Software · Cybersecurity
Network security
Firewalls, segments and remote access managed as code, with traffic visibility to prove the rules work.
Firewall rules pile up for years until nobody knows which ones are still needed. We build network security tools that store policy as code, review every change, map which systems actually talk to each other, and replace flat networks and old VPNs with segmented, identity-aware access. Flow logs and intrusion detection show whether the rules behave as written.
What we build
- Firewall policy repositories with review, testing and automated deployment to devices
- Rule clean-up reports that find shadowed, unused and overly broad rules
- Segmentation maps built from flow logs, showing the real traffic between zones
- Zero trust access gateways that check user identity and device posture per request
- Network intrusion detection with Suricata or Zeek, feeding alerts to your SIEM
- DNS filtering and egress controls that block known malicious destinations
DemoInteractive · sample data
Try it live.
A working sample with made-up data. It runs in your browser; nothing is sent anywhere.
netsec@policy:~$ policy lint rules/ parsed 412 rules across 6 zones warn: rule 118 is shadowed by rule 42 warn: rule 207 allows any source to db-zone:5432 netsec@policy:~$ policy unused --days 90
What it does well
Policy as code
Rules live in readable files, are reviewed in pull requests and are pushed automatically.
Unused rule finder
Hit counts and flow logs show which rules have carried no traffic for months.
Real traffic maps
Flow data shows who talks to whom before segmentation rules are tightened.
Identity-aware access
Remote users reach only the apps their role needs, not the whole network.
Change safety
Every rule change is tested against recorded traffic and can be rolled back.
Detection on the wire
Suricata and Zeek watch for scanning, beaconing and known exploit traffic.
Questions
What does zero trust mean in practice?
Being on the office network no longer grants access by itself. Each request is checked against who the user is, the health of their device and what the application allows. In practice we start with remote access to a few internal apps, then extend it as old VPN routes are retired.
Can you work with our existing firewalls?
Yes. Most enterprise firewalls from vendors such as Fortinet, Palo Alto Networks and Cisco expose APIs or have Terraform providers. We import the current rules, review them with your team, and manage them as code from then on, without changing hardware unless there is a clear reason.
Will segmentation break things?
It can if rules are written from diagrams instead of facts. We collect flow logs first, so every rule is based on traffic that really happens, apply changes in monitor mode, review what would have been blocked, and enforce only after system owners agree.