User opens a website

• Scripts

• Cookies

• Script Signature Scanner

- Checks scripts vs malicious DB

- Blocks or allows based on severity

• Cookie Signature Scanner

- Analyzes & deletes malicious cookies

• Collects CPU, RAM, processes, etc.

• Builds digital fingerprint

• Sends profile after 48h, updates every 30d

• Alerts on threats

• Blocks threats

• May rollback system changes

• Stores IOCs (IP, domains, hashes)

• Shares IOC with networks for real-time protection

• Updates firewall, DNS, security software

• Protects connected devices

• Rollback to stable state if needed

• Learns from threat

• Updates agent memory

• Stops same threat instantly