The Sub-Millisecond WAF with Zero False Positives.
Stop fighting OWASP CRS regular expression hell, false positives that break checkouts, and ReDoS CPU spikes. SATGuardian replaces brittle regexes with a deterministic boolean SAT solver running locally in < 0.05ms (0.02ms typical), evaluating 10 formal Certainty Islands and continuously simplified via satguardian.tech.
Interactive Payload & Latency Benchmark
Compare how traditional Regex WAFs (ModSecurity / OWASP CRS) fail on modern application payloads versus SATGuardian's deterministic formal solver.
Local Sub-Millisecond Proxy + Cloud SAT Synthesis
Why compromise between speed and accuracy? SATGuardian splits the workload into a local zero-latency proxy and a remote cloud synthesis engine.
100% Sovereign Sub-Millisecond WAF
Runs natively on your own Windows Server (IIS / .NET) or Linux VPS (Nginx / Docker). Inspects every request in < 1 millisecond using pre-compiled boolean matrices without ever sending your sensitive payload data outside your network.
- ✓ Zero runtime dependencies (Single compiled Rust binary)
- ✓ Runs as a native Windows Service (
install.ps1) or Linux Systemd - ✓ Built-in Monitor (Shadow) and Enforce modes
SAT Optimization at satguardian.tech
When your local WAF detects custom application anomalies or legitimate edge cases (false positives), it submits the rule signatures to satguardian.tech. Our cloud solver simplifies the SAT matrix (up to 128 variables) and updates your WAF automatically.
- ✓ Eliminates false positives specific to your codebase
- ✓ Compiles rule matrices into dense boolean logic
- ✓ Syncs with 1 command:
satguardian-waf sync --token <KEY>
The 10 Formal Certainty Islands
Instead of heuristic guessing or probabilistic neural networks, SATGuardian partitions web security into 10 deterministic, mathematically closed domains. If a request forces an interpreter to violate its formal grammar, it is dropped in < 0.05 ms with zero hallucination.
ISLAND-SQLI
BLOCK
Tautologies (' OR 1=1), UNION exfiltration, stacked DDL statements, and sleep/benchmark timing primitives.
ISLAND-XSS
BLOCK
Script tags, inline DOM event triggers (onload, onerror), SVG polyglots, and dynamic javascript: URIs.
ISLAND-RCE
BLOCK
Shell command chaining (;, ||, &&), subshell substitutions ($(), backticks), dynamic eval sinks.
ISLAND-LFI
BLOCK
Directory traversal escapes (../../), direct root targeting (/etc/passwd, /proc/self/environ).
ISLAND-SSRF
BLOCK
Cloud metadata probes (169.254.169.254), loopback internal routing (127.0.0.1), and private RFC1918 subnets.
ISLAND-GRAPHQL
BLOCK
Schema introspection dumping (__schema), cyclic recursive query bombing (depth > 6), and query batching floods.
ISLAND-JSON-PROTO
BLOCK
JavaScript prototype pollution keys (__proto__, constructor.prototype) and nesting recursion bombs (> 20 levels).
ISLAND-GRPC
BLOCK
Client status trailer injection (grpc-status: 0) and 5-byte gRPC framing desynchronization / request smuggling.
ISLAND-JWT
BLOCK
Algorithm confusion (alg: "none"), unsigned token spoofing, and Key ID (kid) directory traversal / SQLi.
ISLAND-STATEFUL
BLOCK
Sliding window atomic ring buffer: Layer-7 burst DDoS protection and distributed credential stuffing prevention.
Why Was It Blocked? Mathematical Causal Explainability
Traditional WAFs fail because no one understands why requests are blocked: regex rules trigger cryptic error codes, and probabilistic AIs return an opaque threat score. SATGuardian produces a formal causal proof for every request: you know exactly which token, which grammar, and which invariant caused the block.
ModSecurity / OWASP CRS
Triggers enigmatic rule IDs based on hundreds of characters of regular expressions:
The Problem: No one knows which fragment of the input matched the rule. Developers waste days debugging or end up disabling entire rules.
Opaque Black-Box Models
Return an arbitrary numeric score without verifiable semantic justification:
The Problem: Completely inauditable. Impossible to know if it was a model hallucination or a real attack. Cannot be defended during PCI-DSS or SOC2 audits.
Deterministic Causal Explainability
Every single block includes the algebraic theorem proof and first-order causal tokens:
Unique Advantage: 100% Certainty. You know with mathematical precision which tokens and invariant triggered the block. Zero ambiguity.
1. O(1) Lexical AST Tokenization
SATGuardian avoids blind substring regex matching; it constructs a structured Abstract Syntax Tree (AST) with exact semantic tokens in CPU registers.
