Three layers. One gate.
Three architectural layers, each structurally invulnerable to the systems it governs. The Watcher confirms Churchill is operating. Churchill verifies what executes. The Protector anchors Churchill in the kernel, below the reach of user-space or root.
An offsite sentinel that confirms Churchill is still operating. If Churchill goes silent, The Watcher detects the anomaly and, when criteria is met, triggers the imminent-breach response.
The runtime gate. A cryptographically signed snapshot of your application defines what's allowed to run, verified in real time, with no performance cost. Legitimate traffic passes through at full speed. Anything that falls outside it is stopped before it executes and preserved as forensic evidence.
Anchors Churchill in the kernel below the reach of user-space, root, or remote access. Hidden, fail-closed, unopenable. Without The Protector, Churchill could be tampered with. With it, Churchill is structurally invulnerable to the systems it governs.
Built to fit a CISO's existing model. One binary per host. Tamper events flow into your existing incident response. Evidence is audit-ready. Broad platform fit across Linux, with a Windows edition in development.
Read the full whitepaper →Four architectural decisions.
Not part of your build pipeline.
Build pipelines sign whatever the build infrastructure produces. A compromised build means signed corrupt code, deployed with full pipeline trust. Churchill operates separately, verifying what is actually running against what your governance board approved, regardless of how the code was built.
Stops the attack. Not your business.
When Churchill blocks an unauthorized change, the protected application keeps running. Customers, transactions, operations continue uninterrupted. Churchill shuts a system down only when an attacker has compromised Churchill's own recovery layers and is attacking repeatedly.
Attackers perceive success. You get evidence.
Blocked attacks do not disappear. They get captured. The attack plays out against the mirror envelope. The attacker continues executing their playbook, perceiving success. Not one byte on the real system is modified. Every action becomes prosecution-grade forensic evidence with complete chain of custody.
You see them coming. They never see you.
Enforcement at every decision point.
Churchill evaluates every execution request before it runs. 406,433 decisions in 11.3 hours during the Mythos engagement. Every program, script, credential, and AI agent action evaluated against the CAB-signed package. No lag. Legitimate work ran at full speed. Unauthorized work did not run at all.