one engine

Three sources of truth. One verdict.

Themis does not replace your enforcement points. It reads them, holds them against what you declared and what actually flows, and refuses to widen anything without a name on it.

Start the free network audit Why a pass means anything →

0100 the three truths

Each one proves something. None of them proves everything.

Declared

What should be allowed — a zone matrix, a ticket, a declaration with a named approver. The only thing that may widen policy.

Configured

What the network permits: rules, ACLs, routes, VRFs, security groups, cluster policy in one model. “Can A reach B?” is answered here, deterministically, with no packet needed. Where continuous assurance is kept.

Observed

What the telemetry saw, sampling rate stamped on every record. A flow seen is evidence of presence; a flow not seen proves nothing. Evidence, never authority.

Three truths give six states, not two. The six states →

0200 the rules it keeps

What decides, what reports, and what is never allowed to.

The engine listens; the estate sends.— never logs into a router. No SSH, no RESTCONF, no credential hand-over.
No write credentials.— compile, you apply, the engine verifies.
A verdict ledger, not a flow lake.— raw flows are classified in flight and discarded; a hash commitment per window proves the ledger summarises what was seen.
No model in the verdict path. No GPU.— the same export yields the same gap list every time. An optional assist container drafts groupings; a named approver promotes them or not.
Nothing leaves the tenant.— dependency-free Python with one documented egress: the licence check. Air-gapped estates run on a signed licence file.
Every gate is shown going red before you trust it.— and a closed window replays byte-identically from its own artifacts.

0300 what it reads today

One normalised model. Thin frontends per vendor.

FortiGatePAN-OSCisco ASA / FTD IOS-XENX-OSIOS-XRJunosSR-OSHuawei VRPArista EOS NetFlow v5 · v9 · IPFIXKubernetes · Ciliumcloud security groups pulled read-only: Panorama · FortiManager · NetBox · Hubble

Findings never depend on which vendor you bought: every export normalises into the same model, and the same policy in two syntaxes yields the same verdicts — that is a gate, not a hope. Every parse ships a coverage report listing what it could not read, so “no issue found” can never mean “could not read it”. The test configurations are standards-shaped; your first real export will tell us what they missed.

0400 before you ask

What runs on your estate today — and what SRv6 adds.

Network Audit and Network Truth no SRv6 required

The three-way compare, six states with the reason. Ten vendors read, three flow formats, sampling stamped. Rule classification with conservative retirement. Drift on a live stream, gated on freshness. Held-out verification. Windows that replay; a pack that generates itself.

Application-Aware Network and beyond SRv6 entry · enforce · control

Segments that count what crossed them, per-segment path proof, the provable negative, the locator and route plan, the migration itself. Data path verified on stock Linux 6.8; never yet on an operator estate or router silicon.

Revenue never waits on SRv6. The audit and Network Truth run on any estate you have today.

e000 End.DT6 deliver

Start the free network audit.

Read-only, fixed scope. We compare your declared intent to what is actually running, and hand back the gap list.

Start the free network audit Or just email us
Start the free audit — read-only