Facts and evidence
What Legit AI has proved, how each figure was measured, how to check it on your own platform, and what it does not claim.
These are the figures behind the Facts page, with the conditions they were measured under. Anything not listed here is not claimed.
What was measured
Section titled “What was measured”| Measure | Result | Conditions | Date |
|---|---|---|---|
| Storing events | 6,780 a second | One server, one SQLite database in WAL mode | 31 Oct 2026 |
| Detection, all layers | 170 events a second | Same server, ordinary events | 31 Oct 2026 |
| Detection when each event opens an alert | 77 events a second | Same server | 31 Oct 2026 |
| Back after a crash | 4 s | Process killed, restarted by Docker; 1.07 GB database on a work machine | 31 Oct 2026 |
| Full stop and start | 26 s | Same | 31 Oct 2026 |
| Live backup, nothing stopped | 7 s | Same | 31 Oct 2026 |
| Restore from a backup | 28 s | Same, including a safety copy and restart | 31 Oct 2026 |
| Isolating a real Windows host | About 3 s | Agent 1.1.0, live in production | 3 Oct 2026 |
| Releasing it by hand | 8 s | Same run | 3 Oct 2026 |
When detection falls behind, events wait in a durable, bounded queue and processing carries on after a restart. A full queue answers 503 with Retry-After.
Times do not include a person noticing, or preparing a new server. A slower server takes longer.
What was run for real
Section titled “What was run for real”| Run | Result | Date |
|---|---|---|
| Air-gapped build and installation | Completed end to end, readiness report “ready”; eleven defects found and fixed | 15 Oct 2026 |
| Isolation, then release when time ran out | The agent lifted it by itself, with no command | 3 Oct 2026 |
| Stopping a process through the console | Requested, approved, carried out by the agent | 3 Oct 2026 |
Network sensor against a real nmap scan |
Caught end to end | 26 Jul 2026 |
| Router read | RouterOS 7.16.2, OpenWrt 24.10.4, OPNsense 25.7, UniFi 9.0.114 | 1 Nov 2026 |
What the tests cover
Section titled “What the tests cover”| Check | Result on 6 November 2026 |
|---|---|
| Backend tests | 7,172 passed |
| Browser tests | 106 passed |
| Detection rules | 62 of 62 pass validation, each with test events |
| Organisation boundary | About 630 calls as another organisation’s administrator, on every run |
| Known vulnerable dependencies | 0 in npm, Python and Go |
Check it yourself
Section titled “Check it yourself”-
An event becomes something you can see. In Data sources, press Send a test event, then open Event Explorer. See Quickstart.
-
An isolation lifts itself. Isolate a test machine for a short time and wait. The agent releases it without being told. See Isolation and process kill.
-
A changed update is refused. In Settings → Offline updates, upload a bundle with one file changed. The check refuses it. See Offline updates.
-
A recording says if it was altered. Replay a terminal session: the replay recomputes the hash taken when the session ended. See Secure terminal.