Update trust
Definition packs and agent binaries are still widely signed with RSA or ECDSA. After a cryptographically relevant quantum computer, a stolen or reconstructed vendor key is a silent fleet-wide implant path.
Frontier · QUANTOM DOM · AEGIS-Q architecture
A new frontier is not a higher score.
Classical EDR is good at watching a host. It is not built for a world where the signatures that bind updates, telemetry, and vendor identity become forgeable. QUANTOM DOM on AEGIS-Q treats that as the product problem — sovereign post-quantum EDR/XDR — and refuses to invent CrowdStrike or AV-Comparatives numbers to dress it up.
The break
What classical EDR still assumes.
Telemetry identity
The console believes a host because a classical certificate — and a standing vendor account — said so. Forged agents, replayed heartbeats, and lookalike tenants become cheaper as those primitives age.
Cloud as cerebellum
Too many verdicts wait on a reputation API. Pull the cable — or the vendor region — and the endpoint becomes a watcher that cannot decide.
Evidence as a PDF
Incident exports live in a ticket system the operator also controls. That is operations, not integrity. A later dispute has nothing independent to check.
The substitution
What AEGIS-Q changes.
We do not claim to have retired process telemetry, YARA, behavioral graphs, or the unglamorous work of an AV engine. We claim a different frontier: AEGIS-Q — sovereign post-quantum EDR/XDR. Enrollment is an accountless one-time TRELYAN activation. Evidence is an Algorand nullifier plus a QRL Merkle inclusion, not a ticket PDF. Agents remain autonomous when isolated.
- Accountless one-time TRELYAN activation — no standing vendor account to phish, clone, or subpoena as the source of truth.
- Dual-rail integrity — Algorand nullifier (Falcon-1024 via TRELYAN) and QRL Merkle evidence. Construction.
- Air-gap autonomy — signed packs, local verdicts, queued evidence. Isolation is first-class.
- Honest scoring — no trophy wall until a named evaluation exists.
Claims matrix
Said without euphemism.
| Claim | Status |
|---|---|
| Classical on-access / on-demand AV capabilities as a product category | In build · waitlist |
| AEGIS-Q as sovereign post-quantum EDR/XDR architecture | Specified · product pre-GA |
| Accountless one-time TRELYAN activation | Specified · not generally available |
| Dual-rail evidence (Algorand nullifier + QRL Merkle) | Specified · Foundation Falcon path TestNet-verified, unaudited |
| Air-gap autonomy as a supported mode | Design commitment · kits not generally available |
| AV-Comparatives, SE Labs, MITRE ATT&CK, or CrowdStrike bake-off scores | Not claimed · no such reports exist |
| Replacement for offline backups or immutable storage | Not claimed |
| Independent product audit of the agent | Not yet |
| FIPS 206 (FN-DSA) final-standard compliance for Falcon | Not claimed · FIPS 206 is in development |