2. First-Order Invariant Theorem
Decisions are evaluated against formal boolean invariants: CDOM ≡ ¬(SCRIPT ∧ SINK). If the request does not contradict the invariant, traffic is allowed with zero false positives.
3. Audit-Ready Forensic Ledger
Immutable local SQLite WAL forensic ledger. Any engineer or compliance auditor can independently verify the exact decision with cryptographic hash signatures.
How SATGuardian Compares to Alternatives
Stop overpaying for per-domain cloud proxies or suffering under brittle open-source regex rules.
| Feature / Metric | SATGuardian WAF | ModSecurity / CRS | Cloudflare / AWS WAF |
|---|---|---|---|
| Detection Engine | Deterministic SAT Solver (10 Islands) | Brittle Regular Expressions (PCRE) | Proprietary Regex + ML Heuristics |
| Mean Latency | < 0.05 ms (0.02 ms typical) | 25 – 120 ms | 15 – 60 ms + DNS Roundtrip |
| Throughput | 82,400+ req/s | ~2,100 req/s | Scales via Cloud CDN nodes |
| False Positive Elimination | Automatic via Cloud SAT Synthesis | Manual exclusion writing (Weeks of work) | Manual IP / URI rule exclusions |
| Explainability & Root Cause | 100% Formal Causal Proof (AST Tokens + Logic Trace) | Cryptic regex IDs (e.g., Rule 942100) | Opaque black-box score (e.g., Threat 87/100) |
| Data Sovereignty | 100% Local (Traffic never leaves server) | 100% Local | Zero (Traffic decrypted in cloud) |
| Windows Server IIS Support | Native 1-Command Service (install.ps1) | Complex compile / Unstable C++ DLLs | DNS reroute only |
| Cost Structure | Gratis $0 / Scout $20 / Pro $49 / Startup $499 | Free (High sysadmin labor cost) | $20 – $200/mo PER DOMAIN + Bandwidth |
Transparent Pricing. Zero Cost Per Domain.
The local SATGuardian WAF proxy binary is free forever and runs sovereignly on your own infrastructure. Subscribe to cloud synthesis to adapt rules to your application traffic and eliminate 100% of false positives.
- ✓ 1 Seat included
- ✓ Up to 12 variables / 1K minterms
- ✓ 100 SU / mo (Monthly hard limit)
- ✓ Sovereign local WAF binary for Windows & Linux
- ✓ 0% False Positives across 10 Certainty Islands
- ✓ Discord & GitHub community support
- ✓ 1 Seat included
- ✓ Up to 20 variables / 2.5K minterms
- ✓ 1,000 SU / mo (Monthly hard limit)
- ✓ Adaptive false positive elimination
- ✓ Continuous edge monitoring & audit logging
- ✓ Standard email support
- ✓ 1 Seat included
- ✓ Up to 64 variables / 10K minterms
- ✓ 5,000 SU / mo included
- ✓ Flexible overage: $10 per 1,000 extra SU
- ✓ Formal synthesis & Verilog/VHDL/.BLIF export
- ✓ Priority email & Discord developer support
- ✓ 5 Team Seats
- ✓ Up to 128 variables / 100K minterms
- ✓ 50,000 SU / mo included
- ✓ Discounted overage: $8 per 1,000 extra SU
- ✓ High-priority cloud synthesis queue
- ✓ Dedicated Slack channel & guided onboarding
- ✓ 15 Team Seats
- ✓ Up to 128 variables / 1M minterms
- ✓ 500,000 SU / mo included
- ✓ Optimized overage: $5 per 1,000 extra SU
- ✓ Isolated synthesis instances & auto-deployment
- ✓ 99.9% SLA & dedicated technical account manager
- ✓ Unlimited team seats
- ✓ Up to 128 variables / Unlimited minterms
- ✓ Custom negotiated annual SU quota
- ✓ Dedicated on-premise or sovereign hybrid cluster
- ✓ 99.99% SLA with 24/7/365 phone & incident support
- ✓ Full SOC2 and PCI-DSS compliance audit assistance
Due to the computational physics of the NP-complete Boolean minimization problem, workloads exceeding 256+ variables are never self-service SaaS; they are scoped and managed exclusively as an Engineering Expansion Project on dedicated HPC clusters or bare-metal accelerators.
Deploy in Less Than 60 Seconds
No runtime compilers, no Python environments, no DLL hell. A single self-contained binary configured as a reverse proxy for your existing applications.
Join Our First 20 Design Partners
Are you an agency managing client servers or running a SaaS plagued by WAF false positives? Deploy SATGuardian in Monitor Mode on up to 3 servers and receive 6 months of the Pro Plan ($72 value) completely free in exchange for technical feedback.