Resources
Technical resources
Planning tools, explorers, policies and references. Everything here works in your browser without sending anything anywhere.
Threat visibility coverage
What each log or sensor source can and cannot reveal.
Offline update and authenticity centre
How signed releases are published and verified.
Responsible disclosure
How to report a vulnerability and what to expect.
Glossary
The terms used across the platform and this site.
Deployment planner
A browser-only planning brief for your environment.
Synthetic investigation
An interactive demonstration on fictional data.
Trust-boundary explorer
Every path a deployment has — and does not have.
Standards we work to
External references
- MITRE ATT&CK — Adversary tactics and techniques knowledge base
- MITRE D3FEND — Knowledge graph of defensive countermeasures
- OWASP ASVS — Application Security Verification Standard
- The Update Framework — Framework for securing software update systems
- W3C WCAG 2.2 — Web Content Accessibility Guidelines
- RFC 9116 — security.txt: a file format to aid in security vulnerability disclosure
- NIST SP 800-61 — Computer Security Incident Handling Guide
- NIST SP 800-92 — Guide to Computer Security Log Management
- Samuel, Mathewson, Cappos and Dingledine (2010) — Survivable key compromise in software update systems, ACM CCS 2010 — the research behind The Update Framework
- Air gap (networking) — Encyclopaedic overview of physically isolated networks
SOVEREIGN BY DESIGN.
Request a technical briefing
Tell us what you need to protect. A briefing is an engineering conversation; it never needs your credentials, network inventories or logs.