Civilium

Thesis

The insight

The winning defense already exists. It just can’t be bought for Linux.

Three trillion-dollar platforms independently concluded that the only durable way to stop a kernel-level attacker is to watch the kernel from below it — and each locked that capability to their own OS:

Meanwhile the threat is live and industrializing on Linux: in-the-wild kernel rootkits that hook 18 syscalls with zero AV detection (PUMAKIT) and hook kill() and hide processes (Krasue), and purpose-built “EDR-killers” whose whole job is to switch defenses off from the inside. The defenders who could stop this either run inside the kernel or watch only their own OS.

The opening: general-purpose ARM64 Linux — the surface AWS says 120,000+ customers already run on Graviton, and the one under safety and compliance mandates in vehicles, medical devices and defense — has no below-kernel integrity layer, and no incumbent has the incentive to build one for it.

What’s built

A working monitor, not a slide.

Civilium late-launches into EL2 under a running, unmodified ARM64 Linux kernel and write-protects the kernel’s critical structures at stage-2 — a layer the kernel can’t reach to undo. Each attack below was run in-guest against the real monitor; the write is denied and recorded. Watch the live demo →

• verified Syscall-table hooking — the canonical rootkit primitive; the write to sys_call_table is denied at EL2.
• verified LSM hook tampering — nulling AppArmor/SELinux/Yama callbacks (security_hook_heads) is blocked.
• verified Code injection / ret2usr — an EL1 jump into an attacker page faults at stage-2 (PXN).
• verified IOMMU control-plane — root can’t disable, repoint or bypass the SMMU to open a DMA path.
• verified Self-defense — the monitor refuses unload and its seal is irreversible; the forensic log can’t be silenced.

Running today on a cycle-accurate model of the ARM silicon (QEMU). The same binary targets real EL2; silicon bring-up is the first milestone of the raise, not a research question. Full transcripts ship in the repo’s DEMO_EVIDENCE.md.

Market

A large, growing budget — entered through a slice we can defend.

Runtime security is already a multi-billion-dollar, double-digit-growth budget. These adjacent markets are context, not our serviceable market — presenting them as SAM is exactly what loses a technical partner.

Same drop-in monitor across every segment. ARM64 today; x86/64 (via the equivalent VT-x/EPT primitive) is roadmap, not shipped.

Competitive teardown

Everyone is captive, inside the kernel, or only watching.

The category splits cleanly. The players who enforce from below the kernel are locked to one OS; the OS-independent ones either run at kernel privilege (the same level as the rootkit) or only detect after the fact. One cell is empty.

Why the incumbents won’t close it. HVCI, RKP and pKVM are each strategic moats for someone else’s platform — Microsoft, Samsung and Google have no incentive to protect general Linux. The OS-independent players are structurally weaker: LKRG shares the kernel’s privilege, Invary detects rather than prevents, and the secure-OS vendors require ripping out the kernel you already run. The durable moat is coverage + retrofit: enforcement, below the kernel, on the Linux you already run — the one combination no incumbent serves.

Business model

Integrity as a line item on the safety-critical bill of materials.

Software margins; a design-win that pays an eval fee, converts to a license or royalty, and renews for the platform lifetime. Expansion is the same monitor moving from the safety-critical beachhead into the operator’s broader fleet.

Go-to-market

Land where the kernel is a safety problem, then expand.

1. 1Land — design-win motion. Target ARM64 Linux fleets where a kernel compromise is a physical-safety or mission event and the operator controls the boot chain (automotive domain controllers, medical devices, defense & autonomy). A paid eval proves the block on their hardware.
2. 2Convert — production license/royalty. The eval becomes a per-node license or a per-unit royalty at start-of-production, on a platform that renews for years.
3. 3Expand — the same monitor, the wider fleet. From the safety-critical beachhead into the operator’s cloud, edge and enterprise Linux — where hyperscalers can build their own, so we expand, not enter.

Defense is a live, funded lane. The DoD is already paying for runtime assurance: USAF SBIR Phase II awards of ~$985K and ~$1.0M under a single runtime-assurance topic (AF221-0024, 2024) — a non-dilutive procurement door into exactly the buyers who own their boot chain and cannot use a captive-OS solution.

The forcing function

Regulation is putting integrity budget on a known clock.

The beachhead isn’t just high-consequence — it’s increasingly mandatory. Runtime and update integrity are moving from best-practice to type-approval requirement.

• UN R155 / R156Vehicle cyber-security management (CSMS) and software-update management (SUMS) systems, mandated by the EU within its type-approval framework by 2022. UK Gov (DfT) sourced
• ISO/SAE 21434Road vehicles — cybersecurity engineering, the standard that makes automotive security a lifecycle engineering obligation. ISO catalogue sourced
• EU CRA · 2027Cyber Resilience Act (Reg. (EU) 2024/2847) — horizontal security obligations for “products with digital elements,” in force since Dec 2024, applying ~Dec 2027. European Parliament sourced
• DoD SBIRUSAF is funding runtime assurance for autonomy at ~$1M/award (topic AF221-0024) — public money already flowing to the problem. SBIR.gov sourced

Comparable outcomes

Real capital, real buyers, honest ceiling.

Low-level and runtime-integrity security is a category defense primes, sovereign funds and platform vendors actively buy. The track record is strategic acquisition, not IPO — and we size the ambition to that.

The buyers are defense primes (Mercury), platform vendors (HP), and MoD-backed funds — the same institutions that own the boot chains Civilium protects.

Roadmap & use of funds

What the raise buys.

The mechanism is proven in emulation. The next 12–18 months turn a verified prototype into a deployable product and a first paying design win.

1. SiliconBring-up on real ARM hardware. Move off the QEMU model onto a physical ARM64 board — the primitive is standard ARMv8 EL2; this is engineering, not research.
2. Design winFirst paid evaluation. Prove the block on a partner’s kernel and hardware in a safety-critical vertical, and convert to a production agreement.
3. CoveragePage-keyed DMA + hardening. Extend from IOMMU control-plane to per-page DMA protection, and close the known scope gaps.
4. Reachx86 port + compliance path. The equivalent VT-x/EPT primitive for x86 fleets, and the certification groundwork the regulated buyers require.

Risks & mitigations

What could go wrong, and why we still win.