Operational interdependence
Response depends on evidence, evidence on sensing. The platform reports when a dependency is missing — a silent sensor makes the response layer more cautious, never more aggressive.
Platform
One platform. Every stage under your control.
Sensors, ingestion, evidence, intelligence, policy and response — designed as separate components with separate permissions, so a failure or a compromise in one does not become control of the others.
Domain architecture
The components
| Component | What it does | Status |
|---|---|---|
| Sensors and agents | Server log readers, page-level behaviour beacons served from the protected site, endpoint agents, DNS and firewall log collection, and passive network mirroring where the customer provides a TAP or mirror port. | Available in current prototype |
| Hardened ingestion | Every input is treated as potentially hostile, including log content written by an attacker. Parsing is strict, size-bounded and isolated from analysis and from response. | Available in current prototype |
| Normalisation and time | Events are aligned to one clock with their original timestamps preserved, so sequence survives across hosts with different clocks. | Available in current prototype |
| Local evidence store | Per-host, append-only retention. Each protected system keeps its own history; correlation reads it without rewriting it. | Available in current prototype |
| Graph and intelligence models | Relationships between sources, networks, documents, devices and time, each with a confidence grade and its alternatives. | Available in current prototype |
| Investigation workspace | Window replay, relationship expansion, hypothesis notes and case reports. | Available in current prototype |
| Policy boundary | A separate component that holds the customer's defensive policy and decides whether a proposed action may run. The analysis engine cannot bypass it. | Available in current prototype |
| Defensive actuators | Edge refusal, challenge and throttle; host isolation and session revocation through customer systems. | Available in current prototype |
| Auditing | Every observation, proposal, decision and action is recorded with its reason and its approver. | Available in current prototype |
| Recovery | Verified restore of configuration, evidence and policy, rehearsed rather than assumed. | Available in current prototype |
Scope limitations
The platform sees what its sensors see. Encrypted payloads stay encrypted; a host without an agent shows only its network behaviour. The coverage explorer lists what each source can and cannot reveal.
Hostile input
Log content is written by whoever made the request, including attackers. Every field is data, never instruction — to the parser, to the analysis engine and to any automated reasoning layered on top.
SOVEREIGN BY DESIGN.
Request a technical briefing
Tell us what you need to protect. A briefing is an engineering conversation; it never needs your credentials, network inventories or logs.