No vendor cloud
There is no tenant to sign up for and no account on our side holding your data.
Nothing to sign up for
Unified endpoint security
Self-hosted
Replace ten security tools
on your own server.
One agent on every computer and one console to run it, on a server you own. Your data stays where you put it.
0
Connections to us
10+
Tools replaced
60 s
Between reports
What you run
Your server
Laptops
one agent
one agent
Servers
one agent
one agent
Web firewall
optional
optional
Load balancer
optional
optional
Runs on
Your server
Installs in
5 minutes
Sends us
Nothing
Logins
One
One console covers the whole estate
01What it replaces
One product,
instead of ten.
Each of these is usually a separate product with its own agent, its own login and its own renewal date. Here they come as one.
Antivirus and malware protection
Drop the separate antivirus subscription and its agent.
Detection and response
Investigate and contain threats without a second security console.
Patch management
Stop paying for a patching tool. Updates install on your schedule.
Software deployment
Push software to every computer and give staff a self-service app store.
Application control
Decide what is allowed to run, without an allowlisting product.
USB and device control
Block unapproved USB drives without another add-on.
Data loss prevention
Stop sensitive files leaving, without a standalone DLP licence.
Password vault and admin access
Store admin passwords and record admin sessions without a separate vault.
Compliance and audit evidence
Stop gathering audit evidence by hand before every review.
Device management
Manage Windows and mobile devices without a separate MDM subscription.
Also included: disk encryption reporting, backup and disaster recovery, asset and software inventory, an IT help desk for staff requests, and a web application firewall with load balancer.
02Your server
It runs on your server.
Your data stays there.
You install it on one Linux server that you control, and everything it collects lives there.
Nothing phones home
It makes zero outbound connections to us, and your security reviewer can confirm that at the firewall.
On your terms
You hold the data
Records, logs and recordings sit on hardware you own, under your own access rules.
On your terms
03Zero trust
If it is not on the list,
it does not run.
Nothing is trusted by default: not a program, not a device, not a connection, not an administrator.
Approved software only
A program runs only if you have allowed it, and everything else is blocked.
On the device
Approved devices only
A USB drive or other device works only if it is on your approved list.
On the device
Every login checked
Each administrator login is checked before it gets in, whoever it is and wherever it comes from.
In the console
Every action recorded
Each administrator action is logged and sensitive sessions are recorded, so you can see who did what.
Ready for the auditor
04Automation
Set the rules once.
It does the rest.
You decide the policy, and the routine work happens without anyone remembering to do it.
Policies apply themselves
Set a policy once and it reaches every computer it covers, with nobody pushing it by hand.
Hands off
Patches on your schedule
Updates install in the window you set, not in the middle of someone’s working day.
Hands off
Compliance checks keep running
Checks against eight included frameworks run continuously, so the evidence is ready when the auditor asks.
Eight frameworks
One queue for problems
Anything that needs a person lands in one queue, not in ten inboxes.
One place
Next Coming soon
AI agents
The automation above is rule-based, and it ships today. On top of it we are building agents that take on the routine triage: reading what came in, grouping what belongs together, and putting a recommendation in front of the person who decides.
Not in the product yet. This page will keep saying so until it is.
- Triage of what arrives in the queue
- Grouping related findings into one case
- A recommended action, for a person to approve
05In detail
The five people
always ask about.
If you already run one of these, this is the part that replaces it. Named products are here as a reference point, not a comparison.
Application and device control
If you run ThreatLocker today, this is the equivalent
An allowlist decides whether a program may run at all. A ringfence decides what it may do once it is running. Putting Word on the allowlist does not stop Word launching PowerShell. A ringfence does.
- Allowlisting by hash, path, publisher or parent process
- Ringfencing stops an allowed app reaching files, other apps or the network
- Learning mode watches first and records what would have been stopped
- Elevation lets a named app run as admin without the person being one
- USB and storage blocked, or forced read-only, per policy
- Network and web control by category and country
- Browser extensions blocked across the fleet
- Configuration drift reported against your baseline
Code and cloud scanning
If you run Aikido or Snyk today, this is the equivalent
For teams who write software as well as run it. The scanners are the open-source engines you would pick anyway, run from the agent you already have on the build machine, with the findings landing beside everything else about that host.
- Source code scanned for insecure patterns, with Opengrep
- Dependencies checked for known vulnerabilities, with Trivy
- Secrets found before they reach a repository
- Infrastructure code and container images scanned the same way
- Licences listed, and a software bill of materials produced
- Running applications probed with ZAP, exposed surface with Nuclei
Scanners install on the machines you choose. No pull request is opened for you: findings are reported, not fixed.
