How CyberSecurityOS
deploys, integrates, and prices.
The reference document for procurement, platform engineering, CISOs, and GRC. Five sections: surfaces, integration patterns, deployment topologies, pricing model, compliance alignment, SLA tiers. Everything a 2026 MSA needs in one place.
1 · Surfaces
Three product surfaces on one measurement substrate.
Every surface ships over the same Joule Wire Protocol. Every verdict carries a JWP ReceiptPayload. Buy one, two, or all three — the protocol doesn't change.
Defensive Substrate
Static ledger + runtime drift + signed bundles. Consumed by your SOC, SRE, platform eng. Integrates via REST / NDJSON / SDK.
Offensive Operator CLI
Red-team primitives for authorized operators on your payroll. Fingerprint, diff, corpus-search, leak-scan. Per-seat licensing.
Cyber Range & BAS
Reproducible attack scenarios, sandboxed, ATT&CK-scored, signed coverage attestations. Per scenario-hour or managed tier.
2 · Integration patterns
Five ways to consume CyberSecurityOS.
REST API
operational · synchronousHit the ledger / verify / range endpoints from any service. Each response includes a signed JWP ReceiptPayload.
POST /api/v1/joule-sec/ledger
POST /api/v1/joule-sec/verify
POST /api/v1/joule-sec/range/coverage
GET /api/v1/joule-sec/healthNDJSON streams
telemetry · streamingOne JouleTrace per line on stdin, one DriftReport per line on stdout. Pipe into your SIEM with one tail.
joule-sec-tap --backend hardware --pid $PID \
| joule-sec watch ./target-bin \
| tee -a /var/log/sec/joule.ndjson \
| your-siem-ingesterRust SDK
library · embeddedjoule-sec as a crate. Build ledgers, compute drift, generate attestations inline in your own service. No extra process.
[dependencies]
joule-sec = { version = "0.1", features = ["jwp"] }
joule-sec-range = "0.1"Fleet agent
endpoint · daemonDeploy the reference agent to every server or endpoint in your fleet. Monitors running processes against a signed known-good corpus; emits verdicts to your SIEM. Cross-platform native binaries, OS-standard log paths, menu-bar indicator included.
Signed bundles
supply-chain · Ed25519 / ML-DSAShip a signed fingerprint bundle with every release. Consumers verify the bundle against your pinned public key before trusting it. Constant verification cost: one BLAKE3 hash plus one Ed25519 verify, regardless of corpus size.
3 · Deployment topologies
Four shapes. Pick the one your compliance team can sign off on.
4 · Pricing model
Priced by measurable unit, not by alert volume.
The industry standard is vendor-defined "events per second" — pricing that punishes you for generating more telemetry. CyberSecurityOS prices by units you can count and audit: seats, verifications, fleet size, scenario-hours. Contact for current schedules.
Operator CLI
One seat per authorized red-team operator. Seats are named and audit-logged. Volume pricing above 5 seats.
REST API · Managed
One unit per /verify or /ledger call. Bulk tiers for CI/CD integration at pipeline scale.
Fleet agent · On-prem
Annual subscription banded by endpoint count. Includes signed bundle publication for your release line.
Cyber Range
One unit per scenario run against your target. Continuous BAS pricing available for 24/7 coverage.
Platform subscription
Annual contract covering all three surfaces, with a named customer success engineer and quarterly posture reviews.
Air-gapped licence
Annual licence with physical-media update schedule. Includes source-code escrow and cleared-engineer support.
5 · Compliance alignment
Signed coverage reports map into your frameworks.
Every coverage report is signed with Ed25519 and shipped as a JWP ReceiptPayload. Drops into your evidence locker as a tamper-evident artifact, indexed by ATT&CK technique. Maps to the control families auditors ask about.
We do not certify customer deployments. Alignment means the evidence format fits the framework's documentation expectations; final attestation is your auditor's.
6 · Security model
Tamper-evident by construction.
Signed artifacts
Ledgers, corpora, coverage reports — all BLAKE3-hashed and Ed25519-signed (ML-DSA FIPS 204 on request). Verification is constant-cost. Tampering voids the signature.
Authorization gates
Dual-use primitives (leak-scan, range, attack emulation) require a named MSA-scoped authorization token. Every invocation is audit-logged.
Sandbox isolation
Range scenarios execute in isolated VMs / containers tied to your authorized target fleet. Sandbox escape requires signed artifact export under your MSA.
Data minimization
Joule traces contain no payload bytes. Ledgers contain instruction classes and picojoule estimates, not source code. Telemetry you send us is strictly statistical.
7 · SLA tiers
Three tiers of support.
Ready to scope?
Send us your fleet size, compliance frameworks, and deployment preferences. We'll come back with a scoping document and a pricing schedule — in that order.
Request scoping call