NUMBROOT is the world’s first hybrid Continuous Threat Exposure Management and endpoint control platform. It unifies agentless subnet vulnerability assessment with granular endpoint hardware enforcement in a single multi-cloud platform — discovery and containment in the same console, on any cloud, on-premise, or fully air-gapped.
100% surface coverage
Managed endpoints, rogue devices, network switches and IoT hardware — scanned without gaps and without an agent on any of them.
Contextual prioritisation
Real-time subnet findings mapped against endpoint enforcement state, so you remediate actual business risk instead of a CVE count.
Instant containment
From discovering a zero-day exposure to hardware-level isolation of the affected host in seconds, from the same console.
10 min
Full subnet re-scan cycle
<30 s
Satellite install time
<15 MB
Leaf agent memory
1-click
Hardware isolation
Built for regulated enterprises, hyperscale fleets and air-gapped networks
Traditional vulnerability management is broken, and bolting an EDR agent onto it does not fix the half of the estate that no agent will ever reach.
They sit outside your firewalls and return 500-page PDFs of non-contextual CVEs, days after the exposure appeared and with no idea which asset actually matters.
They consume real system memory on every workstation while offering zero visibility into unmanaged legacy devices, IoT hardware or guest subnets — precisely where the risk hides.
Blocking a USB port means authoring a policy, waiting for a sync window and hoping the device checks in. That is not containment, it is paperwork.
NUMBROOT closes the gap by merging agentless subnet discovery and deep system control into one unified enterprise dashboard — so the thing that finds the exposure is also the thing that can shut it down. It is attack surface management, continuous vulnerability assessment and endpoint device control in a single exposure management platform, rather than three consoles that never agree on what an asset is.
One Hub. One Satellite per subnet. One Leaf per endpoint. Everything speaks back over encrypted, auto-reconnecting WebSocket tunnels.
NUMBROOT Hub
AWS · Azure · GCP · Oracle · Bare metal · Air-gapped
Satellite Engine
CTEM and host discovery across the whole segment, with no agent on any target.
Leaf Agent
Hardware and shell control at SYSTEM / root, driven from the Hub console.
The central brain
Deploy anywhere — AWS, Azure, Google Cloud, Oracle Cloud, bare-metal servers or a localised air-gapped data centre.
Agentless subnet CTEM
One Satellite per subnet, installed from a native binary with administrator privileges in under thirty seconds.
Endpoint enforcement
A lightweight agent on workstations, servers and remote laptops, running at SYSTEM / root and answering to the Hub.
The whole estate comes online in the order shown below — Hub first, a Satellite into each network segment, then a Leaf agent on every corporate endpoint, all reporting back over their own outbound tunnels.
NUMBROOT Server
awaiting satellites
Satellite
10.20.4.0/24
Head office · 8 machines
Satellite
10.31.9.0/24
Data centre · 8 machines
Satellite
192.168.7.0/24
Plant floor · 8 machines
No agent on the target. No credentials to distribute. The Satellite enumerates the segment autonomously and fingerprints what it finds.
ARP · ICMP · SYN
Three discovery methods, so silent hosts still surface.
Banner grabbing
Service and version identification straight from the wire.
OS identification
Fingerprints the platform without touching the filesystem.
TLS cipher audit
Flags TLS 1.0/1.1 and weak suites the moment they appear.
Running at SYSTEM or root with a kernel-level watchdog, the Leaf agent turns a console click into a hardware-level fact on the endpoint — at layers a policy-sync tool never reaches.
Blocking a USB port is table stakes. What separates an enforcement agent from a policy engine is the class of attack it can reach — keyboards that are not keyboards, drivers that are signed but vulnerable, and memory read straight off the bus. Open any control to see what it stops.
Baseline — table stakes, included and assumed
Beyond the baseline — what a policy-based tool cannot reach
Streaming a shell is easy. Governing it is not: dual approval before it opens, a hash-chained keystroke ledger, destructive commands refused by the agent itself, and a session that stays alive after you cut the host off the network.
Dual approval
no single admin can open a shell
Hash-chained ledger
every keystroke, tamper-evident
Survives isolation
control rides the agent's own tunnel
Network killswitch
Drop the host off the network in one click while keeping your session alive.
Forced system lock
Lock the console immediately, wherever the laptop physically is.
Volume unmount
Detach mounted volumes before anything can be copied off them.
Reboot or shutdown
Power-state control from the Hub, with the action written to the audit log.
Most tools flood the SOC with duplicates: one entry for the IP, one for the hostname, one for the agent GUID. A deterministic fingerprint makes that impossible.
Automatic reconciliation
When a Satellite scans a host that also runs a Leaf agent, both feeds merge into a single asset record within 24 hours.
Telemetry fusion
Satellite findings give the external exposure view — open ports, external CVEs, response times. Leaf telemetry enriches it with patch level, running processes and hardware block state.
Inventory you can report on
Because the count reflects real machines rather than observations, it can be handed to an auditor without a reconciliation spreadsheet.
Satellite record
Leaf record
SHA256( hardware_uuid || primary_mac || system_serial )
A deterministic key, so the same machine can never enter the inventory twice — however many feeds report it.
Every detection, every finding and every remediation in NUMBROOT is backed by something you can inspect yourself — the packet, the reproduction, the signature. Never a confidence number we ask you to trust.
