I manage infrastructure for clients across Pakistan. Last month, a freelancer friend got a $1,400 bill from CrowdStrike for 40 Linux servers. That's more than his monthly revenue.

Enterprise EDR is broken for the rest of the world. So I'm building an alternative.

SystemGuard is a lightweight, self-hosted HIDS I'm open-sourcing. It's not another wrapper around OSSEC — it's built from the kernel up with eBPF and Rust.

GitHub: https://github.com/systemguard-io/systemguard

The Problem Nobody Talks About

Western security tools assume:

You can afford $35/host/month

You want to send all your telemetry to US clouds

You have a SOC team to tune 10,000 alerts

In Karachi, Lahore, and Islamabad, we run 5-100 servers on tight margins. We need:

Real-time detection (<100ms)

Self-hosted (data sovereignty)

<2% CPU overhead

Free

OSSEC hasn't had a meaningful commit since 2019. Wazuh is great but requires Elasticsearch cluster (overkill for 10 servers).

Why Rust, Not Go?

I prototyped in Go first.…