We map your network from the devices themselves — not from the diagram — and hand you a report that names every finding next to the evidence behind it.
The scale the instrument is built to work at. Measured against a real multi-vendor fleet, not brochure numbers.
Nobody documents a network that grew. The switch added during an outage, the link to the new building, the VLAN that was meant to be temporary — none of it is on the drawing, and the only place the truth exists is inside the devices themselves.
We ask them. Two addresses are enough to start: we log in, read the neighbours each device declares over LLDP and CDP, and walk outward until we stop finding new ones. What comes back is not an opinion about your network — it is what your network says about itself.
Finding them is half of it. The map is assembled in layers: the neighbours both ends declare, the links we verify by MAC against the forwarding database — that is how the firewall that speaks no LLDP shows up, with its exact port — the VSX, VSS, stack and MLAG clusters, and GRE and IPsec tunnels as their own layer. Whatever is left standalone hangs off whoever owns its gateway. A link makes it onto the drawing because it was measured.
Nothing to install on your devices. No licence, no dashboard to keep alive, no tool to learn — you get these documents. Not a slide deck with traffic lights either: every finding carries the device, the interface and the output it came from.
Deterministic: run by code, not by a judgement that varies with who is auditing or with the day. A selection by category below.
You are going to give us access to your devices. Whoever asks for that should be judged on what they cannot do, not on their feature list.
Every command comes from a whitelist: reads, plus the few mode changes some platforms need before they will show their configuration, each one named, and none of them changes a line of your configuration. You get that list, vendor by vendor, before we start, and your AAA logs can check every command against it. The test that enforces it walks the module instead of a hand-written list, so a command added later is checked whether or not anyone remembered.
The instrument runs inside your perimeter, on a machine you control. Credentials live in memory and are never written to disk. No configuration file from your fleet is uploaded anywhere: the only things that leave are a query to NVD by model and firmware version, and the download of the public CISA catalogue — never a configuration, an address or a hostname.
A failed authentication can log, alert, or lock an account out across your whole fleet — and that is the auditor causing an incident, not finding one. Vendor-specific accounts are tried only against their own vendor. There is no default username and no second password for the same user.
A fleet-wide silence is a broken measurement, not a state of the network: the instrument refuses to overwrite good data with it and carries that refusal in its exit code. A measurement that failed says so; it never dresses up as a healthy network.
Nothing is installed on your devices. No outage window is needed: these are the same sessions anyone opens to look at a configuration, and nothing we run can modify a device.
One fixed price per audit, set by device count and agreed before we start. No licence, no subscription.
A written authorisation naming the ranges and the dates, and a non-disclosure agreement. Not one device is touched before both exist.
An account you create and remove yourself, with the exact command list in hand. You choose the addresses and the ports. Two devices are enough to start — the crawl finds the rest.
It runs on a virtual machine you provide, inside your network, and nowhere else. It collects, scrubs the passwords, parses and builds the graph; each stage writes a file the next one reads, and nothing is inferred that could be read.
The map, the findings with their evidence, and the exposure inventory. Over a short call if you want, but the report stands on its own.
What was collected stays on your machine for the next pass, or is deleted and confirmed to you in writing. We keep nothing.
A second pass is not another audit from scratch — it is the delta. What changed, what got fixed, and what is new, and it costs less than the first.
A network that grew is a mixed network, and that is exactly where a single-vendor tool gives up. Each brand brings its own command set, its own way of spelling LLDP, and its own parsing branch.
On the network side, that is all a first pass needs. Tell us what you have and what you suspect, and we will come back with what your network actually says.
You do not need an inventory, a device list, or the old diagram. If the diagram existed and were right, none of this would be necessary.
The first pass only ever reads: it changes nothing, installs nothing, and needs no maintenance window.
Or write to us: [email protected]