Skip to content

Local AI Models: Is a Device Ready?

Last verified against code and its unit tests on 2026-10-16. Nothing on this page has been run on an installed endpoint yet, and nothing on a Windows host. Local detection-model packs on desktop endpoints remain PoC/demo on the capability status page.

When a CyberArmor.AI tenant opts in, each endpoint downloads a signed, encrypted model pack and the local engine runs the detection models on the device. This page explains how a person at the device, and support, can tell when those models are ready, and what every other answer means.

What "ready" means

An endpoint is ready only when the local engine itself, asked just now, says that:

  1. it re-verified the signed model pack (signature, digest, rollback floor, and the device-bound key that decrypts it), and
  2. every model the tenant selected is loaded. The PHI model (ner_phi) is the one exception: the engine loads it the first time a redaction needs it, by design, and it is shown as "on demand".

"Installed" is not "ready". The agent can finish downloading and verifying a pack before the engine has loaded anything, so the download finishing is not reported as ready.

State What it means What to do
ready verified pack, selected models loaded nothing
downloading the agent is fetching the pack (bytes and percentage shown) wait
verifying every file is being checked against the signed pack, or the engine is decrypting it wait a minute
loading verified; some models are not loaded yet wait a minute; on agent 1.0.12 the first AI request loads them
absent no pack is installed yet see "When does a device download?" below
not_entitled the organisation has not opted in, or has no pack published an administrator enables local models for the tenant
unavailable this device cannot hold a pack (for example, no local engine installed) check the device's platform and agent version
failed a download, a verification or a model load failed; the reason is shown send the check output to support
unknown nothing could be read: the local engine did not answer, or the status file is out of date check that the agent is running

What the user sees

From agent 1.0.13, the macOS menu bar and the Windows tray show one line:

Local AI models: ready (4 of 4 loaded, 1 on demand)
Local AI models: downloading 44% (1.4 GB of 3.1 GB)
Local AI models: failed (the download failed (HTTP 503))

When the models first become ready, each user is told once: "CyberArmor.AI local protection models are ready — checks now run on this device". A new pack version announces again. If the models cannot be made ready, the user is told once per pack and reason. Nobody is notified while the answer is unknown.

On Windows the notification is a balloon from the notification area. It has not yet been seen on a Windows host.

Checking a device (support)

The check scripts are read-only and need no administrator rights on macOS or Linux. They exit 0 when ready, 1 when not ready, and 2 when nothing could be read, so a remote-management tool can act on the result.

# macOS / Linux
/usr/local/cyberarmor/scripts/check_local_models.sh
/usr/local/cyberarmor/scripts/check_local_models.sh --watch     # re-check every 15 s until ready
/usr/local/cyberarmor/scripts/check_local_models.sh --json

# Windows (the script is unsigned, so allow it for this one process)
powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Program Files\CyberArmor\scripts\Check-LocalModels.ps1"
powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Program Files\CyberArmor\scripts\Check-LocalModels.ps1" -Watch

The report shows the pack and tier, the state, bytes downloaded against bytes expected, whether the pack was verified, which models are loaded, and how many AI requests over the last 60 minutes were decided on the device (with the models, or with rules only) versus by the CyberArmor.AI service (--minutes changes the window).

When administrator rights help (Windows). The script confirms that the program answering on the local engine's port is the real engine, which runs as SYSTEM. Windows may refuse that check to a standard user. The script then uses the answer the agent published (the agent reads the engine as SYSTEM) and says so. Run it as administrator to read the engine directly.

Older agents. The scripts run from a copy of the repository against an agent 1.0.12 endpoint too. That version does not publish its download progress, so the download line says "not reported", and its menus have no models line.

When does a device download?

Without a push, an endpoint checks for a new pack once a day, inside the tenant's window (by default 02:00–05:00 in the device's local time, at a per-device offset so a fleet does not download at once), or after 36 hours without a check. Push update now in the console starts a download within about a minute. A failed download is retried at the next window or the next push. A device that already holds most of a pack downloads only the files that changed.

Downloads are served by the CyberArmor.AI control plane, so pushing a new pack to many devices at once puts all of those downloads on it at the same time. Prefer the nightly window for a large fleet.