Guides for every stage of an evaluation.
Deploy the sensor
One binary per OS for Windows, Linux & macOS. Push via Intune, Jamf or SCCM. Restarts after a crash or reboot; updates are pinned by version and verified, staged by your tenant’s update policy or pushed by MDM. Permissions are documented per OS.
How it fits together
Data pipeline, the AI attack path, the trust boundary, and the observe-vs-enforce separation, as real diagrams, not paragraphs.
Wire it into your stack
Jira & Slack ship today (configure in the app, or with environment variables); SIEM/SOAR export (Splunk, Sentinel, QRadar, Elastic, Chronicle), OCSF and webhooks are live. ServiceNow bidirectional read-back and ownership sync, and EDR/ITSM coverage reconciliation (CrowdStrike, Defender, ServiceNow), are live today. ServiceNow tickets, read-back and owner sync are configured in the product by URL and login; there is no packaged ServiceNow app. Roadmap A packaged ServiceNow app is planned. Roadmap Native Sentinel, QRadar and Elastic outputs are built and in validation.
Access & policy
Role-based access (Viewer / Analyst / Admin / Owner, plus Platform Admin) and custom roles, TOTP MFA, org management, SLA policy, audit log. SSO (SAML and OIDC) + SCIM 2.0 are live (Discover + Warn + Block). Sign-in can be limited to the email domains you list.
Data handling
What’s collected and what’s never collected, encryption in transit/at rest, tenant isolation, in-VPC option, retention & deletion.
Programmatic access
Live A versioned /api/v1 REST API with scoped service-account keys to pull risk scores, findings, inventory and cloud posture into your own dashboards, plus webhooks for events.
The short version.
The details a security or endpoint team asks for first, in a sentence each. The full tables come with the demo and technical pack.
| Topic | Short answer |
|---|---|
| Collection | The sensor reports on a regular schedule and shows up as stale in the console if it stops. |
| Network | Outbound secure connections to your collector only. The sensor opens no port reachable from the network. |
| Updates | Updates are signed and pinned, and your tenant policy decides who gets a build and how fast. Windows builds and macOS builds are code-signed (macOS: Apple Developer ID, notarized). |
| Privileges | The service runs with elevated rights, because discovery has to read other users' files. Enforcement actions are opt-in and operator-authorized. |
| Permissions | For each operating system, the sensor lists what it needs permission to read or change, and a built-in check reports what is missing. On macOS, allow it Full Disk Access, or deploy a privacy profile from your device-management tool, so it can read Documents, Desktop and Downloads. |
| Commands | Pause, revoke and enforcement are operator-authorized and audited. |
Deployment topology, HA/DR, scaling limits, a security questionnaire: ask us and we’ll get it to you.
See the AI on your fleet in about a week.
Run the sensor across your estate and receive an AI risk report and an AI Bill of Materials. The assessment is free and carries no commitment.