Three ways in. One engine.

For new programs, M&A integrations, or "let's start over" moments. The engine designs a security stack from your industry, size, regulatory load, and budget — three priced architectures (Lean / Balanced / Advanced) with real products, real prices, and the reference architectures teams like you actually deploy.

A short profile: industry, headcount, regions, frameworks in scope, current stack, budget, and concerns — you describe it. Documents you upload are read to ask you follow-up questions and to flag where they contradict your answers; they don’t fill in the profile for you.

• Three priced architectures with real product recommendations from a catalog of 99 products
• An architecture diagram of the Balanced stack — its zones, the deployment order, and how the products connect
• A deployment plan: every product in order, with a written setup guide where one exists, filled in with your details — a draft your team reviews and applies
• Compliance coverage scored across 24 frameworks, a Do-Nothing dollar scenario, and a sequenced upgrade roadmap with cost and lead time
• Or start from requirements: a target architecture for AWS, Azure, on-premises or hybrid, re-run through the attack-path engine, with a bill of materials against your budget and a draft FortiGate config — all modeled
• A board-ready PDF behind every number

Upload a real configuration export and the engine parses the actual bytes against vendor-specific best practices — 1,913 checks across 37 supported vendors. Every finding is read from your real file. For FortiGate, PAN-OS and OPNsense configs, findings are labeled proven: the engine re-parses the file, so each of those findings can be re-checked. For every other vendor, findings are labeled observed — read from your file, without a re-checkable proof until that vendor's parser lands. Anything inferred is labeled modeled. The kind of review a consultant takes weeks to deliver — re-run it yourself any time a config changes.

A configuration export from any of the 37 supported vendors — firewall, WAF, EDR, cloud, identity, SIEM, email, backup, DLP. Secrets are redacted across 8 secret classes before storage; nothing is stored in the clear. No live scan, no agent, no connected integration.

• Configuration-wide checks for overly permissive any-any grants, risky settings and missing protections, read from your file. Not yet: the rule-by-rule pass (shadowed and redundant rules, one row per policy) — it is being switched on and is not part of today's review
• Assess and Operate audit one vendor's export per review; on Program every vendor is covered and findings stitch cross-vendor to your crown jewels
• Findings with real evidence excerpts from your file (read from the artifact, not asserted)
• A written fix for every finding, plus the exact replacement config wherever the engine generates one — corrected CLI for most FortiGate findings, snippets for many Palo Alto, Cisco ASA, Microsoft and CrowdStrike checks
• The attack path each gap opens, and the compliance controls it maps to
• A posture score and a tamper-evident record you can re-check offline