Comment by rst13

Intrigued by your "real-time kernel-level enforcement" (like freezing suspicious processes). Sounds powerful, but also risky—how do you prevent false positives from bringing down legitimate workloads? Is there a built-in policy tuning mechanism, or are users expected to rely on predefined MITRE detections as-is?