How it is built.
Everything on this page is a design commitment, not an adjective. Sizing figures, partner terms, scheme details and delivery plans are available to design partners under non-disclosure.
The trust chain, from firmware to container.
The platform refuses to run altered software and can prove what it is running. These are the mechanisms behind that sentence.
The operating system is an artefact
Enterprise Linux in image mode: the whole operating system is one signed image built in Withstand's pipeline, hardened to a government baseline and audited with open tooling, with mandatory access control enforcing and validated cryptographic modules. The system switches images atomically and rolls back on its own if the new image fails to boot.
Withstand owns the boot trust chain
Withstand's own Secure Boot keys are enrolled on the hardware at integration and the vendor's keys are removed. The system boots only a unified kernel image signed by Withstand, and TPM measurements extend from firmware through the kernel and operating-system image to every container image. Attestation reports are exportable for assessors.
Storage unlocks only to a measured system
Self-encrypting drives and encrypted volumes are bound to the TPM through measured boot. Keys are released only when the measured chain matches the accredited state, so a drive removed from the system is inert. Crypto-erase supports classified decommissioning.
Every service is signed and confined
Services run as containers in namespaces per functional area, with a deny-all network policy that permits only the published contract paths. Every image is signed in the same pipeline as the operating system and admission is enforced by signature. Services run as non-root with read-only root filesystems and confined by mandatory access control.
What was accredited is what ships
A software bill of materials for every release, a hardware bill of materials for every unit, and a model bill of materials for every model, with a revision lock on all three. Each release carries an accreditation change delta naming every changed component, so an assessor can scope re-assessment instead of starting over.
Updates arrive by controlled media
A signed bundle on physical media carries the operating-system image, container images, detection content, models and threat intelligence, each with its bill of materials. Import verifies every signature against the trust root, records the import as evidence, and applies the update atomically with automatic rollback if health checks fail. In classified profiles, import is a dual-controlled operation.
Evidence an intruder cannot rewrite.
An attacker who reaches the monitoring layer can blind the organisation, alter evidence and hide. The evidence tier is built so that the second of those is impossible.
- Findings, verdicts, decision trails, actions and administrative events are written to a write-once evidence tier. Every record carries the hash of the record before it.
- Signed anchors of the chain head are written at a fixed interval and on every export and recovery. From any anchor forward, an assessor can verify that the evidence presented is complete and unaltered.
- Deletion within the retention period is architecturally impossible, not a permission. Exports carry the chain proofs, so a successor system or an auditor can verify what was exported without trusting Withstand.
Who is allowed to act, decided in the core.
The engine that proposed an action has no influence on whether it runs.
- Policy lives in the core. Any engine may propose an action; only the core's gating engine authorises it and only the core's executor performs it. No engine can alter the policy table.
- Every proposed action is evaluated against an environment profile crossed with an action class and the verdict's confidence. The outcome is automatic execution, human approval required, or prohibited.
- Operational-technology and classified profiles default to human approval. Any action on a Purdue Level 0 to 2 asset is never automated, whichever engine proposed it.
- Policy changes, media imports and evidence exports in classified profiles require dual control. Every change to a profile is itself an evidence event.
- Engines never hold product credentials. Actuator adapters run as isolated services with their own credentials from a secret store sealed to the TPM.
Every engine replaceable, behind a defined contract.
| Contract | What crosses it |
|---|---|
| Events and findings | All normalised telemetry and every detection, from every engine, in one schema. |
| Detection content | Rules are content, not engine internals. Content outlives the engine that runs it. |
| Investigation and verdict | Finding in; verdict, confidence, proposed actions and a decision trail out, written to evidence before any action is considered. |
| Playbooks | Response workflows as data. An engine proposes a playbook; only the core executes it. |
| Actions | Commands to firewalls, endpoint tools, identity providers, network access control and OT-safe isolators, one adapter per product family. |
| AI-system telemetry | Prompts, responses, tool calls and agent actions as traces. |
| Control results | Obligation, control, evidence reference and status, for the compliance engine. |
Each contract has a schema, a conformance suite and a reference adapter. An engine is integrated when it passes the suite, and the same suite gates its replacement. Swapping an engine means running both against the same findings, cutting over per tenant with rollback, and keeping every verdict and trail in Withstand's schema so history survives the swap. Storage is Parquet in an open table format, readable with commodity tools after Withstand is gone.
Where the architecture answers each framework.
| Framework | What answers it |
|---|---|
| ISM and IRAP | Hardened signed image, validated cryptography, the evidence tier, controlled media import, classification-separated topology. |
| Essential Eight | Control-level measurement from live telemetry; the platform's own application control, patching, privilege restriction, multi-factor authentication and backup. |
| APRA CPS 234 and CPS 230 | Continuous control measurement, resilience indicators, evidence exports. |
| SOCI and CIRMP | Control results mapped to programme elements; obligation-mapped narratives. |
| NIST AI RMF, ISO/IEC 42001, OWASP LLM Top 10 | AI-system collection as a first-class source, AI-security content, model bills of materials, guardrails on the platform's own model. |
| FIPS 140-3 | Validated modules for all cryptography; TLS 1.3 with mutual authentication on every internal connection. |
| IEC 62443 | Purdue-aligned passive collection, hardware data diodes, an OT action policy that never automates control-network actions. |
AI you can put in front of an assessor.
Where learning is used, where it is not, and where every model comes from.
- Classical machine learning does detection. Generative models investigate, explain, draft and rank; a verdict is a proposal until the gating engine decides. Reinforcement learning is applied only where the reward can be verified, such as whether a generated rule fires on a labelled attack corpus and stays silent on a benign one, and never to choosing an action.
- Two training paths and no third. Base training runs in Withstand's build environment on Withstand-owned corpora and ships as signed artefacts. Adaptation on your telemetry runs on your own hardware as adapters that remain there. No customer data reaches Withstand's training environment and no pooled model is trained across customers.
- Every shipped model carries a model bill of materials: base weights, licence, training corpora, adaptation steps and evaluation results, signed with the release. Open-weight families with published training data are preferred, community-licensed families are described as open-weight rather than open source, and families whose provenance an assessor cannot inspect are excluded.
- The natural-language query never answers from memory. It writes a query, runs it against the lake, and returns the result with the query shown, so an analyst can verify and reuse it.
- The platform's own model is a monitored AI system. Its prompts, responses and tool calls are collected like any other, and the AI-security detection content applies to them. The generative layer has read access to the lake and evidence tier and no other capability.
Check it against your own constraints.
The next-generation Withstand platform is being built with design partners whose constraints are the specification. If your networks cannot leave, you are who this is for.
Become a design partner