Methodology & trust

Off-path by architecture.
Honest about how it fails.

A security engagement on a life-safety network has to earn the trust of a safety assessor, a biomedical engineer and a skeptical CISO. The way you do that is by stating your failure mode plainly and keeping the unprovable machinery out of the control path. Here's exactly how Wardhelm is built.

Request an Assessment How Conduit works →
Three commitments

Passive. Honest about failure. On-prem.

⤫

Passive by architecture

The assessment reads a traffic copy you provide — a SPAN port, a tap or a PCAP. It observes and nothing else: nothing we run sits in the packet path, and we never originate a control command.
⏻

Honest about how it fails

When Wardhelm is offline, your traffic is unaffected — we were never in the wire. There is no failure mode where taking Wardhelm down changes what your network does, because Wardhelm never sits in it.
☁

On-prem, no cloud

Runs air-gapped. No cloud dependency, no outbound data. Your traffic and your evidence never leave your walls.
Evidence, not assertion

Every finding says how we know it.

A finding is only as good as its provenance. We grade each one, so your engineers can trust the confident ones and interrogate the rest.

KNOWN

Directly observed on the wire in this capture.

INFERRED

Derived from observed behaviour with stated reasoning.

ASSERTED

Provided by documentation or the engineering team.

UNKNOWN

Not established — and flagged as a gap, never guessed.
Provenance you can verify

Signed, hash-chained, independently checkable.

Tamper-evident by design

Capture hashes, a signed model version, and an append-only, hash-chained report with signed checkpoints. Any edit, deletion or reorder breaks the chain — and an auditor can verify it offline with the public key, without any Wardhelm software. That's the point.

AI where it's safe, humans where it matters

AI assists analysis of the captured traffic offline, on your premises. Humans review, ratify and sign every finding that reaches the report. Nothing in this engagement acts on your network.
Discipline & alignment

Passive, scoped, and mapped to your frameworks.

🔏

There is no active step

Passivity here is architectural, not a promise on paper: the engagement has no active step to authorize. We read the traffic copy you approve and transmit nothing into the control network — for every site, signed or not. Scope is still fixed in writing before anything begins.
≡

Standards alignment

Our assessment maps to, and supports your program under, these frameworks — it helps you evidence them. It is not a certification and does not replace your audit or regulatory submission.
IEC 62443NERC CIP-015 NIS2MITRE ATT&CK ICS

A passive network assessment can evidence the network-observable, technical clauses of any framework — not administrative or policy safeguards, and never a regulatory outcome. We map the shape; your counsel renders the conclusions.

The safest security engagement is the one that can't cause the outage.

Request a Critical-Conduit Assessment Back to overview →