Glossary
The words, defined.
Terms used across the platform, the documentation and this website.
- Active defence
- Defensive action taken on the defender's own infrastructure in response to observed hostile activity — refusing, throttling, challenging, isolating. Never action against the source's systems.
- Air-gapped mode
- Operation with no network path to the internet. Updates and intelligence arrive on removable media.
- Alternative explanation
- A benign or different cause that would produce the same evidence, recorded beside every correlation.
- Appliance
- A dedicated unit running the platform on customer premises, owned and administered by the customer.
- Baseline
- The learned normal behaviour of a host or audience, against which deviation is measured.
- Chain of custody
- The record of who held, moved or changed evidence, from collection to report.
- Counter-reconnaissance
- Detecting and characterising an adversary's preparation — mapping, enumeration, observation — before an attack.
- Evidence grade
- Confirmed, supported hypothesis or unverified: the strength attached to every finding.
- Forced-command key
- A key that can run exactly one command on a server, from one address — used so a remote sensor can be read without being administered.
- Intelligence fusion
- Combining observations from different sources and hosts into one picture, with provenance kept.
- Interdiction
- A defensive control applied to traffic or sessions: refuse, throttle, challenge, isolate, revoke.
- Mirror port / TAP
- A passive copy of network traffic delivered to a sensor without placing it in the traffic path.
- Policy boundary
- The separate component that decides whether a proposed defensive action may execute.
- Private access key (Secure Channel)
- A high-entropy bearer credential that lets a visitor return to a conversation. It is not an end-to-end encryption key.
- Provenance
- Where a piece of evidence came from, when, through which sensor, and what transformed it.
- Relationship graph
- Nodes (sources, networks, documents, devices) and edges (shared attributes, timing) with confidence.
- Signed offline bundle
- A software update carried to the appliance by the customer, verified by signature on the appliance itself.
- Sovereign
- Under the customer's sole control: no vendor access, no vendor dependency, no vendor visibility.
- Threat hunting
- Hypothesis-led search through retained evidence for activity that automatic detection did not flag.
SOVEREIGN BY DESIGN.
Request a technical briefing
Tell us what you need to protect. A briefing is an engineering conversation; it never needs your credentials, network inventories or logs.