CEDX Network · IT & Security
CEDX Network scores every lateral path, classifies every flow — allow, block, inspect — and shows the drift between the policy you wrote and the network you actually have.
32 paths in the demo show high drift: the effective route is not the intended one. The table says which, from what hop, to which target, and how stale the policy behind it is.
Runs on demo data — Northline is the software's sample estate, not a customer.
What it is
The path risk queue lists device, hop and target with risk and drift: a personal phone reaching the ledger database through a remote jump at risk 95, drift 75 — top signal “open east-west path”, confidence and last seen attached.
The flow table shows source, destination, protocol, port, action and the policy that decided it — a blocked assistant-chat call cites AI governance; an inspected database connection cites Shadow OT route; bytes moved are on the row.
320 enrolled devices with site, segment, OS, posture and a UEBA behaviour score: 232 managed, 52 high risk, 67 with behaviour scores at 70 or above. The guest segment and the OT segment are columns, not surprises.
Product tour
Not a mockup and not a concept deck. This is what opens at /app/network.
01 — Overview
286 of 320 devices online, a 21.6% block rate, an 8.1% DNS block rate on malicious categories — and a network health ring at 56 that lists its own inputs: online devices, lateral paths, block rate, gateway health.
02 — Lateral & drift
The OT gateway reaching the deploy host through a jump box scores 95 with drift 91 — a path that was never supposed to exist, persisting because nothing removed it. 57 of the 110 scored paths are high risk right now.
03 — Devices
Every device with owner, site, segment, posture and behaviour score — sortable, exportable, and honest about coverage: 89% online, 73% managed, and the 52 high-risk devices averaging posture 89.
04 — Flows
Read the sample like a ledger: a blocked call to an AI-apps workspace at 0 bytes under AI governance, an inspected connection to a flagged drop host under Shadow OT route, a 32.7 MB internal transfer allowed under CI-to-registry.
Who runs it
Roles, not references. We have no named customers yet, so nobody in these photographs is quoted, credited or claimed as one.
Owns the gateways, the segments and the physical end of the flow table — and the 33 edges that are not healthy.
gateways · 15/48 healthy
Writes the rules the flow table cites — AI governance, posture floor, east-west blocks — and reads the drift report to see what the network actually does.
policy drift · 61
Keeps the enrolled estate managed and postured: the 73% coverage figure and the 52 high-risk devices are theirs to move.
high risk · 52The shape of it
Every figure below is legible in the captures above. Nothing here is a projection of your estate — it is the state of the demo data.
How it runs
Devices join the estate with owner, site and segment — 320 enrolled, each with a posture and a behaviour score from the first packet.
Every flow is typed and matched to policy: east-west, egress, AI destination, sensitive target — 56 AI-bound flows in the window alone.
Allow, block or inspect, with the deciding policy's name on the row — AI governance, posture floor, shadow-OT route.
The intended policy and the effective network are compared continuously; 32 high-drift paths are a work queue, not an audit finding.
One record
A flow is not just two addresses — it is a device with a posture, a principal with grants, and a signal the SOC reads. Those records already exist.
The device's posture on the network is the same posture Endpoint computes — 73% managed coverage is one number, shared.
CEDX AccessThe principal behind a sensitive flow carries grants Access reviews — a blocked remote-jump path is also a standing-grant question.
CEDX SIEMPolicy denies and lateral movement land in the event stream as outcomes the SOC triages — 95 policy-blocked denies in the demo window.
CEDX Inventory ITThe enrolled estate reconciles against the asset register — unknown devices on the network are assets the register never saw.
Limits
Finding this out on the third call is worse for you than reading it here, and worse for us.
Start
Open it right now
Your segments, your policies
Network with the rest of it
Questions
Yes. Every screenshot is a capture of the running build and you can open the same build at /app/network. It runs on demo data — Northline is the sample estate.
The difference between the policy you intended and the route traffic actually takes. 32 paths in the demo score drift ≥55 — like the OT gateway reaching the deploy host through a jump box. The drift tab lists them with the hop and the staleness of the policy behind each.
AI destinations are classified — assistant chat, model API, agent framework — and governed by a named AI-governance policy: a blocked assistant-chat call cites that policy on the flow row, at 0 bytes, with the class attached.
In the sample window, 82 of 380 flows were blocked — 21.6% — and DNS blocks on malicious categories run at 8.1%. Both figures are the demo estate's own, printed on the cards.
No certification has been issued. What we can evidence about hosting, encryption, tenant isolation and inspection is written up on the security page.
Live build, demo data, no card. Then ask which of your paths would show drift.