WireTrace has two parts. Sensors sit where the traffic is and read protocol conversations in depth. A central platform turns those observations into asset intelligence, exposure, behavioural context and evidence, and presents them to people and to other systems.
The architectural commitment that shapes everything else is that the monitored network is never written to. A sensor receives a copy of traffic and produces understanding from it. It does not probe, poll, interrogate or respond.
Existing infrastructure
Passive copy of traffic
Deep protocol analysis
Asset and communication intelligence
Security, operations, compliance
Positioned wherever visibility is needed: a plant network, a clinical VLAN, a data centre core, a remote site. It receives mirrored traffic and analyses protocol conversations for their meaning, producing structured observations rather than stored packets.
One sensor covers every domain present on the segment it watches. There is no separate industrial sensor, medical sensor or enterprise sensor to select, license or reconcile.
Receives observations from every sensor and builds the estate-wide picture: device identity, communication relationships, behavioural baselines, exposure, vulnerability correlation, compliance evidence and topology.
This is also where analysis that needs the whole estate happens, since a relationship crossing two sites is only visible once both sites report into one place.
| Model | Shape | Typical use |
|---|---|---|
| Single site | One or more sensors and a platform within the same facility. | A plant, a hospital, a campus or a data centre with visibility needs contained to one location. |
| Multi-site | Sensors distributed across locations reporting to a central platform. | Utilities, manufacturers and healthcare groups needing one estate-wide picture across many sites. |
| Air-gapped | The full platform, including analytics and the AI assistant, inside an isolated network with no outbound path. | Defence, national infrastructure and any environment where external connectivity is prohibited. |
| Segregated tenancy | One platform presenting separated environments to separate audiences. | Groups with independent subsidiaries, and providers delivering a managed service. |
Every model is fully on premises. There is no cloud component that must be reachable, no telemetry sent to a vendor service, and no capability that degrades when the environment is isolated. Air-gapped is a supported deployment model rather than a reduced mode of operation.
In safety-critical and clinical environments the architecture has to be defensible to people who are not security specialists. These are the properties that matter to a plant manager and a biomedical engineer, and they hold by design rather than by configuration.
A sensor is a receiver on the monitored side. There is no active mode, and therefore no setting that can be enabled by accident during a maintenance window.
Nothing is installed on any observed device. Devices under warranty, certification or vendor support are unaffected because they are never touched.
A sensor that stops receiving traffic stops producing observations. It cannot degrade the network it watches, because it never participates in it.
A sensor sees exactly what is mirrored to it, no more. Coverage is therefore a deliberate design decision, and the platform is explicit about what is and is not being observed.
Understanding what is retained matters for privacy review, for clinical and regulatory sign-off, and for the security questionnaire that arrives later. The short version is that WireTrace keeps understanding rather than raw traffic.
| Held | Not held |
|---|---|
| Device identity and attributes derived from observed behaviour. | Full packet captures as a matter of course. The platform is not a recording appliance. |
| Communication relationships, protocols used and behavioural history. | Clinical or business content beyond what is needed to identify a device and characterise its behaviour. |
| Security findings and the observations that support them. | Anything transmitted to a vendor cloud service, because none exists. |
| Compliance evidence tied to the window it was observed in. | Data beyond the retention period configured by the customer. |
Retention is configurable, and the detailed data handling position, including how sensitive environments are treated, is covered in the security and privacy documentation available during evaluation.
WireTrace is deployed alongside existing tooling rather than in place of it. Asset intelligence, findings and evidence are made available to the systems that already carry your operational and security workflow, so that the visibility WireTrace produces improves the decisions those systems support.
Findings and asset context delivered into the platforms your analysts already work in.
An observed inventory to reconcile against the recorded one, which is usually a revealing comparison.
Evidence and posture reporting for audit, board and regulator audiences.
A note on what this document deliberately omits. This is the product architecture: the parts, where they sit, and what they are responsible for. Internal component design, data structures and analysis methods are not described here, because an external reader does not need them to evaluate whether WireTrace fits their environment. Technical evaluation, sizing and integration detail are provided during a scoped engagement.
The single biggest determinant of value is where the sensors sit. We will walk your network diagram with you, identify the points that produce the most visibility for the least disruption, and tell you honestly what each position will and will not see.