HeliusOS v0.1 · Helius Network Ltd · measured 1 Oct 2026
HeliusOS is a hardened, image-based Linux operating system I built to run every security assessment from. It boots only from a verified image, encrypts its disk to the hardware it was enrolled on, refuses any target outside your signed scope, and produces evidence your own team can rerun. Every number on this page was measured, and every gap is named.
heliusos · boot
booting
374 of 386 scored rules, OpenSCAP
target was 80
on every build, with SBOM and CVE scan
SELinux enforcing, kernel lockdown
Why an assessor needs its own operating system
The flow · one engagement, start to finish
Scroll. The panel on the right shows what HeliusOS is doing at each stage. Nothing here is a simulation of your systems; it is a drawing of the method.
01 · Verified start
Before anything touches your systems, the machine proves it is what it claims to be. The image signature is checked, the root filesystem is immutable, SELinux is enforcing, the kernel is locked down, and a boot health check passes or the system rolls back to the previous image on its own. The disk unlocks only because the TPM recognises the hardware it was enrolled on.
Your signed scope and authorisation are loaded as a file, and the firewall is built from it: the three targets you authorised are reachable, and everything else is refused before a packet leaves the machine. Scope creep becomes a technical impossibility rather than a promise, which is also what makes the resulting report usable with insurers and customers.
Transport, headers, authentication, sessions, access control, cryptography, the mobile binary, dependencies, secrets, storage, any AI feature, and infrastructure. Each gets manual review plus the right tooling, run from an environment where I know exactly what is installed and nothing else. Anything you host also gets the same OpenSCAP and Lynis treatment HeliusOS applies to itself.
Every request, response, screenshot and extracted string is hashed the moment it is captured and stored encrypted on the machine. A finding in the report is a link to the exact artefact that produced it. Your engineers can reproduce it, an auditor can trust it, and I cannot quietly edit it afterwards.
Page one is for whoever signs: overall risk, the three things to fix this week, and what it means commercially. The rest is for engineers: a grade per surface, a risk matrix, every finding with where, evidence, impact, the fix with code, and the standard it maps to, then a now, thirty and ninety day roadmap. See the sample pages.
After your fixes, the same scope is run again from HeliusOS. Closed findings are verified, accepted risks are documented with your rationale, and a check confirms the fixes introduced nothing new. The retest letter is the page you attach to a sales deal, an insurance renewal or an App Store review note.
Inside the image
Pick a layer. The status is what heliusos-status reports on the machine, not what a brochure would like it to say.
CentOS Stream 10, built as a bootc image from one definition. The CIS RHEL 10 Level 2 Server benchmark is applied while the image is built, so a machine cannot drift away from it: every HeliusOS device is the same image.
Full-disk encryption with LUKS2, sealed to the TPM so the disk unlocks only on the hardware it was enrolled on. Change the boot order or the kernel arguments and it refuses to auto-unlock.
A default-deny firewall zone: every inbound connection is dropped unless explicitly allowed, and during an engagement the outbound allow-list is built from your signed scope. Blocking decisions are deterministic rules; the AI layer only explains, it never decides.
The root filesystem is immutable and updates arrive as whole signed images. A reject-by-default signature policy means a device refuses any update not signed with the Helius release key, and a boot health check rolls back automatically if an update misbehaves.
Runtime monitoring: privilege changes, module loads and changes to system settings are recorded as they happen, with eBPF-based process monitoring layered on top of the audit trail.
Proving to an organisation that a given device is a genuine, unmodified HeliusOS machine, using TPM remote attestation.
Evidence a sceptic can rerun
Every HeliusOS release ships an evidence pack, and every client assessment ships the same shape. The two commands below are what produced the numbers at the top of this page.
$ sudo heliusos-status --pretty baseline ACTIVE selinux=enforcing lockdown=integrity vault ACTIVE luks2 tpm2-sealed firewall ACTIVE inbound=DROP zone=heliusos integrity PARTIAL signature-policy=unset (dev build) shield PREVIEW tetragon=not-started auditd=active binding PARTIAL tpm=absent (vm) $ sudo heliusos-evidence openscap cis_server_l2 96.9% 374 pass 12 fail 53 n/a lynis hardening-index 84 1 warning 21 suggestions sbom spdx written cve grype 0 critical reachable pack /var/lib/heliusos/evidence/20261001T085921Z
After the assessment
Everything HeliusOS does for the assessment it can do for the laptops and servers that hold your secrets: one hardened image, encrypted disks sealed to hardware, signed updates that roll back on failure, and an evidence pack per release that answers the security questionnaire for you. The dashboard shows what is actually on, and the AI layer, Olo, explains an alert in plain language and proposes a step. A person presses the button. It never enforces on its own.
Early access. HeliusOS is at v0.1 and runs my own engagements. If you want it on your fleet, that is a conversation and a pilot, not a download button, and the roadmap above is what you would be buying into.
Security Centerv0.1Get HeliusOS
HeliusOS is sold as a pilot licence per device: the signed image, updates, the evidence pack for every release, and me on Helius Connect when something needs a human. There is no anonymous download, because the image is signed to you and the first boot is where most installs go wrong.
Tell me how many machines and what they do. You get a licence, a download link for the installer, and the one-line command that verifies the image signature before you trust it.
$ cosign verify --key heliusos-cosign.pub ghcr.io/heliusnetwork/heliusos:stable
Boot the installer. It erases the target disk, creates an encrypted root (LUKS2), and asks you for the passphrase and an admin user. No secret is baked into the image, so nothing I hold can unlock your machine.
clearpart --all --initlabel part / --encrypted --luks-version=luks2
Set the per-device root and bootloader passwords, then seal the disk to this machine’s TPM so it unlocks itself only on this hardware and only when the boot chain matches.
$ sudo heliusos-setup $ sudo heliusos-vault-enroll
From then on, at six every morning, the machine runs its own evidence pass and writes a report: the CIS pass rate and Lynis index with the change since yesterday, failing rules, any staged update, file integrity, failed logins and denied connections in the last 24 hours, and every layer’s real status. It lands in ~/HeliusOS Reports and, if the machine can send mail, in your inbox. The verdict is deterministic, so a quiet day reads Steady and a bad one reads Regressed before you have had coffee.
$ sudo heliusos-report --enable you@company.com Daily report enabled: 06:00 local time, /var/lib/heliusos/reports/<date>.html
| CIS Level 2 | 96.9% (no change) · failing rules 12 |
| Lynis | 84 (no change) · warnings 1 |
| Staged update | none |
| File integrity | no changes reported in 24h |
| Failed logins, 24h | 0 |
| Denied connections, 24h | 37 |
| Layers | baseline active · vault active · firewall active · integrity active · shield preview |
New images are signed, downloaded in the background, and applied on a reboot you plan. The boot health check runs on the way up; if it fails, the machine is back on the previous image before you notice. Every release ships its evidence pack, so the report you forward to a customer is always about the version you are running.
$ sudo bootc status booted heliusos:0.1 staged heliusos:0.2 (applies on next reboot)
Request the image
I reply within one business day with a licence proposal, the link and the verification command. Pilot pricing is per device per month and includes updates, evidence packs and support on Helius Connect.
HeliusOS is at v0.1. If your environment needs something it does not do yet, I will say so rather than sell it to you.
Start
Fixed prices on the main page. NDA before the first substantive conversation. All communication on Helius Connect, end-to-end encrypted.