Fleet
Edge kits at every plant
- Mode A: Core in cloud, Edge on-site.
- Mode B: Core + Edge sovereign / air-gap.
- Certs and firmware tracked per node.
Deployment
Cloud, sovereign, or somewhere in between.
Edge stays at the plant DMZ. Core can live in cloud, sovereign region, or fully on-prem and including air-gap.
Fastest start
Hybrid Cloud (Mode A)
Core hosted in cloud; Edge on-site.
Best for: Mid-market, fast PoV
Full control
Sovereign On-Prem (Mode B)
Core + Edge at customer site.
Best for: Air-gap, data sovereignty
Maximum isolation
Dedicated Single-Tenant
Isolated VPC and database per customer.
Best for: Banks, national utilities
Balanced
Hybrid Edge + Sovereign Cloud
Edge stays local; Core runs in a sovereign cloud region.
Best for: National utilities
Partner ready
MSSP BYOC
MSSP hosts the platform under an Axix license.
Best for: Service providers
How it works
Typical go-live in 7 weeks.
Week 0
MSA + DPA signed
Week 1–2
Infrastructure provisioned, tenant created
Week 3–4
Edge install, ingest validation
Week 5–6
UAT
Week 7
Go-live + 30-day hypercare
Collectors
Health during roll-out
- Uptime, last event, degraded flags during week 3–4 install.
- Protocol parsers validated per site.
- Offline SQLite buffer if Core is unreachable.
SLA tiers
Standard, Enterprise, Critical Infrastructure.
| Tier | Uptime | P1 response | Support |
|---|---|---|---|
| Standard | 99.5% | 4 hours | Business hours |
| Enterprise | 99.9% | 1 hour | 24×5 |
| Critical Infrastructure | 99.95% | 30 min | 24×7 |
Config
Platform health for the tenant
- Tenant-admin sees config without Super Admin.
- Dedicated single-tenant option for banks and national utilities.
- Typical go-live in 7 weeks.
Prerequisites
What we need from you before week one.
Runtime path
What happens to a packet after go-live.
01
Capture
Edge mirrors traffic from a SPAN port or hardware TAP at the industrial DMZ and parses OT protocols locally.
02
Buffer
Events land in a SQLite WAL store-and-forward queue (~5,000 events) so a link outage never loses telemetry.
03
Transport
HMAC-SHA256 signed batches, optionally mTLS, are shipped to Core over the ingest network only.
04
Enrich
Threat-intel fusion adds OTX, Abuse.ch, ThreatFox, MITRE TAXII, and GreyNoise context in flight.
05
Correlate
Cascading W15 / W60 / W24 windows assemble events into kill chains and flag Enterprise→OT pivots explicitly.
06
Decide
Risk scoring, compliance auto-mapping, and Temporal playbooks with human approval and OPA guardrails.
07
Seal
Detections, approvals, and denials are hash-chained and Ed25519-signed into the evidence vault.
FAQ
Frequently asked questions.
Start your 7-day free trial.
A dedicated CyberDragon tenant on your own traffic and not a slide deck. See kill-chain cyber defense on your network.