Deployment is deliberately unremarkable. There is no agent programme, no build image to modify, no scan window to negotiate and no change freeze to work around, because nothing is installed on any device and nothing is transmitted onto the monitored network.
The part that genuinely matters is placement. A sensor sees exactly what is mirrored to it, so where sensors sit determines what you get. That is the conversation worth having properly, and it is short.
Where visibility is worth the most
SPAN or TAP, nothing transmitted
Assets appear within minutes
Inventory, exposure, evidence
| Step | What happens | What you provide |
|---|---|---|
| 1. Design placement | We work through your network diagram together and agree the points that produce the most visibility for the least effort. We also tell you what each position will not see, which is the more useful half of that conversation. | Time with someone who knows the network. |
| 2. Connect | A sensor is connected to a mirror port or TAP at each agreed point, and the platform is stood up. Nothing touches any observed device. | A SPAN port or TAP, and somewhere to run the platform. |
| 3. Observe | Assets begin appearing and classifying within minutes. The picture continues to fill out as the environment goes through its normal daily and weekly cycles. | Time. Longer observation gives better behavioural context. |
| 4. Operate | The inventory, exposure and evidence become part of normal working, and findings are fed into the tooling your teams already use. | Whoever will own it day to day. |
Because observation is passive, coverage follows the mirror rather than the device list. A sensor at a distribution point sees traffic crossing that point and nothing else, so two devices that talk only to each other on a local switch are invisible from there. This is a property of the technique rather than a shortcoming to work around, and it is why the placement conversation comes first.
Where traffic naturally concentrates, giving the widest view for the fewest sensors.
Between zones, sites or domains, which is where the security-relevant traffic crosses.
A specific plant cell, clinical VLAN or facility network you already have a question about.
| Model | Shape | Suits |
|---|---|---|
| Single site | One or more sensors and a platform in the same facility. | A plant, hospital, campus or data centre. |
| Multi-site | Sensors distributed across locations reporting centrally. | Utilities, manufacturers and healthcare groups needing one estate-wide picture. |
| Air-gapped | Full platform inside an isolated network with no outbound path, including analytics and the AI assistant. | Defence, national infrastructure and classified environments. |
| Segregated tenancy | One platform presenting separated environments to separate audiences. | Groups with independent subsidiaries, and managed service providers. |
No software installed on any observed device
No credentials for the devices being observed
No scan window or change freeze to negotiate
No endpoint build changes or agent rollout
No outbound connectivity from the environment
No cloud account or vendor-side onboarding
Why the operations conversation is usually short. The objection that stops most security tooling at a plant or clinical boundary is that it touches equipment. Here nothing does. Operations can watch the sensor being connected, confirm that it is receiving a mirror and transmitting nothing, and satisfy themselves in the room rather than on the strength of a datasheet.
Sensor count follows network topology rather than device count, since a sensor covers whatever is mirrored to it regardless of how many devices that involves. Sizing is therefore worked out against your actual diagram during evaluation rather than estimated from an asset number. Detailed sizing guidance, along with placement patterns for industrial, healthcare and data centre environments, is provided as part of a technical engagement.
One segment answers the question of whether the visibility is worth having, quickly and cheaply.
Add sensors where the earlier ones showed you were blind, rather than by covering everything at once.
Bring sites into one platform once the pattern is proven, for a single estate-wide position.
Bring a network diagram. In one session we will identify where sensors would produce the most visibility, what each position would and would not see, and what a first deployment would actually involve. That is usually enough to decide whether to run an evaluation.