The AI Wall Windows endpoint agent.
A lightweight Windows service plus tray/dashboard experience for ransomware behavior monitoring, USB controls, startup visibility, and admin evidence.
Local endpoint dashboard
Protection state, monitored folders, service status, recent events, license cache, and quick admin visibility.
Protected Canaries activeDevice approval
Unknown removable media can be blocked, approved, logged, and reviewed later.
Approval requiredAdmin portal evidence
Machine list, event timeline, license state, and response notes for owners or MSPs.
Event log Weekly reportWhat runs on each endpoint.
File Shield
Monitors protected user areas and canary files for rapid, suspicious modifications consistent with encryption activity.
Process Shield
Watches script engines, unknown executables, and processes that begin modifying files at suspicious speed or scope.
Behavior Shield
Uses practical behavioral signals, policy rules, canaries, and anomaly detection. Admins stay in control of response policy.
USB Guard
Helps prevent unknown removable drives from introducing payloads or moving sensitive data without a logged approval.
Startup Guard
Looks for persistence changes that often appear after malware, installers, or unauthorized tools attempt to survive reboot.
Network Isolation
Designed to help interrupt spread by containing suspicious endpoints while an admin reviews the event.
What happens during install?
Download and run setup
No special deployment system is required for a first machine. Admin rights may be required because AI Wall installs a Windows service.
Service starts
The background protection service starts and creates the local monitoring state.
Tray app appears
The user-facing tray/dashboard path gives visibility without opening the admin portal.
Machine checks in
The endpoint contacts https://aiwallprotection.com over HTTPS/443 for license checks and event reporting.
Portal shows proof
Admins can review machine status, events, USB decisions, and reporting history.
Typical first-machine install requires no reboot and can be removed through Windows Programs and Features. Final behavior depends on policy and customer environment.