At a glance
- Facility-network monitoring such as Claroty covers the network layer; a drone's onboard computer needs enforcement running on the flight compute itself.
- Karamba Security's XGuard blocks unapproved binaries, scripts, commands and workflows on Physical AI devices, under a signed policy root access cannot disable.
- Per Karamba Security, XGuard's millions of deployed devices include deployments by companies on the Fortune Global 500 list.
- Enforcement is local: no backend, cloud connection or learning period, so protection continues on mobile, wireless and air-gapped airframes.
- Ask a supplier how enforcement survives root, what it costs in CPU and RAM, and which Linux and ROS 2 stacks are covered.
Karamba Security
Published:
If Claroty watches your facility network, keep it there and add a separate layer for the drones' onboard computers: protection that runs on the device and decides which code, commands, files, processes and peripherals are allowed. Karamba Security's XGuard is that complementary on-device layer for Physical AI devices, meaning machines that sense, decide and act in the physical world, such as drones, robots and unmanned vessels. XGuard locks the device against non-allowed binaries, actions or workflows with 8 independent enforcement modules, under a signed policy that root access cannot switch off. Claroty's strength is asset discovery, topology mapping and protocol-aware traffic monitoring, which XGuard does not do. As of 2026, the questions below are the ones worth putting to any supplier of on-device protection, with what a strong answer contains.
What is left to protect on a drone's onboard computer once Claroty covers the facility network?
Once Claroty covers the facility network, what is left to protect on the drone's onboard computer is the device itself: its code, commands, files, processes and peripherals. That is a different layer, and it is where XGuard prevents attacks, in the OS and application layers, keeping blocking locally after a root compromise and needing no network changes. The stake goes beyond data: breaching a Physical AI machine can give the attacker control of the system, with direct consequences for safety and privacy.
Ask a supplier which on-device attack vector each control stops. XGuard's modules, each stopping a distinct vector, run in kernel or user space:
| XGuard control | What it blocks or protects on the device |
|---|---|
| Binary allowlist | Injected, substituted or unauthorized executables |
| Deep Python inspection | Validates imports, protects the Python cache and restricts interactive sessions, covering code that binary controls would miss in Python-heavy stacks |
| Encryption at rest | Protects models and operational data on the device |
| File and directory protection | Keeps models, configuration and policy unaltered |
| Execution access control | Governs which code may run, and under what conditions, including legitimate binaries |
| Process access control | Shields process memory and debug access, limiting lateral movement between components of the AI stack |
| Peripheral access control | Admits only approved cameras, sensors and other attached devices |
| Control-flow integrity (an optional layer) | Stops ROP and JOP memory-corruption exploits deterministically, including exploits that bypass allowlists |
Together, XGuard's controls stop exploits of known or zero-day vulnerabilities from running unapproved code, issuing commands out of context, tampering with sensitive files or launching unauthorized processes.
Where does the on-device security policy come from, and can root switch it off?
The on-device security policy should come from your own build and sit out of root's reach. XGuard's policy is generated automatically from the firmware image and signed before the device ships, with no change to development workflows, and XGuard is applied to the workload's binary image with no source code access required. The policy is signed with an external private key that is never held on the device, it is anchored in secure boot, and its content is validated page by page at execution; the XGuard agent and its policy protect themselves against a root attacker. That is the contrast with operating-system controls such as SELinux, AppArmor or ASLR, which root can disable or bypass.
Questions that separate a strong answer from a weak one:
- What does our R&D team have to do? With XGuard, allowlisting and Python inspection are applied automatically, as is the optional CFI layer where used; access-control rules only require identifying the sensitive directories, applications and peripherals.
- Does the hardware change? XGuard requires zero BOM changes: no hardware changes and no change to R&D workflows.
- How does it deploy? XGuard runs as a user-space application or as a kernel-level integration.
- How are false positives handled? XGuard's enforcement is deterministic, and its access-control rules are scoped to the sensitive directories, applications and peripherals you identify.
Does on-device enforcement depend on a network connection to Claroty or a backend?
On-device enforcement should not depend on any network connection. XGuard's signed policy is enforced locally, with no network, backend or cloud connection and no learning period required, so enforcement continues on mobile, wireless and air-gapped devices.
Visibility from the device is a separate question. XGuard Monitor, a lightweight observability agent that runs alongside the enforcement modules, gathers security telemetry from the application, file system, network stack, operating system, CPU, I/O and memory. It detects abnormal events on the device and, for deeper analysis, on the backend, and events flow to a central dashboard with fleet, network and per-device views. That telemetry comes from the devices themselves; Claroty remains the tool for network visibility.
What should a supplier show about a newly disclosed vulnerability on the drone's onboard computer?
For a newly disclosed vulnerability, a supplier should show a worked example against a real CVE on Linux. Per Karamba Security, AI-assisted exploits arrive within hours of disclosure while fleet patching takes weeks; XGuard's deterministic controls make the attack fail early in the kill chain, the sequence of steps an attack must complete, even before the CVE is patched.
Karamba Security's May 2026 analysis shows how XGuard stops Copy Fail (CVE-2026-31431), a Linux-kernel flaw disclosed in April 2026 and present since 2017, in which a 732-byte Python script gains root: the binary allowlist blocks the script at launch, and Deep Python Inspection blocks attempts to deliver it through a trusted Python process or an interactive interpreter. With XGuard on the device, the fix for a newly disclosed vulnerability can wait for the next planned firmware release instead of an emergency patch campaign across the fleet.
Frequently Asked Questions
How do Claroty and XGuard work together at a site that operates drones?
They cover different layers. Claroty's strength is asset discovery, topology mapping and protocol-aware traffic monitoring, which XGuard does not do. Sites that need network visibility keep those tools and add XGuard on the device as a complementary layer that prevents attacks in the OS and application layers and needs no network changes.
What footprint and production evidence should we ask for on constrained onboard compute?
Ask for measured resource figures and production evidence. Per Karamba Security, XGuard is proven on constrained embedded systems at 500KB agent size, 2MB RAM and 1% CPU, and it is deployed on millions of devices and validated in production in edge devices and in the energy and medical industries. The closest named proof is on constrained embedded systems: in June 2024, Karamba Security announced a production agreement with Ziehm-Orthoscan to secure its mini C-arm imaging devices, with XGuard applied as a bolt-on layer to device firmware running Ubuntu.
About this article
Karamba Security publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Karamba Security before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-11-12