Platform

How it reaches your systems, and what it does when it gets there

Estate management

Declarative desired state for the security controls you already own, applied over the channel each system actually speaks.

Vaulted and injection-only. No API returns a secret; external PAM is dereferenced at connect time.

Brokered, recorded and command-mediated. Recording cannot be disabled.

Diff preview, dry run, commit gate, prior state captured, one-click rollback.

nftables, SELinux/AppArmor, auditd, PAM, SSH hardening, fapolicyd, LUKS status, CIS.

Defender, Firewall with Advanced Security, BitLocker, AppLocker/WDAC, ASR, STIG.

Import an OpenAPI document; get a working admin page for that device, with quotas and dual control.

Learn what talks to what, propose the allow-list, show what enforcing it would break — then enforce, if you say so.

Discovery is deterministic: the same window and metadata always produce the same policy, so it can be diffed and reviewed like code.

OCSF-native, tiered storage, federated query across your own lake.

Detection-as-code with Sigma, plus an ATT&CK heatmap that shows the gaps.

Playbooks whose actions reach real hosts. OpenC2 and CACAO interop.

Triage and response agents with confidence thresholds and a kill switch.

EASM and CTEM with attack paths to crown-jewel assets, and safe-exploitation validation.

STIX/TAXII, IoC lifecycle, honeytokens with high-fidelity alerting.

Joiner-mover-leaver with ≤60s session revocation; certification campaigns that auto-revoke.

Toxic-combination enforcement across module boundaries, not just within one app.

Region residency, customer lockbox, BYOK and hold-your-own-key.

Append-only hash-chained bus, signed SLA reports, time-boxed auditor role.

Signed releases with SBOM, CBOM, VEX, SLSA — and a reproducible build.

Org hierarchy, delegated admin, deterministic entitlement merge, co-managed SOC.