Strict limits on every request
Short timeouts, capped connections, health checks, and a last known-good configuration to fall back on. If something misbehaves, traffic keeps flowing.
Speed and inspection
Inspection that does not slow your site down.
Requests are checked at the edge — the point where traffic arrives, before your own server. The checks are strict but small, and the heavy analysis happens afterwards, off to the side, where it cannot make anyone wait.
What the current evidence supports
In warmed benchmark runs the added inspection time measured between 3.0 and 3.4 milliseconds at the 95th percentile. Inspection stays in watch-only mode until the activation checks pass.
What you can see and control
Every capability has a narrow responsibility, an operational state and evidence that explains the result.
Available
Attack-pattern checks, watch-only first
An industry rule set runs in a separate process from the one serving your traffic. It starts by only reporting what it would have done, so false alarms cost nothing.
The slow thinking happens later
A small, bounded summary of each request goes to analysis afterwards. The visitor is never held waiting for it.
02
How you use it in an operating workflow
The visitor path remains short. Configuration, verification and rollback stay visible to the operator at every stage.
Fast request pathParallele AnalyseEvidence before promotion
- 01
Serve what can be served
Images, scripts and other static files are delivered from cache before they ever reach inspection.
- 02
Decide locally
The remaining requests get a small, strictly bounded decision made on the spot.
- 03
Analyze afterwards
Patterns are correlated later and turned into a case with a proposal you can accept or reject.
The interface explains what is known, unknown and required
AegiFlow does not turn missing evidence into a reassuring zero. Every state links to its source, freshness and next action.
- State
- Available, observation, configuration required, degraded, unavailable or planned.
- Evidence
- Source, timestamp, scope and last successful verification.
- Action
- The responsible party, exact change and expected impact.
- Way back
- Rollback instructions are defined before an active change.
In depth
How this capability behaves in production — grounded in the platform's documented, current operation.
Inspection out of process, measured in single-digit milliseconds
The AegiFlow edge pairs Envoy routing with OWASP CRS inspection running out of process, over a private local socket that only the two components can reach. In warmed benchmark runs, the added inspection overhead measured a p95 between 3.0 and 3.4 milliseconds — and inspection stays shadow-first until enforcement gates pass.
Failure means falling open, never falling on the visitor
Strict timeouts, connection limits and last-known-good configuration mean an analysis component that slows down or dies cannot take your website with it. Databases, threat feeds and dashboards are never dependencies of the visitor request.
Start in observation. Activate only measured controls.
Ownership, certificate, origin health and rollback must pass before traffic protection changes.