CEDX Endpoint · IT & Security
CEDX Endpoint scores every device for exposure, tracks patch lag in days, and puts an agent's verdict next to every detection — benign, suspicious, malicious, with the confidence printed. Nothing is hidden behind a colour.
The agent investigated 39 detections this week and proposed 5 actions. 4 are still waiting for a human. That queue — proposed, pending, approved — is the product.
Runs on demo data — Northline is the software's sample fleet, not a customer.
What it is
The exposure queue ranks all 320 devices with owner, OS, score, patch lag and the top signal behind the score. finance-kiosk-02 sits at 94 with a 112-day lag and five critical CVEs open on the host — and the remediation simulator is the next tab over.
180 detections in the stream, 102 open, 15 critical. Each row names the behaviour — mass file encryption, outbound C2 beacon, sensor tamper — with tactic, status and the agent's verdict: malicious 82%, suspicious 78%, benign 55%.
The device list is honest about coverage: 289 of 320 online, 31 offline, 15 isolated, sensor coverage 67.5%. A device you cannot see is not presented as a device you can.
Product tour
Not a mockup and not a concept deck. This is what opens at /app/endpoint.
01 — Overview
320 devices, 289 online, 46 high-exposure, 130 hosts with an unpatched critical CVE. The posture ring reads 66 — pulled down by a 35-day average patch lag and the 101 devices lagging 45 days or more.
02 — Exposure
Average exposure across the fleet is 34; the top of the queue is a build runner at 95 and a kiosk at 94 with 112 days of lag. The simulated-high card shows what the board looks like with no levers pulled.
03 — Devices
The full fleet table: device, owner, OS, online state, exposure, lag, risk and last seen. Sort by exposure and the top of the list matches the queue on the Exposure screen — same record, two views.
04 — Detections
RDP brute force from jules-iphone-5 came in as a false positive — benign 55%. The PowerShell encoded command on zion-tab-44 is contained, suspicious 78%. The mass file encryption behaviour on quinn-desk-82 is the one you work first: malicious 82%.
Who runs it
Roles, not references. We have no named customers yet, so nobody in these photographs is quoted, credited or claimed as one.
Owns sensor coverage and imaging — the 67.5% coverage figure and the 31 offline devices are theirs to move.
sensor coverage · 67.5%
Works the detection queue by verdict and confidence, approves or overrides the agent's proposed actions, and owns the 15 open criticals.
open critical · 15
Reconciles the scored fleet with the physical estate — every device with an owner, every owner with a device.
devices · 320The shape of it
Every figure below is legible in the captures above. Nothing here is a projection of your estate — it is the state of the demo data.
How it runs
Every device gets an exposure score from its open CVEs, lag and behaviour — the queue re-ranks itself, so the worst device is always the top row.
Behavioural detections land in the stream with tactic and confidence attached — 180 this week, 125 blocked or contained without waiting for a person.
The agent investigates and proposes: isolate diego-win-desk, run a full disk scan. Four proposals sit in the approval queue until a human says yes.
The patch lag board and the remediation simulator turn the exposure score into a sequence of fixes — 101 devices at 45-plus days, oldest first.
One record
An exposure score means more when the asset record, the network path and the access grant behind it are the same record — not three exports joined in a spreadsheet.
The asset tag, warranty and assignment behind each device live in Inventory IT — the fleet list and the physical estate reconcile themselves.
CEDX NetworkThe same device carries a posture on the network: which segment it sits in, and which east-west paths it can reach.
CEDX SIEMEndpoint detections become SIEM alerts with the verdict and confidence attached — the SOC reads the same row you did.
CEDX AccessThe device owner is an identity with grants. Exposure times privilege is the number Access keeps honest.
Limits
Finding this out on the third call is worse for you than reading it here, and worse for us.
Start
Open it right now
Your fleet, your scores
Endpoint with the rest of it
Questions
Yes. Every screenshot is a capture of the running build and you can open the same build at /app/endpoint. It runs on demo data — the Northline fleet is the sample.
The scoring model is its own tab on the Exposure screen, and every row names its top signal — an unpatched critical CVE, patch lag in days, behaviour. The score is a number you can argue with, not a colour you cannot.
It investigates and proposes; a human approves. This week it investigated 39 detections, proposed 5 actions, and 4 were still pending approval. The two overrides are counted on the same card.
Each detection carries severity, tactic, status and the agent's verdict with a confidence figure — benign 55%, suspicious 78%, malicious 82%. False positives are marked as such in the table, not silently dropped.
No certification has been issued. What we can evidence about hosting, encryption, tenant isolation and production access is written up on the security page.
Live build, demo data, no card. Then ask what your own top-of-queue device would be.