K-Defender

Self-hosted security platform

Always watching.
Always judging.

Audit websites and source code, score and track risk, and let AI triage your Defender, Entra and firewall events into tickets with an owner. Everything runs on your own infrastructure, with the AI models you choose.

See pricing Watch a ticket get made
  • Bring your own AI
  • Entra ID SSO
  • Teams and email alerts
  • Docker deployable
K-Defender: a watchful orange cat eye inside a dark archway

K-Defender Suite is a self-hosted security platform that comes in two editions. The installable desktop app lets you audit websites and source code, then score and track what you find with built-in risk assessments. The Docker-based Enterprise edition adds everything a team needs: Microsoft Entra ID single sign-on with group-based access, plus a Security Log Monitor that ingests Defender, Entra, Azure and firewall events. AI reads each event, decides what matters, and opens a ticket with a category, an owner and next steps, then alerts you in Microsoft Teams and email. Both editions let you bring your own AI models, and your data stays on your own infrastructure.

Two editions

Start on your desktop. Scale to your datacenter.

Installable

K-Defender Suite Desktop

A personal toolkit that installs like any app from the Microsoft Store. No server, no accounts.

  • Audit websites and source code
  • CVE database matching for dependencies
  • Built-in risk assessments and a risk register
  • Re-run audits and quick-check single sections
  • Bring your own AI models
Docker

K-Defender Suite Enterprise

The full platform for teams, deployed with Docker Compose behind your own reverse proxy.

  • Everything in Desktop
  • Microsoft Entra ID single sign-on
  • Group-based access: Admin, Audit, Risk and Monitoring, each with read or write
  • Security Log Monitor for Event Hub, syslog and webhooks
  • AI triage into tickets with categories, owners and notes
  • Alerts to Microsoft Teams and email

Capabilities

One suite. Three jobs done well.

01

Audit

Point it at a website or a codebase. Findings are rated, explained and tracked, with exceptions you can justify and re-run on demand.

02

Assess

Turn audit findings into risk assessments. Inherent and residual scores stay in sync with the open items behind them.

03

Monitor

Collect Defender, Entra, Azure and firewall events in one place. AI sorts signal from noise and opens tickets, so your team handles tickets, not raw logs.

Security Log Monitor

From raw event to owned ticket.

Event Hub, syslog and token webhooks feed one pipeline. Rules decide what reaches the AI, the AI decides what matters, and alerts go to Teams and email.

  1. Ingest Defender, Entra, Azure and firewall events
  2. Triage with the model you choose
  3. Ticket with a category, an owner and next steps
  4. Alert in Teams and email, then track every note
log-monitor

How it works

Follow one event all the way to a ticket.

This is a single event moving through the Enterprise edition. Click any step to jump to it.

Want the long version? Walk through three examples on the support page.

For teams

Built for people who share the work.

  • Single sign-onOne sign-in through Entra ID. Sessions stay on your server. A break-glass token keeps you in if SSO is ever misconfigured.
  • Assign anyonePick owners from your users and groups. The AI suggests categories and subcategories, and you can edit the list.
  • Alerts that reach youPost to a Teams chat or channel with a Workflows webhook. Send ticket digests by email from a mailbox limited to one group.
  • Quiet by designSet a minimum severity for ingest, tickets and alerts. Unrecognized event shapes can be dropped before they cost anything.
  • A trail you can showEvery note, status change and assignment is recorded with who did it and when.

Compare

Which edition fits.

What you getDesktopEnterprise
Audit and assess
Website audits and source code scans
CVE database matching for dependencies
Risk assessments and a risk register
Bring your own AI models, per task
Team and monitoring
Microsoft Entra ID single sign-on and group accessNot included
Security Log Monitor: Event Hub, syslog, webhooksNot included
AI triage into tickets with categories and ownersNot included
Teams and email alertsNot included
How it runs
InstallMicrosoft StoreDocker Compose
Where your data livesYour computerYour servers

Pricing

Simple pricing.

The desktop app is one subscription with every feature, billed through the Microsoft Store. Pick monthly or save with annual.

Monthly

$4.99
per month
  • Every desktop feature
  • Audits, risk assessments and CVE matching
  • Reports you can hand to a client
  • Updates included
  • Cancel any time
Get the desktop app
Save 25%

Annual

$44.99
per year, about $3.75 a month
  • Every desktop feature
  • Audits, risk assessments and CVE matching
  • Reports you can hand to a client
  • Updates included
  • Saves $14.89 a year over monthly
Get the desktop app

Enterprise

Let's talk
self-hosted with Docker
  • Everything in the desktop app
  • Entra ID single sign-on and group access
  • Security Log Monitor and AI tickets
  • Teams and email alerts
  • Runs on your own servers
Contact us
License keysGifts, reviewers and teams can get a license key from us. Enter it on the subscribe screen and the app unlocks.
Free for nonprofitsRegistered nonprofits get K-Defender at no cost. Send us a note and we will set you up.
Your data stays putIf a subscription ends, the app locks. Your audits and reports stay on your computer.

Your infrastructure

Data lives in your containers and your database. Nothing is sent to us.

Your AI models

Use the providers you already trust, including ones you host yourself.

Your identity

Entra ID groups decide who can see and change what. Sessions stay server-side.

Questions

Asked first.

Does any of my data leave my network?
Audits and tickets are stored on your computer or your servers. The only data that leaves is what you send to the AI provider you choose. Pick a model you host yourself and nothing leaves at all.
Which AI models can I use?
Local models through Ollama, hosted models through Ollama Cloud, Qwen Cloud and OpenRouter, plus others you add. Each task, such as analysis, security or summaries, can have its own model.
What happens if I stop paying?
The desktop app locks until you subscribe again. Nothing is deleted. Your audits, risk assessments and reports are still on your computer when you come back.
How do license keys work?
A key is a long code we generate for you. Paste it into the subscribe screen and the app unlocks. Keys can be for life or for a set number of days.
Do I need Microsoft 365 for the Enterprise edition?
Sign-in uses Microsoft Entra ID, so you need an Entra tenant. Event sources like Defender and Azure are optional. Firewall syslog and webhooks work without them.
Where do I get help?
The support page has a quick start, a guide to every section, and fixes for the problems people hit most. You can also message us from there.

Contact

Tell us what you want to defend.

Questions about pricing, a license key, a demo, or a deployment you are planning. Send a note and we will reply by email.

We use these details only to reply to you. See the privacy policy.