RoamSwitch OS
A security-focused OS based on Arch Linux
Built around RoamSwitch, with OS-level defenses in from the start, and planned as a live and installer ISO.
Enforced access control
AppArmor and fapolicyd, enforced at the level you choose.
Detection and forensics
auditd with lightweight Sigma rules, monitoring of persistence, LD_PRELOAD and memfd, and honeytokens. A decoy access also records the accessing process's parent chain and leaves a note suggesting a lockdown (nothing is triggered automatically).
Disk encryption
LUKS2 with automatic TPM2 unlock. The passphrase stays for recovery.
Threat hunting over MCP
LLM agents can query forensic data.
Three security levels
Standard, Balanced (default) or Maximum, chosen at install time.
Security tools and guides
Bundles 265 BlackArch network tools, 258 of them with explanations in 10 languages: the weakness targeted, how it is used, and what defenders can watch for.
Planned as a free, limited release for research and experimentation. Not recommended for production or critical use.