How it is built.
Everything on this page is a design commitment, not an adjective. Each item says where it stands: what exists in the platform today, what is being built now, and what comes later. Sizing figures, partner terms and scheme details are available to design partners under non-disclosure.
- In production
- Exists in the platform's accredited foundation today.
- Building now
- In the current build phases, with design partners.
- Roadmap
- Planned for a later phase.
The trust chain, from firmware to container.
The platform refuses to run altered software and can prove what it is running. These are the mechanisms behind that sentence.
The operating system is an artefact
Building nowEnterprise Linux in image mode: the whole operating system is one signed image built in Withstand's pipeline, hardened to a government baseline and audited with open tooling, with mandatory access control enforcing and validated cryptographic modules. The system switches images atomically and rolls back on its own if the new image fails to boot.
Withstand owns the boot trust chain
Building nowWithstand's own Secure Boot keys are enrolled on the hardware at integration and the vendor's keys are removed. The system boots only a unified kernel image signed by Withstand, and TPM measurements extend from firmware through the kernel and operating-system image to every container image. Attestation reports are exportable for assessors.
Storage unlocks only to a measured system
Building nowSelf-encrypting drives and encrypted volumes are bound to the TPM through measured boot. Keys are released only when the measured chain matches the accredited state, so a drive removed from the system is inert. Crypto-erase supports classified decommissioning.
Every service is signed and confined
Building nowServices run as containers in namespaces per functional area, with a deny-all network policy that permits only the published contract paths. Every image is signed in the same pipeline as the operating system and admission is enforced by signature. Services run as non-root with read-only root filesystems and confined by mandatory access control.
What was accredited is what ships
Building nowA software bill of materials for every release, a hardware bill of materials for every unit, and a model bill of materials for every model, with a revision lock on all three. Each release carries an accreditation change delta naming every changed component, so an assessor can scope re-assessment instead of starting over.
Updates arrive by controlled media
Building nowA signed bundle on physical media carries the operating-system image, container images, detection content, models and threat intelligence, each with its bill of materials. Import verifies every signature against the trust root, records the import as evidence, and applies the update atomically with automatic rollback if health checks fail. In classified profiles, import is a dual-controlled operation.
Evidence an intruder cannot rewrite.
An attacker who reaches the monitoring layer can blind the organisation, alter evidence and hide. The evidence tier is built so that the second of those is impossible.
- Findings, verdicts, decision trails, actions and administrative events are written to a write-once evidence tier. Every record carries the hash of the record before it.
- Signed anchors of the chain head are written at a fixed interval and on every export and recovery. From any anchor forward, an assessor can verify that the evidence presented is complete and unaltered.
- Deletion within the retention period is architecturally impossible, not a permission. Exports carry the chain proofs, so a successor system or an auditor can verify what was exported without trusting Withstand.
Who is allowed to act, decided in the core.
The engine that proposed an action has no influence on whether it runs.
- Policy lives in the core. Any engine may propose an action; only the core's gating engine authorises it and only the core's executor performs it. No engine can alter the policy table.
- Every proposed action is evaluated against an environment profile crossed with an action class and the verdict's confidence. The outcome is automatic execution, human approval required, or prohibited.
- Operational-technology and classified profiles default to human approval. Any action on a Purdue Level 0 to 2 asset is never automated, whichever engine proposed it.
- Policy changes, media imports and evidence exports in classified profiles require dual control. Every change to a profile is itself an evidence event.
- Engines never hold product credentials. Actuator adapters run as isolated services with their own credentials from a secret store sealed to the TPM.
