What it does

Visibility, segmentation, and clear triage.

  • Acts as the network gateway with firewall rules, DNS filtering, and separate trusted, guest, and IoT networks.
  • Runs local intrusion detection and flow analysis, then correlates alerts into a small number of understandable events.
  • Uses a local language model to explain findings, suggest next steps, and draft an incident summary for a human to review.
  • Keeps telemetry, logs, and model inference on the device, with no cloud account required.

How it works

Automation for evidence. Human judgment for action.

01

Observe

The appliance sees network flows and security events from the gateway, DNS, and local sensors.

02

Correlate

Deterministic rules and a local model group related signals and reduce duplicate alerts.

03

Explain

The console describes what changed, why it matters, and which evidence supports the conclusion.

04

Decide

You approve blocks, exceptions, or further investigation. Enforcement never depends on a model alone.

Design boundaries

What it does not pretend to do.

  • It does not guarantee protection against a determined attacker or replace a professional incident response team.
  • It cannot inspect encrypted traffic without adding a trusted certificate and accepting the privacy trade-offs.
  • Its AI assistant can be wrong, so it explains and prioritizes; it does not silently approve or block on its own.
  • It is a hardened appliance, but it still needs updates, backups, and a maintenance owner.

Pilot

Start in monitor mode. Earn the right to enforce.

A pilot begins with a read-only deployment: map the network, establish a baseline, and measure alert quality before changing any firewall policy. Enforcement is added only after the team understands the findings and the rollback path.

Discuss a Home Sentinel pilot