📢 New post: The Login Was Valid: Cisco FMC CVE-2026-20316 and the Console Nobody Scoped · 📝 Also fresh: Partial Impact, Whole Credential: MLflow CVE-2026-64849 and the KEV Item You Installed with pip · 🚦 Beacon — the FedRAMP 20x KSI emitter — see what it emits ✨ · 🆕 20x Hub: program reference, kept current · 🧪 Free tool: KSI Quick Check — paste, run, get the verdict

Products

Four products. Each one deploys inside your boundary.

NAICOM and Citadel are released and are what we lead with. Beacon and the FedRAMP Management Engine are the federal compliance tooling we shipped first, and the reason we know what an assessor will actually accept as evidence. Each entry below links to one page that carries that product end to end.

Released

Generally available, deployed inside the customer's own authorization boundary.

The NAICOM sessions view: a counter strip reading total and active sessions, an active-sessions panel listing code, QA and research runs each against an issue key, a 90-day activity heatmap, and a recent-sessions table.
Our product Generally available

NAICOM

The audit trail for AI-assisted engineering.

NAICOM sits between your engineers and the models they work with, and writes down what happened. Every session opens against a tracked issue. Every instruction is a versioned prompt file committed beside the code it produced. Every commit carries the session ID, the issue key, and the human who approved the merge — so "which of these changes was AI-written, on whose authority, and under what instruction?" is a query, not an investigation. It runs against the forge you already use — GitHub, GitLab, Bitbucket or Gitea, resolved per repository — so nothing about the existing workflow has to move.

Sustains 100+ dispatches a day on a single host, measured. Designed to scale with workers and to track work across thousands of issues; proven across 8 concurrent projects.

Demo-tenant capture — the sessions view of the fictional demo customer.

Everything about NAICOM →
Diagram: a Citadel control plane above a fleet of enrolled hosts, each returning a signed result over mutually authenticated TLS into an append-only evidence stream mapped to the CM, SI and AU control families.
Our product Version 1.0.0 · generally available

Citadel

Live host-state evidence for regulated fleets.

Citadel is a host-state evidence platform for regulated environments. It enrols and configures the Citadel agent across a host fleet, distributes compliance-aligned query packs, and turns their results into a signed, append-only evidence stream — so "what is actually running on every host, and what was running on the day of the finding" is a SQL question with a timestamped answer instead of a quarterly screenshot.

Built for fleet-scale collection over mutually authenticated TLS, with packs distributed per platform and every result signed at the agent. Air-gap and FIPS 140-3 capable.

Diagram — Citadel ships no dashboard of its own to photograph.

Everything about Citadel →

Federal compliance tooling

Built for the FedRAMP 20x pathway and the Rev 5 baseline underneath it.

Diagram: cloud and infrastructure-as-code inputs read into the Beacon evaluator, which emits signed KSI evidence — KSI-IAM, KSI-CNA, KSI-CMT — on a repeating three-day cadence timeline.
Beta

Beacon

The continuous KSI emitter for FedRAMP 20x.

Beacon reads infrastructure state continuously and emits signed, machine-readable Key Security Indicator evidence — at the three-day cadence 20x asks for and in the format the Consolidated Rules 2026 mandate. It plugs into the FedRAMP Management Engine or stands alone against your own package.

Designed to emit KSI evidence at the three-day 20x cadence from cloud primitives and IaC it reads directly. The open-source evaluator produces verbatim, reproducible output today.

Diagram — Beacon is a command-line evaluator, not a screen.

Everything about Beacon →
Diagram: two authorization pathways — FedRAMP 20x KSI emissions and the Rev 5 OSCAL baseline — converging on one record, which issues the OSCAL SSP, the POA&M lifecycle and the evidence ledger.
Limited release

FedRAMP Management Engine

The system of record for authorization, in both directions.

The Engine holds Beacon's 20x KSI emissions as the authoritative package, and generates Rev 5 OSCAL artifacts and POA&M lifecycle for organizations still on the traditional path through the Consolidated Rules transition window. One record, whichever pathway an authorization is on.

Designed to carry a full Rev 5 Moderate baseline as OSCAL, with POA&M lifecycle and evidence origin references sourced from Beacon and Citadel rather than re-keyed.

Diagram — a seeded Engine holds no customer package to show.

Everything about FedRAMP Management Engine →

Next

How the four relate →

One authorization boundary, one audit surface — host state underneath, KSI emission on top.

Frameworks, answered with artifacts →

Which product produces the record against AI RMF, ISO 42001, 800-53 Rev 5, and FedRAMP 20x.

Request a demo →

A working instance and the evidence it produces, against your own requirements.