How Sandfly Works

How Sandfly Works

Sandfly Security is proud to be part of the

Vodafone Xone Accelerator Program

Linux intrusion detection without agents.

Sandfly is a scalable solution that can find compromised Linux hosts without agents. Agent-based solutions can have compatibility issues, impact performance and cannot be deployed and updated without extensive reliability testing. With Sandfly, you simply point it at the hosts you want protected and walk away. Sandfly does the rest without you having to touch any endpoints.

Automated Linux Security

Designed to Work Without Drama or Agents


Instead of agents, Sandfly uses small pieces of code that swarm onto the endpoint on demand to do investigations. These pieces of code are called sandflies and each one looks for a particular problem and reports back findings. Sandflies run on a host as a random swarm and at random times. 


The average sandfly takes under one second to run. A swarm of sandflies can typically assess a system in under 30 seconds and then vanish without a trace. Sandflies have minimal system impacts.


Sandfly is designed to be left alone once you set it up. The system will select sandfly investigations to run based on a random schedule and in random quantities. This allows Sandfly to avoid attacker evasion tactics and also prevents impacting monitored systems.


Sandfly checks your systems at random times using random quantities of sandflies. We designed Sandfly to be random because attackers have adapted their techniques to avoid scheduled and predictable security products. We also designed Sandfly without an agent because attackers target security agents directly to disable them. Sandfly provides invisible protection to your Linux hosts.

What is a Sandfly?

A Sandfly is a small annoying biting black fly indigenous to New Zealand where we are based. Sandflies swarm around you and make life miserable when in the bush.

We call the product Sandfly because our investigative agents swarm around and bug intruders making their life on a compromised system miserable.