the honest FAQ
The objections, at full strength.
Written the way the person raising them would put it. Where the honest answer is “correct”, it says correct.
0100 about the method
“Why should I believe a verdict you computed?”
“Routers sample. You cannot see every flow.”— correct, and we never claim to. Reachability is computed from the configuration, deterministically, on every change; observed traffic is evidence on top, with the sampling rate on every record. Not seen is reported as not observed, never as no traffic.
“Is there AI in the verdict?”— no. The verdict path is deterministic, no model, no GPU. An optional assist container drafts groupings with a seed and a confidence; a named person accepts or rejects.
“Vendors already do microsegmentation.”— most learn least privilege from observed traffic, which scores perfectly on the window it watched and silently blocks the failover. Here nothing widens policy except a declaration with a name on it, scored against traffic it never saw.
“Your figures are lab-only.”— correct, and every number says so. What transfers is the protocol: your ops write the held-out test, every gate is shown going red, a closed window replays byte-identically. Your numbers come from your estate in two weeks.
“Isn't this observability, or a CMDB, or a firewall manager?”— no: we keep verdicts, not flows; we reconcile your inventory, we do not require it; we classify rules and verify your changes, we never apply them.
0200 about your estate
“Our network does not look like your demo.”
“We run Fortinet, Palo Alto, Cisco and Juniper — not Kubernetes.”— then you are the estate this was hardened for: FortiGate, PAN-OS, ASA/FTD, IOS-XE, NX-OS, IOS-XR, Junos, SR-OS, VRP, EOS; NetFlow v5, v9, IPFIX. Every parse lists what it could not read. Your first real export will tell us what the test configurations missed.
“Our CMDB and IPAM are a mess.”— everyone's are, so nothing depends on them. Intent at the level of address spaces is always enough; bring whatever inventory you have as an input, not a prerequisite.
“An agent is not touching our production.”— nothing does. No agents, no probes, no device logins. Exports you push, exporters you point, managers pulled read-only. One container, no code path that writes to the network.
“What leaves our tenant?”— nothing but the licence check, documented field by field. Raw flows are discarded in flight; air-gapped estates run on a signed licence file and make no connection at all.
“Is the audit really free?”— yes. Read-only, fixed scope — one named domain — and you keep everything it produces. What comes after, Network Truth and beyond, is priced on your own numbers, and there are no prices on this site.
“What happens after the fourteen days?”— the window keeps running. At the day-14 readout the same engine continues as a thirty-day Network Truth trial: one new licence file, no reinstall, the cap on declarations lifted, the audit's proposed baseline as the first list to work from. It is opt-out — stopping is a decision you take, not a default.
“How big an estate fits in two weeks?”— one named domain: around fifty enforcement points, twenty-five thousand rules, a hundred exporters per stream. Above that we split into scopes and run them in parallel.
“IPv6 will break things.”— assurance needs none of it and changes no address. Enforcement, when earned, starts at endpoints you control, is reversible in one route change, and publishes its boundaries — 40 bytes of path MTU, an explicit ingress-MTU step — before the plan, not after the incident.
0300 about the company
“And who exactly are we depending on?”
“You are one person.”— true, so the dependency is built not to matter: a small dependency-free codebase your security team can read in an afternoon, in your tenant, with no egress. Every artifact replays from its own inputs whether or not this company does.
“Not now — attention is the scarce resource.”— the entry costs about thirty minutes and no engineer-hours. Effort on your side starts only if the numbers, from your own estate, justify it.
“Will you ever need write access?”— not on assurance, not on enforcement: compile, you apply, we verify. Only the horizon earns it, per change class, after enough human-applied instances verified clean.
“What happens if we stop?”— kill criteria are published up front and either side can invoke them. Everything stays with you; the audit is read-only, so there is nothing to roll back.
If a question is missing, it is worth an email — we would rather answer it than have it decided silently.
e000 End.DT6 deliver
Start the free network audit.
Read-only, fixed scope. We compare your declared intent to what is actually running, and hand back the gap list.