Tools
What the software has to do.
We build for one team and one problem at a time. What follows is what the tools do rather than what they are called: most are delivered under a client’s name, and the capability is the part that transfers to the next problem anyway.
Awareness
Device and network visibility
What an endpoint is actually talking to, attributed to the application that opened the connection, and resolved to a place without asking anyone on the internet to help.
- Per-application attribution, not just a list of addresses.
- Endpoint geography resolved from data held on the device.
- Rules that allow or block by address, by application or by country.
- A flow-by-flow record that can be exported and read later.
Proximity and tag detection
Consumer tracking tags are cheap, small and everywhere. The work is not seeing one; it is telling the tag that belongs there from the tag that keeps reappearing.
- A register of the tags that are expected to be present.
- Repeat presence judged across time and distance, not a single hit.
- The alert goes to the person being followed, not to a console.
A shared picture without infrastructure
Position and status across a team, carried over links the team itself controls, with what each member can see governed by their role.
- No carrier account, no commercial cloud, no third-party map service.
- Role-scoped visibility: some see everyone, some see no one.
- Degrades to local links rather than going dark.
Early warning
Detection that runs on the device
Classification performed on the endpoint, so the decision does not wait on a link and nothing has to leave the device for it to be made.
- Models sized for the hardware actually in hand.
- Alerting gated by the classifier, so the operator is not trained to ignore it.
- Thresholds that are stated, testable and adjustable.
Duress and distress signalling
A way to say that something is wrong that does not look like saying it, and that holds the message until there is a path to send it.
- Entry that resembles ordinary use of the device.
- Queued until delivery is possible, rather than failed and forgotten.
- Separately routed from normal traffic.
Evidence
Records that can be shown to be unaltered
A record is only useful later if its integrity can be demonstrated. Signed baselines and hash-chained logs let a product of the field be shown to be the product of the field.
- Signed at the point of capture, verified afterwards by anyone holding the public key.
- A chain that cannot be quietly rewritten from the beginning.
- Verification that fails loudly, with a reason, rather than degrading.
Exercise control and after-action
Running a scenario, scoring it while it runs, and producing something at the end that survives a debrief and can be compared against the next run.
- Scoring recorded as it happens, not reconstructed from memory.
- An after-action product that names what changed and what did not.
- The same baseline available for the re-test.
Fleet and delivery
Provisioning, policy and sanitisation
Bringing devices to a known state, holding them there, and returning them to a clean one on command, all without a management service on the internet.
- Provisioning and policy applied offline.
- Removal of what the device did not need to be carrying.
- Sanitisation that is verified rather than assumed.
Build delivery on closed networks
Getting software onto devices that are not allowed to reach a store, without loosening the reason they are not allowed to.
- Enrolment by physical presence rather than by account.
- Pinned trust between the device and the source.
- Delivery over a local link, or none at all.
Constraints
What every one of them is built to.
Offline first
A connection is a convenience, never a dependency. If it is only useful online, it is not useful in the place it is going.
Nothing phones home
No analytics, no crash telemetry, no silent sync. What the device learns stays on the device unless a person decides otherwise.
Ordinary hardware
Commodity phones and laptops the team can buy, replace and leave behind, not a case of issued equipment that draws attention.
Quiet presentation
Software that does not announce what it is by sitting on the home screen announcing what it is.
Recoverable
A known state to return to, and a way to get there under pressure and without the network.
Testable claims
Every number we state about a tool is one we can reproduce on request, from a baseline that is signed.
Most of this starts as someone else’s problem.
If something here is close to what you need but not quite it, that is the usual starting point. Tell us the problem and we will tell you honestly whether it is a build, a modification, or something you should buy instead.