Web application firewall
The filter in front of your web application
Coraza with the OWASP Core Rule Set, in front of a site you choose. It starts in detect mode, so you see what it would have blocked before it blocks anything.
- OWASP Core Rule Set for injection, scripting and the rest of the top ten
- Detect first, then move a site to blocking when you are ready
- Per-site policy, so one noisy application does not loosen the others
- Rule suppression for the false positive your app always triggers
- What it caught arrives in the same findings list as everything else
Application delivery
If you run an A10, F5 or NGINX Plus today, this is the equivalent
A load balancer that takes its whole configuration from the console: ports, backends, certificates and rules. You edit, you publish, and the screen tells you what is actually running rather than what you last saved.
- Load balancing across your backend pools, with health checks
- TLS certificates issued, renewed and deployed from one place
- Traffic rules for routing, redirects and headers
- High availability and failover between nodes
- Global traffic steering across sites
- Versions kept, so you can see what changed and go back
Virtualization
If you run VMware vCenter today, this is the equivalent
Your hosts and the virtual machines on them, managed from the same console as the laptops. For teams looking at what VMware now costs them, this is the part worth a conversation.
- Virtual machines created, powered, moved and snapshotted
- Hosts and clusters with capacity and headroom
- Placement and automatic balancing across hosts
- High availability, with maintenance mode that drains a host first
- Networks, firewall rules and VPN between sites
- Storage, snapshots, replication and protection plans
Three of these manage something outside the console and show real data only once it is connected: the web application firewall, application delivery and virtualization. Until then, virtualization shows a sample set and says on screen that it is a sample. Connecting them is a job for whoever runs your server, not something you do from a screen.
06In the console
Twelve areas,
one login.
What your team actually sees. Each area has its own permissions, so people see only the parts they work in.
Devices
Every computer you manage, what is on it, and whether it reported in.
Threats
What was found, what it did, and what you can do about it from here.
Patches
What is missing, what it fixes, and when it will install.
Software
What you deploy, what staff can install themselves, and what is banned.
Compliance
Eight frameworks, checked against the machines, with the evidence kept.
Endpoint control
What may run, what may connect, and what may be plugged in.
Zero trust lives here
Privileged access
Admin passwords in a vault, borrowed for a window, with the session recorded.
Backup & recovery
Backups, restore points and the plan for the day you need them.
Virtualization
Your hosts and the virtual machines on them, in the same place.
Support
Requests from the people at the computers, and your answers back.
Reports
Reports, dashboards, and a log of every administrator action.
Admin
Your people, their roles, and how they sign in.
07Questions
What buyers ask
before they ask us.
Including the ones your security reviewer will send back. Longer answers are in the documentation.
01Where does our data go?
Nowhere. It runs on your own server and stores everything there. There is no vendor cloud and no tenant on our side. It makes zero outbound connections to us, which your security team can verify at the firewall.
02What do we need to run it?
One Linux server for the platform and one agent on each computer. That is the whole footprint. The first computer can be reporting in about five minutes.
03Does it really replace ten tools?
Antivirus, detection and response, patching, software deployment, application control, USB control, data loss prevention, a password vault, compliance evidence and device management are all in the one product. Backup, inventory and an IT help desk are included too.
04Do we have to switch everything at once?
No. Each area works on its own. You can start with one, such as patching or inventory, and retire your other tools as their renewals come up.
05What does zero trust mean here?
Nothing is allowed by default. Software runs and devices connect only if they are on your approved list. Every administrator login is checked, and every administrator action is recorded.
06Which compliance frameworks does it cover?
Eight are included: ISO 27001, SOC 2, PCI DSS, HIPAA, GDPR, NIST CSF, the CIS Controls and the Essential Eight. Checks run continuously, so evidence builds up as you go.
07How much work is it to keep running?
Less than the tools it replaces. Policies apply themselves, patches install in the window you set, and compliance checks run continuously. Every computer reports in every 60 seconds, and anything needing attention arrives in one queue.
08How do we know what our own admins did?
Every administrator action is logged against the person who took it. Sessions that use stored admin passwords can be recorded and reviewed later.
Try it
Your first computer reporting
in five minutes.
Put it on one Linux server, add the agent to one computer, and see it for yourself. Nothing is enforced until you decide it is.
0
Sent to us
5 min
To the first one