | ✗ | ✓ | Detects drift and reports it; it doesn’t enforce or stop the write. |
| Civilium | EL2 · retrofit | ✓ | ✓ | Below-kernel enforcement on general, already-running ARM64 Linux — no new OS, no vendor lock. The empty quadrant. |
Who it’s for
Fleets where a kernel compromise is a safety event.
Automotive
Linux domain-controllers under a runtime-integrity mandate (UN R155 / ISO 21434). A kernel compromise here is physical-safety, and the operator owns the boot chain. Our beachhead.
Medical devices
Linux-based diagnostic, imaging and connected clinical systems where a silently altered kernel is a patient-safety and compliance event (FDA cybersecurity, IEC 62304) — and the manufacturer owns the boot chain.
Defense & autonomy
Robotics and autonomous platforms where mission integrity depends on a kernel nothing has silently rewritten — and where below-kernel evidence matters after the fact.
Regulated fleets
On-prem and edge ARM64 servers that need a below-kernel integrity guarantee their EDR — living inside the kernel — structurally cannot give them.
The stakes
The blast radius is measured in the billions.
Ransomware, rootkits and post-exploitation kernel tampering are a multi-industry, multi-billion-dollar loss. Civilium doesn’t stop the intrusion — it makes the kernel tampering that turns an intrusion into a catastrophe fail, and get recorded.
$13.82T
projected annual global cost of cybercrime by 2028, up from $9.22T in 2024. The macro tide every industry is now bailing against.
Statista Market Insights sourced
$275B
projected annual ransomware damages by 2031, from ~$20B in 2021. Ransomware routinely kills defenses and persists inside the kernel — the step Civilium denies.
Cybersecurity Ventures sourced
$9.77M
average cost of a healthcare data breach in 2024 — the costliest industry, 14 years running. The fleets now shipping Linux medical devices.
IBM Cost of a Data Breach 2024 sourced
$4.88M
average cost of a data breach across all industries in 2024 — an all-time high, up 10% year over year.
IBM Cost of a Data Breach 2024 sourced
These are industry stakes — the cost of the compromise Civilium makes tamper-evident — not our addressable market. The bottom-up sizing, tagged and sourced, is in the technical brief.
Evaluate it on your hardware.
We’re opening a small number of design-partner slots for teams running ARM64 fleets — automotive, medical, defense — where kernel integrity is a safety or mission concern. If that’s you, request access and we’ll set up a technical evaluation.
No spam, no list. Goes straight to the founders. We’ll reply personally.