Three problems current vendors are not solving
In July 2024, one update to a kernel-level agent took millions of Windows machines offline worldwide. Not an attack. The protection itself. That was not a detection failure. It was a consequence of where the protection runs and what it assumes about the endpoint.
Machines that cannot be rebooted
Some Windows machines are never allowed to stop: the ones running a production line, a payment system or a hospital device. Asking them to restart so a security driver can install is not a deployment plan. It is downtime.
Your data leaves with the protection
To detect anything, most vendors stream what happens on your machines into their own cloud, in another country under another jurisdiction. You are asked to trade privacy for protection.
Kernel access is total access
Code in the kernel can read every file, every keystroke and every secret on the machine, and nothing above it can say no. Your confidential data is private only for as long as the vendor chooses to keep it that way.
When the security software fails
Every security product has defects. The question nobody asks in the demo is what happens to the machine when one of them runs.
Where the code runs
Inside the Windows core
In a safe Windows layer
If the agent fails
Windows fails with it
Only the agent stops, with auto recovery
What you see
Blue screen, restart loop
The machine keeps running
Who has to act
Someone walks to every machine
Nobody, the system recovers on its own
Past the first layer is not inside
Most protection is designed to keep the attacker out and has nothing left to say the moment one gets in. Sparta Defend is built the other way around. The breach is treated as a normal condition, and the depth sits behind the first line.
An attacker who gets past the first layer walks straight into the next one, and the ones behind it are already waiting. Every layer watches the same activity independently and from a different angle, so the next move he makes is the move that stops him.
He has to get through all of them. We only need one.
Your system sits at the centre. The attack stops at the outer layer, and every layer behind it stays active, tightening inward, each one watching the same activity from a different angle.
How the layers are divided is not something we publish. That is the point of them.
Nothing acts on a production system without a decision.
ATTACK STOPS AT THE OUTER LAYER
Documented and supported, not clever tricks
Sparta works through interfaces Microsoft documents, supports and maintains. No kernel driver, no undocumented hooks, no patching of system structures. That choice is why the agent cannot bring a machine down, why installing it needs no restart, why there is no driver-signing chain to break on older systems, and why a Windows upgrade does not break your protection.
It works with the network cable pulled
Full detection capability with no internet connection. Threat intelligence and reputation lookups are supplementary, so nothing has to leave your network for the product to do its job.
Aligned with where Windows is going
Microsoft's stated direction is to move security vendors out of the Windows kernel. That is the architecture this product was built on from the first line of code.
Sparta Defend in action
A live ransomware attack detected and stopped on a running machine. No kernel driver involved, no reboot, no interruption to the system underneath.
Runs on any machine that boots a full Windows
From Windows 7 and 8.1 to the latest client and server releases. One agent, no separate workstation and server editions. No driver-signing chain to break on older systems, and no reboot to install. It is designed to sit inside a single-digit CPU budget, so it can be deployed on the hardware already on the floor.
Supported range
You decide where your data lives
Four deployment models, from a managed European cloud to a fully air-gapped install. The product is the same in all of them. What changes is who holds the infrastructure and how far anything is allowed to travel.
In both on-premise models, the platform and every piece of data it produces sit inside your own infrastructure. There is no vendor cloud in the path.
Multi-tenant cloud
Fastest route to a running pilot
We host and operate the platform in the European Union. You install the agent and start the same day, with no infrastructure of your own to prepare.
- Managed, monitored and updated by us
- Nothing to install or maintain on your side
- Best fit for a first pilot or a smaller estate
Dedicated instance
Your own instance, isolated from everyone
The same platform, as a single-tenant instance on our infrastructure, reserved entirely for you. Nothing is shared with anyone else, and you choose the region.
- No shared database, no shared compute
- Region and retention chosen by you
- Operated by us, separated from every other customer
On-premise, connected
Your hardware, your network
The full platform runs on servers inside your own data centre. Everything it produces is written to storage you own, behind your own firewall.
- IP addresses, hostnames, users and file paths stay inside
- Your database, your backup, your retention policy
- Full administrative access, including the data underneath
- The update channel is controlled by you
On-premise, isolated
Air-gapped, nothing leaves at all
The same on-premise platform with no route to the outside world. Detection runs at full capability offline, because the logic lives on the endpoint.
- Full detection offline, not a degraded mode
- Nothing about your estate is ever transmitted to us
- Updates imported as signed packages you verify
- Built for defence, government and OT networks
A European vendor, for European obligations
Endpoint coverage across operational systems, including the legacy machines that usually sit outside scope because nothing supports them.
Operational resilience that includes resilience to your own security stack. A protection agent that cannot halt the host removes one concentration risk.
Croatian company, European code, EU-resident data handling, auditable. In the isolated deployment, nothing leaves the customer network at all.
Who it is built for first
Manufacturing, critical infrastructure, finance, defense, and the providers who run those environments for someone else.
If you run Windows machines that are hard to patch, hard to reboot, or hard to take offline, this was built for you.
Industrial & OT operators
Control rooms, engineering workstations and production servers, including older Windows systems most vendors have left behind. Installs without a reboot.
Service providers & MSSPs
Multi-tenant from the start, EU-sovereign, with a partner model built for recurring managed revenue.
Software & technology companies
You talk to the people who wrote it. Deployed the same day you decide, without a migration project or a procurement cycle.
Defense & government
Air-gapped operation at full capability, European vendor, auditable code, no dependency on a foreign cloud.
Put it on your systems and see what it finds
The design partner programme is how we work right now. A small, deliberate set of environments, direct access to the engineering team, and a say in what gets built next. Real attacks, real machines, and a written account of what we caught.
Technical call, 45 minutes. Your environment, your constraints, and an honest answer on whether we fit.
Deployment on a chosen segment. Ten to fifty endpoints. No reboot, no kernel driver, reversible.
Six to eight weeks of real operation. Findings, tuning, and a written report you can take to your board.
Engineered by a team from defense-grade systems, not from IT tooling
This is not a concept or a deck. It is a product that exists and runs today, built by people whose previous systems were never allowed to fail.
Dusan Bizic
Founder & CEO
Defense-grade software engineer and architect. Years spent on military-grade systems: real-time control and government-scale platforms, where failure is not an acceptable outcome. Sparta Defend is built to the same standard.
Milan Bizic
Co-founder & COO
Runs daily operations, go-to-market and business development. Owns the pipeline, partner relationships and the path from a single pilot to enterprise deployment.
Martin Jordana
Marketing & Fundraising
Communications lead with a track record of securing high-tier global press for cybersecurity companies. Leads Sparta Defend’s funding outreach and investor relations.