For banks and credit unions
Every device, every decision and every gap, in one signed pack your examiner verifies on their own computer. Built for lean IT teams: no NAC project, no agents, and it never changes a switch.
We inventory every device on our network from our switches’ MAC tables and our firewalls’ ARP tables, read-only, every few minutes, and we record every period when a source was not being read.
Every approval or refusal of a device is signed by a named Reviewer with an authenticator code, and every week’s changes are reviewed and signed.
The attached evidence pack is signed. You can verify it offline with the key ID on our key registration sheet, without relying on us or on our vendor.
Adjust the second sentence if one person holds both the Admin and Reviewer roles: the pack discloses it either way.
What we hear
Composite situations from conversations with IT and security teams. Not quotes from customers.
At exam time
Every device on every polled switch port and firewall, with its site, switch, port, VLAN and maker, re-read every 150 seconds. Not a list someone typed. Printers, cameras and personal devices included, because nothing needs an agent.
Every day, for every source, the inventory also says whether the appliance was actually reading. A day it could not see is printed as “not monitored”.
A Reviewer approves or refuses each device with a reason and an authenticator code, and signs a weekly review of everything that changed. A device refused but still plugged in stays on the list until someone removes it.
The person who configures the appliance is not the person who signs. If one person does both, every pack says so.
One signed ZIP for the exam period: the inventory, every decision, every weekly review, and every hour a switch was not being read. The examiner runs the verifier, or the published by-hand steps, trusting one key ID from a sheet your ISO signs.
Seven checks, one verdict. A changed file, a missing entry or a rewritten history fails, and the report names it.
The Examiner role is read-only: the same screens your team uses, plus exports and the list of integrations, so they see everything that leaves the box. It cannot approve or change anything.
An Examiner account always has an end date, set when the Admin adds it. Every sign-in is in the audit log.
Frameworks
Safeguards 1.1 (asset inventory), 1.2 (address unauthorized assets) and 1.5 (passive discovery) show their evidence in the product, each with its checks and the pack files that prove it, and Met only when the data is there. Safeguard 1.3 (active discovery) is not claimed: it shows Needs evidence, because it is not built. Safeguard 1.1 also needs an owner for each approved device; owner editing is in development, so 1.1 shows the gap until then.
Every pack prints the frameworks its controls view refers to:
CIS Controls v8.1 / NIST CSF 2.0 / 12 CFR 30 App. B, 364 App. B, 748 App. A
That line is a label, not a mapping document. It supports your program with evidence. It does not replace it.
For the board
Enter the targets your board approved, such as deciding on every new device within two business days. The appliance measures every case against them from the signed log: time to detect, time to decision, coverage and reviews on time.
The signed board report carries the evidence pack for the same quarter. The verifier recomputes every figure, and a number that does not follow from the log fails.
Every figure comes from one input, the signed audit log: device sightings, alerts, decisions and each saved version of the policy. One policy target, from a fictional policy section IT-07 4.2: decide on new devices within 2 business days. Week by week over the third quarter, every case was decided in time except one, in the seventh week, so 41 of 42 cases met the target and the target is not met; pass or fail is decided on exact counts. Time to decision had a median of 5 hours 12 minutes and a 90th percentile of 1 day 9 hours, and the slowest case links to its log entries. Time to detect had a median of 2 minutes 31 seconds. Beside it, the board report for the quarter, a signed file with the figures as JSON and CSV, one row per case, the evidence pack for the same quarter and the proofs. The report verifier checks the signature and computes every figure again: the signed report prints PASS, and a copy with one figure changed prints NUMBERS DIFFER. All figures are fictional.
Vendor management
Read-only by construction, SNMPv3 with SHA-256 and AES-128, no inbound internet access, and an authenticator code on every sign-in. We also list what we have not done yet: no third-party penetration test and no SOC 2 report so far.
SNMP GET, GETNEXT and GETBULK only. It never changes a switch. When a port should be shut, the alert prints the command for a person to run.
No telemetry, no license check, no update check, no vendor endpoint. Destinations under gigidlabs.com are refused.
Device data leaves only for destinations an Admin configures: your SIEM, chat, ticketing or mail relay.
Every device on a monitored jack waits for a person’s decision, including the box someone plugs in to run their own AI. Imported lists and rules never approve anything.
Read the security pageFor technical buyersWhat we have not done yetTalk to us about a vendor review
Prices are not on this site yet; ask us, and we will answer in writing. What it needs from you is small: it runs on a server or VM you already have and reads the switches you already own, with no database to license and no per-endpoint agents.
A guided setup, and a live test for each switch that names the fix if something is wrong. After the first baseline, the routine is a weekly review of what changed.
Keep it. NAC enforces at the port. The appliance shows what is actually on the wire, including what NAC let through or what sits on monitor-only ports, and keeps the signed record of who approved each device. It never blocks, so it cannot cause an outage.
An RMM sees computers with its agent. Printers, cameras, phones and vendor kit have none; the switch sees all of them. The appliance also reports to your RMM through exit codes.
Engineers first, each with more than 20 years in the field, who kept seeing this gap and built the tool we wanted. We are in early access with pilot customers. We will show you the product live, answer your vendor review in writing, and tell you what it does not do yet. More about us
One appliance per client, wired into the tools you already run.
Know every device on your network without a security team.
Early access: now taking pilot customers.
A live demo on a simulated branch network, with the engineers who built it. Bring the questions your examiner asked last time.
