Defiance Engine\u2122

The Defiance Engine™ is MDRwatchdog’s autonomous local detection system that activates when the backend becomes unreachable. It continues evaluating security events against a set of compiled local detection rules, queues all events in a local SQLite database, and when connectivity returns, drains the queue and seals the entire sequence — defiance activation, events during defiance, reconnect, and queue drain completion — as a continuous, unbroken chain in the Quantum Audit Chain™. An assessor can verify that even during a network outage, detection continued and the audit record has no gaps.

Several things. First, the cryptographic continuity across the disconnection period: no other platform produces a tamper-evident, independently verifiable record that covers the defiance period itself, not just the events before and after. Second, the queue drain is not just an upload — it is an ordered, cryptographically sealed reconstitution of the event sequence with all timestamps preserved and the defiance period bounded by defiance-start and defiance-end events in the chain. Third, the defiance-period events are sealed with the same Ed25519 and ML-DSA-87 signatures as all other events, so a sophisticated attacker who cut connectivity to avoid detection cannot insert, delete, or reorder events from the queue period retroactively.

Indefinitely. The Defiance Engine™ has no time limit. It will continue queuing events in SQLite until the database reaches its storage limit, which on a typical endpoint is measured in weeks of continuous high-event-rate logging. When connectivity returns, the queue drains in order.

A common tactic in sophisticated intrusions is to disable or cut network connectivity as part of the attack — to prevent security telemetry from reaching the cloud platform and to make the attack invisible to cloud-based detection. The Defiance Engine™ is designed for exactly this scenario. If an attacker cuts connectivity to go dark, they trigger the Defiance Engine™ instead. The attack is detected locally, queued, and sealed to the chain when connectivity returns. The attacker cannot use network disconnection to create a gap in the audit record.

Eight compiled detection rules run locally without cloud dependency. These cover the most critical threat patterns — canary file writes (ransomware pattern), mass file modification, privilege escalation, lateral movement indicators, and firmware anomalies from the Firmware Sentinel™. The rules are compiled into the agent binary and cannot be disabled from the network.

When connectivity returns, the agent uploads queued events in sequence order. Each event is sealed to the Quantum Audit Chain™ with its original timestamp preserved. A defiance-end event is sealed with a reference to the defiance-start event, bounding the period. The SHA-256 hash chain continues from the last pre-defiance event through all queued events and into post-reconnect events without any break. The chain is continuous and verifiable.