Request a demoDemo
Menu

Connect · Your policy, measured

The policy your board approved, measured.

Time to detect, time to decision, coverage over time and policy pass or fail, measured from the signed log against the targets your board set.

Request a demoTechnical detail
Status
Available
Screens
Designed, not built yet
Command line
appliance metrics

The problem

A board approves an IT policy. Showing whether the bank met it usually means hand-built spreadsheets.

How it works, illustrated

Your policy, measured: a policy target over a quarter, and the signed board reportA policy target measured week by week from the signed log: 41 of 42 cases met. The signed board report verifies as PASS; a changed copy fails as NUMBERS DIFFER.Signed logthe only inputdevice_first_seenalert_raiseddecisionconfig_changeThe CLI on a copy of thedatabase and the offlineverifier get the same numbers.Policy IT-07 §4.2 · Q3Decide on new devices within 2 business daysdecide_new_device · weekends and holidays count nothingJulAugSepall meta miss41 of 42 cases metTarget not metJudged on exact counts; the miss links to its log entries.Time to decisionmedian 5 h 12 m90th percentile 1 d 9 hTime to detectmedian 2 m 31 ssighting to alertBoard report2026-Q3Example Community Bankevidence packSigned, with:figures as JSON and CSVone row per casethe evidence packproofs for each entryreport-verify board-report.zipPASSa copy with one figure changedNUMBERS DIFFERYour policy, measured: a policy target over a quarter, and the signed board reportA policy target measured week by week from the signed log: 41 of 42 cases met. The signed board report verifies as PASS; a changed copy fails as NUMBERS DIFFER.Measured from the signed log, and nothing else.Policy IT-07 §4.2 · Q3Decide on new devices within2 business daysdecide_new_deviceJulAugSep41 of 42 metTarget not metOn exact counts. The miss links to its entries.Time to decisionmedian 5 h 12 m90th percentile 1 d 9 hTime to detectmedian 2 m 31 sBoard report2026-Q3Example Community Bankevidence packSigned, with:figures as JSON and CSVone row per casethe evidence packproofs for each entryreport-verify board-report.zipPASSa copy with one figure changedNUMBERS DIFFER
Your policy, measured. Every figure is computed from the signed log, and the report verifier computes it again. Illustration with fictional figures.
What this shows

Every figure comes from one input, the signed audit log: device sightings, alerts, decisions and each saved version of the policy. One policy target, from a fictional policy section IT-07 4.2: decide on new devices within 2 business days. Week by week over the third quarter, every case was decided in time except one, in the seventh week, so 41 of 42 cases met the target and the target is not met; pass or fail is decided on exact counts. Time to decision had a median of 5 hours 12 minutes and a 90th percentile of 1 day 9 hours, and the slowest case links to its log entries. Time to detect had a median of 2 minutes 31 seconds. Beside it, the board report for the quarter, a signed file with the figures as JSON and CSV, one row per case, the evidence pack for the same quarter and the proofs. The report verifier checks the signature and computes every figure again: the signed report prints PASS, and a copy with one figure changed prints NUMBERS DIFFER. All figures are fictional.

appliance metrics -data-dir /var/lib/appliance -preset last_quarter \    -tz America/Chicago -fail-on-miss# computes every figure from the log, read-only# exit 0: done, exit 9: a target was missed (for an RMM or CI job)
Command-line usage from the appliance’s reference.

Figures come as JSON, as long-form CSV for Excel, Power BI or Tableau, as one row per case, and as Prometheus text.

The Reports dashboard and the policy form are designed and arrive with the new interface.

How it works

  • Enter your targets, for example: decide on every new device within 2 business days. Weekends and your holidays count nothing.
  • Measures: time to detect, time to decision (wall clock and business days), time to remove a refused device, the age of unapproved devices, coverage per source, site and day, and weekly reviews on time.
  • Each case is judged by the policy in force when its clock started, so loosening the policy later cannot excuse an earlier miss.
  • Pass or fail is decided on exact counts: 94.995% does not pass a 95% target.
  • Computed from log entries only, so the appliance, the command line and the report verifier get the same numbers.
  • Every policy save is a log entry with the whole policy, so the versions form a chain.

What it proves

Meeting the policy stops being a claim. Every figure links to the cases and log entries it came from, and each version of the policy is itself evidence.

What it records

Entries this feature writes to the tamper-evident audit log. Each one is in the evidence packs that cover its date.

  • config_changeFor policy: the whole normalized policy, and the entry of the version before it.

Limits

What it does not do yet, stated plainly. The technical page lists every known gap.

  • The screens are not built yet.
  • Prometheus text is served behind a sign-in. A shared scrape endpoint is not built.
  • Blind-segment completeness is not part of coverage yet.

Technical detail

Docs · Feature referenceYour policy, measured: how it is builtWhat it does, how it works, what it records, security notes, limits and known gaps, the command line, data routes and the review summary.

Also in Connect

Reconcile against IT’s lists

Compares the wire with Active Directory, Entra ID, Intune, CrowdStrike, Defender and DHCP lists. An import never approves a device.

Integrations

Sends alerts to Splunk, Microsoft Sentinel, syslog (CEF, LEEF), Teams, Slack, ServiceNow, ConnectWise, Autotask, HaloPSA, PagerDuty, email and your NMS (SNMP informs or traps), filtered per destination, and streams the evidence log to Splunk, Sentinel, syslog and signed webhooks.

CSV and NDJSON exports

Seven lists download as formula-safe CSV or NDJSON with the same columns everywhere, and every export from the interface is logged.

Early access: now taking pilot customers.

See it on your own network.

A live demo with the engineers who built it. We bring a simulated network; you bring your questions.

Request a demoDocumentation