Detection that keeps running when the cloud link drops, with ransomware isolation decided on Windows endpoints. An endpoint agent backed by cloud analytics on a columnar security lakehouse. A dedicated cloud instance per tenant.
Four pressures that shape security architecture and operating cost.
Per-GB pricing makes security spend rise with telemetry volume. Edg3 plans are priced by endpoint tier instead.
Remote, segmented and disrupted networks cannot assume a continuous cloud path. Deterministic controls must keep operating locally.
Regulated teams need clear retention policies, regional deployment choices and evidence they can inspect.
Deterministic detection and isolation run at the edge; contextual investigation runs through the tenant’s configured cloud services.
Six architectural layers. Two of them reshape the market. The other four make sure the promise holds.
The moving parts behind the platform. Built for operators, inspectable by architects.
Open-source columnar lakehouse with an SSD hot tier and cloud object-storage sync.
Curated Detection-as-Code rules with version control and ATT&CK context.
High-throughput message streaming with at-least-once delivery guarantees.
Reusable security queries over the columnar hot tier and Parquet history.
Tenant-scoped AI investigations with cited evidence and a configurable inference provider, plus deterministic first-seen context.
Event-driven SOAR workflows following Infrastructure-as-Code principles.
Automated provisioning with IaC templates, SSL automation and agent distribution.
Dedicated tenant instances, scoped agent messaging and RBAC. Enterprise SSO is on the roadmap. Roadmap
Availability varies by edition, tenant configuration and deployment stage. Core ingestion, detection and investigation share one platform.
Centralised collection, normalisation and long-term retention on an open Parquet lakehouse in your Edg3 cloud tenant.
Curated rules are git-managed, diffable and auditable, with MITRE ATT&CK context where mapped.
Structured investigation proposals with cited context, confidence and deterministic gates.
Local ransomware isolation on Windows with a safety deadman; other actions remain approval-gated.
Investigation history, evidence collection and exportable reports for review.
Threat-feed ingestion with enrichment and cross-source correlation.
Supported agent hosts keep deterministic controls and buffering during link interruption. A fully self-hosted, air-gapped platform is on the roadmap. Roadmap · Q4 2026
Agent software inventory checked against known vulnerabilities and prioritised with EPSS and CISA KEV, plus Tenable Nessus report uploads.
Tenant roles (RBAC) today. SAML and OIDC single sign-on is on the roadmap. Roadmap
Provider-enabled integrations for cloud, identity, SaaS and operations data.
Edg3 separates deterministic endpoint controls from cloud analytics. Availability is stated explicitly where configuration or rollout stage matters.
| Capability | Edge agent | Edg3 cloud | Availability |
|---|---|---|---|
| Deterministic detection | Local | Enriched | Available |
| Ransomware isolation (Windows) + safety deadman | Local | Controlled | Available |
| Windows and Linux telemetry; macOS file integrity and posture | Collected | Analysed | Current agent |
| Investigations with cited evidence | Evidence | Reasoning | Tenant configuration |
| AWS CloudTrail analytics | N/A | Analysed | New deployments + AWS setup |
| MSSP control plane | Per tenant | Multi-tenant | Available by invitation |
| Fully self-hosted, air-gapped platform | Agent ready | Not current | Roadmap · Q4 2026 |
Four product layers, built to be inspectable by the people whose job depends on trusting them.
Maritime, defence, mining, utilities, manufacturing.
Regional banks, credit unions and insurers with defined retention and evidence requirements.
Hospital networks and supported endpoint fleets with strict access and evidence needs.
Teams that require tenant isolation, controlled access and auditable operational workflows.
Invitation-only portfolio views with separate customer data paths and scoped operations.
A fully self-hosted, air-gapped deployment with sovereign feeds and keys, for estates that cannot touch a public cloud.
A multi-tenant control plane with separate customer data paths, currently available through a guided partner engagement.
Partners can move from a customer fleet view into the selected tenant while keeping customer telemetry paths separated.
Each customer runs on its own tenant instance. The partner surface receives bounded summaries and queue records rather than pooled raw telemetry.
Price customers on endpoints, not GB. Kill the per-GB margin compression that eats MSSP books.
Partner service reports and per-analyst customer assignments are set up during the guided engagement. White-label branding, custom domains and delegated administration are on the roadmap. Roadmap
The agent deploys into remote and segmented networks today; a fully air-gapped, self-hosted platform remains on the roadmap. Air-gapped · Q4 2026
Edg3 hosts the control plane while the partner keeps the customer relationship and operating model.
Integrations are enabled and scoped per tenant. Availability depends on the provider, edition and required customer configuration.
Edg3 maps host posture checks to relevant framework controls. Each framework score is an operational indicator, not an audit result.
Framework scores are a working indicator for prioritising posture fixes, not a measure of audit readiness.
Policy packs cover supported Windows, Ubuntu and macOS security settings.
Check results preserve the observed state and evaluation time for review.
Compliance views and exports support evidence gathering; they do not replace an external audit or certification.
Annual rates below are shown as an effective monthly price. Self-service checkout is temporarily paused; contact Sales for current availability.
One agent for Windows, Linux and macOS, a per-tenant cloud analytics plane and guided onboarding. Detection begins with the first supported event.
Ask Sales about the 150-endpoint Starter edition and current onboarding availability.
30 minutes with the product team. We’ll walk the relevant current surfaces and availability against your use case.
Enterprise Plus and invitation-only MSSP engagements. Tailored quoting and architecture review.
