the differentiator

A policy is trusted only once it survives traffic it never saw.

Every incumbent learns least privilege from observed traffic. It scores perfectly on the window it watched, and silently blocks the failover. This is the part of Themis that exists because that is not good enough.

See it on your estate The engine it verifies →

0100 the held-out test

Learning from observed traffic is a trap with a name.

Learning a policy from observed traffic looks perfect on the traffic it watched. Then the failover runs, the 02:14 batch runs, someone breaks glass at 3am — and the flow that was never in the window gets dropped.

So the policy is scored against a held-back set and an adversarial set before it goes anywhere near enforcement. A pass enforces on one slice and widens only by declaration. A fail returns a gap list, never an outage.

The separation is mechanical, not procedural: the drafting stage has no path to the held-back set, and that is checkable by walking the closed set of files it opened. It is not a promise that someone remembered to be careful. That is what makes a pass mean anything.

Observed traffic is evidence, never authority.

The observation window closes at day zero. — what ran while we watched describes the estate; it does not authorise it. Nothing becomes allowed by having happened.

Only a declared change may widen policy. — a new flow never silently becomes an allowed one. Seen but undeclared escalates to a named human instead of quietly editing the rule set.

Not observed never means no traffic. — flow telemetry is sampled, and the ledger says so: a relationship the telemetry did not show is reported as not observed, never as absent. Evidence of presence is evidence; absence of evidence is a limit, and the pack prints it.

A denied probe is a security event. — never a candidate rule. The system that widens itself to stop generating alerts has optimised for silence, not for safety.

Every gate is shown going red before you are asked to trust it. — each check is run against a seeded defect to prove it can fail. A gate that has never failed in front of you is decoration.

0200 classify & own

A verdict without an owner is a finding nobody acts on.

Verification tells you whether a flow is legitimate. It does not tell you what the flow is for, or who gets to decide about it. Both of those are still needed long after the person who knew has moved on.

So classification is part of the method, not a reporting feature bolted on afterwards. Every flow that survives verification carries three things beyond its verdict.

A class

What kind of flow this is — a tier boundary, a batch dependency, an egress to a third party, a break-glass path. The class is what makes a policy readable by someone who did not write it, and what lets a rule be judged against its peers rather than one at a time.

A story

Why it exists: the declaration that covers it, the change that introduced it, the date it was first observed. A rule with a reason attached can be retired on evidence. A rule without one survives every review, because nobody dares be the person who removed it.

An owner and an approver

A named team accountable for the flow, and a named human who signs any widening of it. Not a mailing list, not a ticket queue — the person whose name appears in the event log next to approve.

The next person inherits the reason, not just the rule.

Classification is proposed, never assumed. — a class is drafted from the declarations, the naming conventions and the topology, then confirmed by someone who owns the estate. A guess that nobody ratified is not a classification; it is a label.

Ownership is a gate, not metadata. — an unowned flow cannot be widened. It escalates instead, which is what stops “nobody knows what this is” from quietly becoming “it has always been allowed”.

The record survives the people. — class, story, owner and every approval are part of the evidence pack, so an auditor, a successor or a due-diligence team reads the same history you did.

0300 limits

What this does not do.

Segmentation reduces blast radius. It does not erase it. — L3/L4 and L7 segmentation constrains what an attacker can reach along allowed paths. On an allowed path, a compromised workload is still a compromised workload.

An address you can read is one anyone can spoof. — identity stays cryptographic. Addresses carry the path and the instruction; they are never the authentication.

IAM keeps the cloud API plane. — we retire its network-shaped hacks, not IAM itself. The boundary is stated rather than blurred.

Current figures are lab figures. — measured on controlled topologies and labelled as such. Your numbers come from your estate, in the first two read-only weeks.

e000 End.DT6 deliver

See it against your own kit.

30–60 minutes. Read-only. We compare your declared intent to what is actually running, and hand back the gap list.

See it on your estate Or just email us

Nothing is installed to have this conversation.