You already own the controls. You don't have a plane to run them from.
Every organisation has firewalls, EDR, an IdP, vulnerability scanning, SIEM, PAM, and the security features already built into Linux and Windows. They are managed from a dozen consoles, by different teams, with different identities and no shared audit trail. USCP is the layer above all of it — one pane of glass, one policy and identity fabric, and one place where a response actually reaches every affected system.
Runs managed, self-hosted, or fully air-gapped — every capability, including licensing, works with zero egress.
Security tools consolidated the market. Nobody consolidated the consoles.
The estate is heterogeneous by nature
Native OS controls, open-source tooling, and third-party products, each with its own console, its own identity model, and its own idea of what an audit log is. That mix is not a failure — it is what a real estate looks like.
Response stops at the console boundary
Isolating a host means one tool. Blocking the indicator means another. Revoking the session means a third. The slowest part of an incident is a human moving between windows.
Nobody can prove what happened
Twelve audit trails in twelve formats is not an audit trail. When the regulator asks who did what, the answer takes a week of correlation.
Four planes, one identity, one audit trail
Not a replacement for your controls. The plane that operates them.
Estate management
Reach every system over SSH, WinRM, RDP, NETCONF/gNMI, SNMPv3, Redfish/IPMI, or an optional agent. Manage native Linux and Windows security features, open-source tools and third-party products as declarative desired state, with diff preview and one-click rollback.
Credentials are vaulted and injection-only — operators never see a secret. Every privileged session is brokered, recorded and command-mediated.
Workload segmentation
East-west flow telemetry, software and process inventory, application dependency mapping, and allow-list policy discovered from what your estate actually does — then enforced on host firewalls, cloud security groups and Kubernetes NetworkPolicy from one published policy.
Enforcement is monitor-only until you deliberately enable it, and refuses to run without a declared management network.
Detection & response
An OCSF-native security lake, detection-as-code with Sigma, ATT&CK coverage mapping, UEBA, identity threat detection, deception, threat intel over STIX/TAXII, and SOAR playbooks whose actions actually reach the estate rather than filing a ticket about it.
Governance & trust
Identity governance with joiner-mover-leaver, access certification campaigns, segregation-of-duties enforcement, DLP and egress governance, data residency, customer lockbox, and hold-your-own-key so the vendor cannot decrypt without your grant.
Three things most platforms in this category do not do
It drives the estate, it doesn't just watch it
Most consoles read from your tools. USCP writes to them: desired-state packs for OS security features, brokered privileged sessions, staged fan-out with a global kill switch, and dual-control approval on destructive operations.
Air-gap is not a special edition
Every one of the 104 capabilities works with zero egress, including licensing. Offline entitlement bundles, offline CVE feed import, and the same release stream as the connected product — not a stripped-down build.
It refuses to overstate itself
Availability is declared per capability and enforced by CI: a capability cannot claim GA in the docs and ship as a stub. Telemetry surfaces show an honest empty state rather than synthetic data. A posture score with no evidence reports unknown, never 100.
Three models, one release stream
The air-gapped install is not a different product with fewer features.
Managed
We run it. Tenant-isolated, region-pinned, with customer lockbox controlling any vendor access to your data.
Self-hosted
One signed static binary, Postgres, and your identity provider. Ships with SBOM, CBOM, VEX, SLSA provenance and a reproducible build you can verify bit-for-bit.
Air-gapped
Zero egress. Signed offline entitlement bundles, offline advisory feeds, in-perimeter telemetry collection. Release parity with the connected product is a binding requirement, not an aspiration.
Ask us to prove it
This is a technical product and it deserves a technical evaluation. A walkthrough covers the architecture, the estate channels against your own systems, and — if it is useful — the penetration-test and compliance position stated plainly.
Good first questions
Which of my existing tools does this replace, and which does it operate? What happens in an air-gapped site? What does a response action actually do to a host? How do I prove tenant isolation to an auditor?
What we will tell you unprompted
Which capabilities are Beta and what that means, that the estate plane requires an external penetration test before production, and that enforcement ships disabled by default.
Get in touch
Email hello@uscp.example with the shape of your estate — how many hosts, which operating systems, which security tools, and whether any of it is air-gapped.
Placeholder contact address — replace with the real inbox before this site is published.