Every engine replaceable, behind a published contract.
| Contract | Standard | What crosses it |
|---|---|---|
| Events and findings | OCSF | All normalised telemetry and every detection, from every engine, in one schema. |
| Detection content | Sigma, plus a native correlation language | Rules are content, not engine internals. Content outlives the engine that runs it. |
| Investigation and verdict | Withstand verdict and trail schema | Finding in; verdict, confidence, proposed actions and a decision trail out, written to evidence before any action is considered. |
| Playbooks | CACAO (OASIS) | Response workflows as data. An engine proposes a playbook; only the core executes it. |
| Actions | OpenC2 (OASIS) | Commands to firewalls, endpoint tools, identity providers, network access control and OT-safe isolators, one adapter per product family. |
| AI-system telemetry | OpenTelemetry with OpenInference conventions | Prompts, responses, tool calls and agent actions as traces. |
| Control results | Withstand control-result schema | Obligation, control, evidence reference and status, for the compliance engine. |
Each contract has a schema, a conformance suite and a reference adapter. An engine is integrated when it passes the suite, and the same suite gates its replacement. Swapping an engine means running both against the same findings, cutting over per tenant with rollback, and keeping every verdict and trail in Withstand's schema so history survives the swap. Storage is Parquet in an open table format, readable with commodity tools after Withstand is gone.
Where the architecture answers each framework.
| Framework | Relevant requirements | Where the architecture answers them |
|---|---|---|
| ISM and IRAP | System hardening, cryptography, logging and monitoring, media handling, supply chain, separation of classified domains. | Hardened signed image, validated cryptography, the evidence tier, controlled media import, classification-separated topology. |
| Essential Eight | The platform measures the customer's maturity, and must itself comply. | Control-level measurement from live telemetry; the platform's own application control, patching, privilege restriction, multi-factor authentication and backup. |
| APRA CPS 234 and CPS 230 | Information security capability, operational resilience, incident management and evidence. | Continuous control measurement, resilience indicators, evidence exports. |
| SOCI and CIRMP | A cyber risk management programme with reporting to government. | Control results mapped to programme elements; obligation-mapped narratives. |
| NIST AI RMF, ISO/IEC 42001, OWASP LLM Top 10 | Governance of AI systems and AI-specific threats. | AI-system collection as a first-class source, AI-security content, model bills of materials, guardrails on the platform's own model. |
| FIPS 140-3 | Validated cryptography. | Validated modules for all cryptography; TLS 1.3 with mutual authentication on every internal connection. |
| IEC 62443 | Zones and conduits; OT monitoring without interference. | Purdue-aligned passive collection, hardware data diodes, an OT action policy that never automates control-network actions. |
AI you can put in front of an assessor.
Where learning is used, where it is not, and where every model comes from.
- Classical machine learning does detection. Generative models explain, draft and rank. Reinforcement learning is applied only where the reward can be verified, such as whether a generated rule fires on a labelled attack corpus and stays silent on a benign one, and never to choosing an action.
- Two training paths and no third. Base training runs in Withstand's build environment on Withstand-owned corpora and ships as signed artefacts. Adaptation on your telemetry runs on your own hardware as adapters that remain there. No customer data reaches Withstand's training environment and no pooled model is trained across customers.
- Every shipped model carries a model bill of materials: base weights, licence, training corpora, adaptation steps and evaluation results, signed with the release. Open-weight families with published training data are preferred, community-licensed families are described as open-weight rather than open source, and families whose provenance an assessor cannot inspect are excluded.
- The natural-language query never answers from memory. It writes a query, runs it against the lake, and returns the result with the query shown, so an analyst can verify and reuse it.
- The platform's own model is a monitored AI system. Its prompts, responses and tool calls are collected like any other, and the AI-security detection content applies to them. The generative layer has read access to the lake and evidence tier and no other capability.
What ships in which phase.
Each phase depends on the one before it, so the order is fixed even where the calendar is not.
1Foundations
Contracts and schemas, the evidence tier, the operating-system image and trust chain on evaluation hardware, and an assessor engaged on the accreditation change delta from the start.
2Data plane
The streaming backbone, normaliser, entity resolver, hot store and lake, with raw-first ingestion running beside the existing system and the existing engines behind their contracts.
3Capability port and response
Detection content ported to Sigma and native rules, the compliance engine on the control schema, the executor, gating engine and first actuator adapters, and a triage engine behind its contract.
4AI and managed SOC
Behavioural baselining live, the generative layer on the GPU tier, tenant adapters, and a multi-tenant managed SOC with its first tenants.
Check it against your own constraints.
The next-generation Withstand platform is being built with design partners whose constraints are the specification. If your networks cannot leave, you are who this is for.
Become a design partner