IPServerSec

Server security that thinks

IPServerSec is a hardening and early-warning system for Linux servers, built by me. It keeps attackers out as far as is technically possible, and it goes looking for the ones who get in anyway. Every version runs on my own server fleet first, from the web servers through the databases to the entire mail cluster, before it ever touches a client system.

Since 2026 it includes something that goes beyond conventional security systems: a highly capable artificial intelligence that walks through your systems several times a day.

There is no script on the other side of your firewall

Conventional security systems wait for a threshold to be crossed. For IPServerSec I bought myself something else: a current, highly capable large language model: 753 billion parameters, a 1 million token context window, trained specifically for security work and equipped with an attacker’s way of thinking. On CyberGym, the benchmark that measures how reliably a system finds vulnerabilities in code it has never seen, it scores 84.5 percent, according to the vendor.

The same model is the tool the other side is reaching for right now. In the relevant forums, people talk openly about how to press it into service for attacks, because it is freely available and answers to no one. On my side, that same machine works in the opposite direction. I also turn it loose on your system as the attacker, in a penetration test, so the gaps surface to me instead of to somebody else. It was trained to understand break-ins, and every day I put it to work finding them.

Several times a day, this intelligence walks through every one of your machines. It knows what each machine looks like when it is healthy, and it reads logs the way an investigator does, not the way a filter does. It notices when a service goes quiet that should be talking. It spots a file that changed in a place where nothing ever changes. It asks questions when a connection reaches for a destination that has no business being there, and it decides whether an anomaly has an explanation or none at all.

This AI thinks like somebody who wants in, only better. It knows the attackers’ tools, their camouflage, and their habit of sweeping up the traces once they are finished. That is exactly where it looks. Anyone who comes after your systems is not dealing with a burglar alarm. They are dealing with an intelligence that could be one of them.

What the AI does for you

It judges instead of just firing
Anomalies are traced to their cause before they reach you. False positives here are not simply dampened or filtered away, they are resolved. When you hear that something is wrong, there is a checked reason behind it. An alarm that screams 20 times for nothing gets ignored on the 21st. That is why mine is built not to scream for nothing.

Its silence is on the record
The best security alert is the one you never receive, because there was nothing to report and because that was documented. Every run is logged, including the ones with no findings. On request you get the complete chain of evidence: who checked what, when, and with what result. That is exactly the kind of evidence insurers, regulators, and courts ask for when it counts. What weight it carries in a given case is for them to decide.

It remembers
Whatever stood out once stays under observation. Whatever repeats gets reported. Whatever explains itself cleanly is closed. Anyone creeping forward in small steps over weeks has a hard time staying invisible to it, because the memory connects what no single run can see on its own.

Once a day, the AI checks your software for open vulnerabilities, from the operating system through the server services all the way down to the libraries. It does not compare against a list from some point in the past. It compares against what is actually installed, which it determines itself. Then it researches and judges: Does this affect you? Is it exploitable? What needs to happen? Anything that is open and affects you reaches you promptly, so you can act before somebody else exploits it.

New attack patterns from the global early-warning network and from the live operation of your own systems feed continuously into detection. Your protection does not stay frozen at the day it was set up. It accumulates experience.

14 layers of protection, and one that thinks

Defense at the door
Attacks on Linux servers are rarely clever. They are always numerous. IPServerSec recognizes them by behavior, fed by a worldwide network in which servers warn each other. Detected attackers get blocked automatically, with nothing required from you and no waiting. Repeat offenders I block progressively harder and network-wide, and known attacker networks stay outside the door from the start.

In front of your web application sits a web application firewall built on the OWASP Core Rule Set. Typical patterns of SQL injection, cross-site scripting, remote code execution, and path traversal are caught before they reach your application. Camouflaged decoy paths that no real visitor ever requests often expose automated attackers on their first try. Enforcement happens on two levels, in the web server and in the operating system’s packet filter. Whatever gets past one level runs into the next.

Detection on the inside
Every run compares cryptographic checksums across all monitored system paths against protected reference states. Modified system files, new listening ports, planted persistence, a service left behind after a break-in: whatever the check finds gets named, none of it stays vague. For web applications I also check against the vendors’ own checksums and search the codebase for obfuscated malicious code, including the kind attackers like to delete once they are done.

IPServerSec watches outbound traffic too. A mailbox that suddenly starts sending in bulk. A connection to a destination that has no business being there. Compute load at hours when nobody is working. Those can be the signs of a successful break-in, and that is precisely where the AI gives no quarter.

Email security (on managed mail systems)
If you take mail seriously, you get the full set from me. Providers delivering mail to you are required to encrypt it, and your system insists on it. SPF, DKIM, and DMARC are monitored continuously across all of your domains. On top of that, I evaluate the delivery and security reports that other providers send back. AI-assisted fraud detection is built to catch forged senders and fraudulent payment instructions before they do damage. More than a dozen custom behavioral rules, attachment analysis, and neural scoring keep spam and malware largely out.

Proof of authenticity is the part I am proudest of. Your outbound mail can carry a verifiable certificate of authenticity. The recipient can check at any time whether a message really came from you. A single forged payment email can cost hundreds of thousands of euros. So this is not a feature. It is an argument that carries weight with clients.

The foundation
Every website runs under its own system account with minimal privileges, so one mistake does not become a wildfire. The operating system is hardened: automatic security updates from defined sources, kernel live patching where possible, monitored certificate renewal, a complete set of security headers, protected mail authentication, and backups on separate storage.

Reporting and proof
You receive structured reports on every run that turns up something, and a text message only when it is genuinely burning. Everything else is silence, and that silence rests on an actual check. On request you also get the documented chain of evidence for each run and the quarterly service report you can put in front of insurers and government agencies.

Why this is more than a burglar alarm

An attacker sits inside a system for a median of 14 days before anyone notices (M-Trends 2026). In 14 days you can carry off a great deal and cover up a great deal, if nobody is looking. Thresholds do not look. They wait. An intelligence that walks the system several times a day and understands what it sees does not wait. Careless attackers get noticed fast. Skilled ones still have to get past a check that comes back several times a day.

Onboarding in 4 phases

1. Assessment, read-only
I look at your system and you get a findings report. Nothing is changed.

2. Hardening
I replace instead of stacking. 4 systems that block each other protect you worse than 1 system somebody understands and answers for.

3. Tuning against live traffic
Your real visitors and real processes define the normal that everything else is measured against.

4. Sign-off with a documented, staged cutover
After that the AI takes over the daily check of your system, and I keep an eye on the AI.

How long it takes depends on the system, and most of the time goes into tuning against live traffic. The assessment alone takes a week for a medical practice with a system that grew over the years, 2 days of that on site. For a clean server with 3 domains it is done in a day.

What I do not promise

There is no such thing as 100 percent security, not for any reachable server anywhere. The standard is whether everything technically possible and reasonable was actually done, including in the eyes of insurers, regulators, and courts. What do I promise? A system I built myself. An artificial intelligence I run myself. A man who answers for it. By name.