All seven modules
Module 01 · Nerv-EDR · Endpoint
Endpoint Detection & Response
Enterprise-grade endpoint protection with 37 AI-powered detection modules in a single agent.
A lightweight agent monitoring every process, file, network connection and registry change on Windows, macOS and Linux. Behavioural AI, YARA scanning and deception technology, not signatures.
- 37
- Detection modules in one agent
- 3
- Operating systems, one codebase
- <10s
- AI triage on every alert
What it detects
- Process injection and hollowing
- Persistence: WMI, COM, IFEO, LaunchAgents
- Ransomware, canaries and shadow copy deletion
- Lateral movement: PsExec, SMB, pass-the-hash
- Credential theft: LSASS, browser stores, keychain
- Evasion: AMSI bypass, LOLBAS, PPID spoofing
- C2 beaconing, DNS tunnelling, C2 port use
- Exfiltration: cloud upload, USB, volume tracking
- Local vulnerability and hardening assessment
- Network segmentation validation
Where it separates
- 01Deception built in.
- Ransomware canary files and honeytoken credentials, SSH keys and API keys that raise critical alerts the moment an attacker touches them.
- 02AI triage as standard.
- Every alert is classified by NOVA in under ten seconds. Not a paid add-on module.
- 03Encrypted C2 detection.
- JA3 and JA4 TLS fingerprinting identifies Cobalt Strike, Sliver and Metasploit by handshake, without decryption.
- 04Anti-tamper and zero dependency.
- Standalone binary with self-protection. No Python or Java runtime on your endpoints.
Capability comparison8 capabilities
| Capability | Typical EDR vendors | Nerv-EDR |
|---|---|---|
| AI triage of every alert | Separate product | Built in |
| Ransomware canary files | Not native | Built in |
| Honeytoken deployment | Not native | Built in |
| JA3 / JA4 TLS fingerprinting | Sometimes | Built in |
| Network segmentation check | Not native | Built in |
| Endpoint hardening audit | Separate product | Built in |
| Windows, macOS and Linux | Often Windows + macOS | All three |
| Multi-tenant MSP console | Separate tier | Built in |
Capability summary of standard-tier inclusions across the endpoint market as at August 2026, prepared from publicly available product documentation. Packaging and licence tiers change frequently and vary by region and contract. This is not a statement about detection efficacy. Verify current inclusions with any vendor you are comparing.