Sovereign cyber security, from IT to OT to AI. One raw-data lake beneath accredited detection and compliance content, with AI that never leaves your boundary. Software on hardware you control, in your jurisdiction.
After a decade of cloud-first, critical security infrastructure is coming back on-premises. The networks that matter most never left, and they have been served by fragmented tools and foreign vendors.
Usage-based hyperscale pricing forces vendors to quietly cut retention and functionality when costs rise.
The system that watches everything should not run on infrastructure you neither own nor control.
Effective machine learning needs all raw telemetry in one place, next to the compute. Expensive in the cloud, impossible under sovereignty.
Withstand's foundation is a defence-grade detection and compliance platform that is accredited and in production in allied government, defence and criminal justice networks, independently owned, and built to run fully air-gapped. The next generation re-platforms that foundation onto a sovereign raw-data lake and extends it to OT, IoT, AI systems and data.
Assessed under national government schemes and operating in classified environments today. Scheme details are available under non-disclosure.
No external dependency in the runtime path. Content, models and software updates arrive on signed media and are verified before use.
One accredited platform serving many organisations as isolated tenants, operated directly or through cleared managed-service partners.
Endpoint, server, identity, network and application telemetry across IT, OT and IoT; behavioural detection, correlation and response orchestration; control-level measurement of preventive controls.
Frameworks
ISM, MITRE ATT&CK, ATT&CK for ICS, NIST CSF
Telemetry from AI gateways and agents: prompts and responses, tool and action calls, model registry events, vector store access, guardrail outcomes; detection of prompt injection, data leakage through models, agent privilege escalation and model supply-chain change.
Frameworks
OWASP LLM Top 10, NIST AI RMF, ISO/IEC 42001, ISM AI guidance
File, database and share access audit; classification and sensitivity labels; data movement across boundaries including removable media; DLP events; lineage from source to model to output.
Frameworks
DORA, NIS2, CPS 234, privacy and protective-security regimes
A single anomaly in one domain is noise; the same actor touching an identity, a model and a data store within an hour is an incident. Separate products cannot see that sequence, and one lake with one entity model can.
Each principle is a constraint on how the software is built, not a feature that can be switched off.
Every event is retained as received. Parsing and normalisation run in parallel and never as a gate. Nothing is discarded at collection.
IT, OT, IoT, AI and data telemetry land in the same store and resolve to the same assets, users, data objects and models.
No external dependency in the runtime path. Inference, detection and reporting all run inside your environment. Updates arrive by controlled media.
Parquet and open table formats for storage, Sigma for detection content, OpenTelemetry-compatible traces for AI systems. Your data and your rules outlive any engine.
Hardened, attested, with immutable evidence and offline recovery, on the assumption that the monitoring layer will be attacked.
A tier carries a rated capacity; retention is a configuration. There is no per-gigabyte charge that rewards discarding data at collection.
The layers and engines of the platform, in the order they are built.
All telemetry lands once, raw, in open formats.
A mature body of content, running on complete data.
Whether a control fired, not whether it is documented.
Ask any question of any data, then act inside your boundary.
Behavioural detection at millions of events per second.
Explains, drafts and ranks, and is never the lead detection claim.
A signed image on certified hardware or in your accredited private cloud. Single site, clustered, hub and spoke, or one instance per classification domain. Nothing leaves the boundary.
Your own servers from Withstand's hardware compatibility list, imaged and enrolled with a signed operating-system image, measured boot and drive binding. For agencies bound to hardware panels and estates that already own the metal.
The same signed image as a virtual machine in your already-accredited private cloud. The trust posture is reduced and stated as such: the hypervisor is in the trust base.
A core instance plus edge collectors and passive sensors at remote sites and OT zones, joined by diodes or constrained links. Collectors hold local evidence if the link is lost and reconcile on reconnection.
One instance per classification domain, with one-way flows through cross-domain guards where policy permits. Updates, content and models arrive on signed media and are verified against the trust root before use.
The next-generation Withstand platform is being built with design partners whose constraints are the specification. If your networks cannot leave, you are who this is for.
Become a design partner