Web Server Safeguard AI

WSS AI uses AI detection to respond instantly to new and evolving web shells and malicious URLs, keeping web businesses secure.

Watch video

Server attacks are surging: web vulnerabilities and web shells account for 56% of all breaches

Cybersecurity incidents in Korea reached an all-time high in 2024, with more than 56% involving server attacks that exploited web vulnerabilities and web shells.
As web server attacks grow more sophisticated, now is the time to defend with real-time detection and immediate blocking.

Cybersecurity incidents reported by year

*Source: KISA

Dozens of security solutions, yet web servers are still breached.

Firewalls, IPS, and WAF solutions have limitations in detecting web shell attacks disguised as legitimate files or altered to evade detection.
WSS AI runs inside the web server, using real-time AI detection to precisely identify threats that bypass perimeter defenses.

Architecture in which WSS AI detects and isolates web shell attacks that bypass firewalls, IPS, and WAF solutions in real time on the web server

Why choose WSS AI

Powerful AI-powered web shell detection

AI analyzes code intent and context to detect evolving and unknown web shells in real time
Machine-learning precision minimizes false positives and false negatives
LLM-based source code analysis provides detailed detection results

Resource optimization

Minimal server load through CPU and memory optimization
Runs with only 1% CPU usage

Cloud and container environments

Supports cloud scale-in and scale-out
Supports Kubernetes and Docker container environments using Sidecar and DaemonSet
Compatible with Windows, Linux, Unix, and other operating systems

Convenient management environment

One-click automatic isolation and report generation
Automatic detection pattern updates
Customer-specific maintenance support

Proven technology and stability

Korea's first web shell detection solution
Stability verified by first-grade GS certification
Technology proven by 12 patents related to web shell detection and restoration

External system integration and management

Integrates with external systems including SYSLOG, SMTP, APIs, and SOAR
Integrates with monitoring dashboards, ESM, email, and more
Fine-grained access permissions strengthen security controls

Can WSS replace a WAF?

A web application firewall (WAF) filters and monitors HTTP traffic to protect web applications from vulnerabilities such as SQL injection and cross-site scripting (XSS).

WSS provides an additional layer of web shell protection after the web firewall. UMV therefore strongly recommends using WSS alongside an existing WAF as a booster solution to reinforce protection against web shell attacks.

Doesn't a WAF also detect web shells?

A web application firewall (WAF) may provide limited web shell detection through pattern matching or anomalous traffic detection.

However, web shells are often obfuscated or use requests resembling legitimate code, making it difficult for a WAF to distinguish malicious activity from normal traffic.

UMV therefore recommends using WSS alongside a WAF to strengthen protection against obfuscated and fragmented web shells.

Doesn't server EDR also detect web shells?

Like a WAF, a server endpoint detection and response (EDR) solution provides limited web shell detection through anomalous traffic detection or pattern matching. However, web shells perform malicious activity within legitimate web server processes, so EDR often fails to detect them. Obfuscated web shells are particularly difficult for EDR to identify.

WSS uses a dedicated SCR parser and decryption engine to detect obfuscated and fragmented web shells in real time. It can immediately isolate and block them before suspicious activity begins.

We already have several agents installed on our web servers and WAS. Will adding another agent slow them down?

WSS requires an agent to be installed on each web server and WAS that needs protection.

The WSS agent is extremely lightweight and uses less than 1% CPU, minimizing resource consumption with no impact on normal web server or WAS operation.

Can WSS be used in every server environment?

The WSS agent can be deployed to web servers and web application servers (WAS) on any operating system that supports Java 1.5 or later, including Windows, Linux, and Unix.

Does WSS work in cloud environments?

Yes. WSS is available in both on-premises and cloud editions.
WSS Cloud includes every feature in the on-premises edition plus additional capabilities optimized for cloud environments.

Can we request a WSS demo or PoC?

Yes. We provide proofs of concept (PoCs) for both WSS On-Premise and WSS Cloud.
You can experience WSS firsthand and evaluate how it fits your IT environment.
Contact us anytime for more information about a PoC.

How much does WSS On-Premise cost?

WSS is available under a range of license models tailored to your requirements. Please contact us for detailed pricing information.