Data sources
- Sensor heartbeats with content
- Integrity baselines
- Coverage expectations from the deployment plan
Capability
Sensor reliability, tamper detection and operational health
A monitoring system must notice when it goes blind. Sensor silence, tampering and degraded coverage are findings in their own right.
Available in current prototype
Integrity baselining and read-back proof of recording on every sensor; a silent sensor raises a finding.
Operational problem
The problem
An attacker who disables logging leaves no log of having done so. A sensor that fails quietly produces a clean report. Both look like safety.
Workflow
How it works
- Each sensor proves it is recording by producing evidence that can be read back, not by answering a ping.
- Watchers are placed outside the thing they watch, so a failure of the host cannot silence its own alarm.
- Gaps, silences and integrity changes are raised as findings with their own severity.
- Coverage is reported against what the deployment was meant to see.
Actionable outputs
- Blindness alarms
- Tamper findings
- Coverage reports
Trust boundary
Health checks run inside the customer's deployment; nothing reports to the vendor.
Benefit
Silence is never mistaken for safety.
Related
Other capabilities
- Counter-reconnaissance and behavioural detection Available in current prototype
- Threat hunting and historical investigation Available in current prototype
- Intelligence fusion and relationship discovery Available in current prototype
- Attack-path and exposure analysis Available in current prototype
- Active defence and controlled interdiction Available in current prototype
- Forensics, evidence integrity and reporting Available in current prototype
SOVEREIGN BY DESIGN.
Discuss this capability
Tell us what you need to protect. A briefing is an engineering conversation; it never needs your credentials, network inventories or logs.