One plane, four jobs, 104 capabilities
Every capability is separately licensable, declares its own API and UI surface, states whether it works air-gapped, and carries an availability level that CI refuses to let the documentation overstate. What follows is what is in the product today.
How it reaches your systems
Agentless first. An agent only where an agentless channel genuinely cannot do the job.
| Channel | What it manages |
|---|---|
| SSH | Linux and Unix native security features and open-source tooling |
| WinRM / PowerShell | Windows security configuration, programmatically |
| RDP | Interactive Windows work — brokered and recorded, fallback only |
| NETCONF / RESTCONF / gNMI | Network devices, with candidate → commit-confirmed → rollback |
| SNMPv3 | Read and trap. v1 and v2c are refused outright |
| Redfish / IPMI | Out-of-band hardware; destructive actions need four-eyes approval |
| API | Third-party security products through certified connectors |
| Agent optional | Where no agentless channel suffices — same signed update path, documented resource ceilings |
Reach and operate every system in the estate.
Discovery & inventory
Live estate inventory with tags, criticality, region and reachability.
Credential custody (PAM)
Vaulted, injection-only credentials. Operators never see a secret; external PAM is dereferenced at injection time.
Brokered sessions
Every privileged session is brokered, recorded and command-mediated. Recording cannot be disabled.
Six channels
SSH, WinRM/PowerShell, RDP, NETCONF/RESTCONF/gNMI, SNMPv3, Redfish/IPMI — plus an optional agent.
OS security packs
Declarative desired state for Linux (nftables, SELinux/AppArmor, auditd, PAM, fapolicyd, CIS) and Windows (Defender, WFAS, BitLocker, AppLocker/WDAC, ASR, STIG).
Open-source & third-party packs
Manage Suricata, Zeek, Wazuh, osquery, Falco and friends; certified connectors for NGFW, EDR/XDR, IdP, CASB, vuln management and SIEM.
Estate-wide policy & response
One action fans out across native, open-source and third-party targets, with staged rollout, per-target reporting and a global kill switch.
Device Console
Import an OpenAPI or Swagger document and the platform generates a working admin page for that device — with execution, egress allow-listing, quotas, scheduling and dual-control approval.
Know what talks to what, then stop the rest.
Flow fabric
NetFlow v5/v9 and IPFIX collection plus agent/eBPF ingest. Coverage reporting names the workloads that are dark rather than hiding them.
Software inventory & CVE exposure
Per-host packages joined to a live NVD/OSV feed with real version-range matching. Air-gapped sites import the feed offline.
Process & hash sensor
Running processes with executable hashes, reputation verdicts, and forensic rules mapped to MITRE ATT&CK techniques.
Application dependency mapping
Clusters observed communication into applications and tiers, seeded from your own CMDB and Kubernetes labels. Deterministic: the same window always yields the same map.
Policy discovery
Generates an allow-list from observed behaviour, merged with your intent. Your rules survive re-discovery; discovery never publishes.
Impact analysis & compliance
One evaluation, two uses: against a draft it tells you what enforcement would break; against the published policy it tells you what is happening that you never intended.
Enforcement
Host firewall (iptables/nftables, Windows Firewall), AWS security groups, Azure NSGs, GCP firewall rules, and Kubernetes NetworkPolicy — from one published policy.
Policy-intent egress
Publish computed intent to NGFWs, ADCs and the fabric over webhook or Kafka, or export it as PAN-OS or iptables. A rule that cannot be expressed faithfully is reported, never silently dropped.
Find it, decide about it, act on it.
Security data lake
OCSF-native ingest with tiered storage and retention classes; federated query across your own lake.
Detection hub
Detection-as-code lifecycle with Sigma, plus an ATT&CK coverage heatmap that shows the gaps.
SOAR & case management
Playbooks whose actions reach real hosts, cases with evidence custody and war rooms, and standards-based interop (OpenC2, CACAO).
Agentic SOC
Triage, investigation and response agents with confidence thresholds, scorecards and a kill switch.
UEBA & ITDR
Behavioural analytics over the real log store and identity threat detection over the audit log — explainable, not black-box.
Exposure management
EASM and CTEM with attack-path analysis to crown-jewel assets, and continuous safe-exploitation validation.
Deception & DRP
Honeytokens and lures with high-fidelity alerting; digital risk protection over external exposure.
Threat intelligence
STIX/TAXII ingest, IoC lifecycle, and opt-in privacy-preserving cross-tenant indicator sharing.
Prove who can do what, and what was done.
Identity governance
Joiner-mover-leaver with ≤60s session revocation, access-certification campaigns that auto-revoke what nobody attests to.
Segregation of duties
A toxic-combination engine that blocks conflicting grants across module boundaries, not just within one app.
DLP & egress governance
Classification-driven policy that blocks exfiltration over brokered sessions and raises a response.
Sovereignty
Region residency matrix, customer lockbox for vendor access approval, BYOK envelopes and hold-your-own-key.
Audit & evidence
An append-only hash-chained audit bus, signed SLA reports, and a time-boxed auditor role with an evidence locker.
Supply chain
Signed releases with SBOM, CBOM, VEX and SLSA provenance, plus a reproducible build you can verify bit-for-bit.
MSP & multi-tenancy
Org hierarchy with delegated admin, channel/parent/child entitlement merge, and a co-managed SOC surface for vendor analysts.
Metering integrity
Tamper-evident usage metering with signed rollups a customer can reconcile independently — billing disputes have evidence, not assertions.
What GA and Beta actually mean here
Stated per capability, and enforced by the build.
GA — 20 capabilities
Production-ready. Durable state, hardened, documented, and covered by the customer handoff guides.
Beta — 84 capabilities
Shipped with real logic, real persistence and real tests — pending pre-production hardening. Not a stub, and not a promise: you can call every one of them today.
The claim is checked by CI, not by us
A release gate reconciles the capability matrix against the entitlement registry, the module manifests and the actual registered routes. A capability cannot claim an availability level it does not have, and a shipped module cannot reference a capability marked Planned. Drift fails the build.