Every detection
The five-tuple, protocol, service, process and epoch timestamp it came from — not a summary of them.
Every finding
A reproducible exploit against the specific asset, not a version string matched to a CVE list.
Every remediation
An Ed25519 signature over a re-test that failed, verifiable without asking us to confirm it.
Every asset, finding and live signal collapses into a single Cyber Exposure Score — weighted the way attackers actually behave rather than the way a severity column is printed.
Not CVSS alone
The score fuses CISA KEV for what is exploited today, EPSS for what is likely to be, ransomware family association, and real reachability from the internet edge.
Position beats severity
A critical nobody can reach scores below a medium sitting one hop from a domain controller. Topology is an input, not a footnote.
A queue that ends
Your team fixes the 3% that matter this week instead of the 40% a legacy scanner will flag forever.
CISA KEV
in the wild today
Known-exploited
EPSS
30-day forecast
Exploit probability
Ransomware
linked tooling
Family association
Reachability
provable path
From the internet edge
Ranked by severity alone
0%
of 1,284 findings flagged critical or high — a queue nobody finishes.
Ranked by exposure
0%
reachable, exploited in the wild, and one hop from something that matters.
NUMBROOT maps every route from an exposed foothold to your crown jewels — this internet-facing host, this credential, this lateral hop — and then shows you which single fix severs the most of them at once.
Rotate one over-privileged service credential and 34 of the 38 paths disappear. That is the fix the queue would have ranked forty-first.
Fleet topology
The whole estate rendered as it actually connects, not as the network diagram in the wiki says it does.
Attack-path analysis
The exact chain traced end to end — foothold, credential, hop, target — with each edge attributable to something observed.
Choke-point analysis
The fixes ranked by how many paths they sever, so one remediation can collapse dozens of routes.
Crown-jewel view
Click a domain controller or a data store to see precisely how it can be reached, and what to cut first.
East-west detections
netflow · every Leaf subnet
Lateral movement · subnet sweep
t=178941266310.20.4.57:49882 → 10.20.9.0/24:445 · TCP · smb · powershell.exe
Internal port scan
t=178941270110.20.6.31:51204 → 10.20.6.1:1-1024 · TCP · multi · nmap
Credential stuffing against jump host
t=178941274410.20.4.57:44120 → 10.20.1.9:22 · TCP · ssh · sshd
Privilege escalation attempt
t=178941279010.20.1.9:0 → 10.20.1.9:0 · LOCAL · kernel · pkexec
Every row above is the packet record, not a summary of one — full five-tuple, protocol, service, originating process and epoch timestamp, correlated across the fleet.
NUMBROOT watches east-west traffic across every subnet where a Leaf agent is deployed, and classifies what it sees.
Probe · DoS · U2R · R2L
The four classical attack families, detected on the wire between your own hosts.
Abnormal
Our behavioural class: lateral movement, subnet sweeps and internal port scans — the signature of an attacker already inside.
100% real netflow evidence
Source IP and port, destination IP and port, protocol, service, originating process, exact epoch timestamp.
Confidence that grows
Correlation strengthens as coverage does, because the evidence is pooled across the fleet rather than judged per host.
No inferred alerts and no black-box scoring. If NUMBROOT says it saw something, it can show you the traffic it saw.
Legacy scanners tell you a CVE might be present. NUMBROOT proves whether it is actually exploitable in your environment, and hands you the reproduction.
Exploitability, not presence
A scanner tells you a CVE might apply. NUMBROOT runs the check in your environment and keeps what actually worked.
Deduplicated across feeds
Satellite and Leaf sightings of the same weakness collapse into one finding against one asset.
Tied to a reachable path
Each finding carries the route that reaches it, so severity is argued from topology rather than asserted.
Ranked by real-world risk
The queue is ordered by what an attacker can use this week, not by the highest number in the CVSS column.
You stop drowning in theoretical findings and start acting on proven exposure.
PITO does not just recommend the fix. Backed by the Leaf agent's endpoint control, it applies it — and the gap between knowing and fixed shrinks from weeks to minutes.
Patch
Vendor rollups and hotfixes staged across the fleet, in the order dependency allows.
Reconfigure
Services, registry keys and daemon settings brought back to the hardened baseline.
Isolate
The host cut off the network at the Leaf agent while the session stays alive for the responder.
Harden
Device classes, driver load policy and pre-boot media locked down at the endpoint.
Policy-gated
Actions run only inside the blast radius you define — by tier, by tag, by site.
Human in the loop where you want one
Approval is a per-action setting, not a global switch you have to leave on or off.
Rollback aware
Every change records the state it replaced, so an action can be reversed as deliberately as it was applied.
When NUMBROOT fixes a finding it re-runs the exploit and issues an Ed25519-signed certificate: it succeeded before, and it provably fails after.
Tamper-evident
The certificate is signed over the evidence, so an altered record stops verifying rather than quietly reading as valid.
Independently verifiable
Anyone holding the public key can check it. Nobody has to take our word for the outcome, including us.
Records what was removed
Not 'resolved' — the exact exposure points that no longer exist, listed.
Catches a quiet reopen
If the issue comes back, the certificate is marked reopened, so the trail reflects the estate rather than the ticket.
Hand these to auditors, insurers and your board as hard evidence that the risk was eliminated — not that a ticket was closed.
Before
Exploit reproduced
CVE-2024-21413 · RCE confirmed on FIN-WS-0142
Action
PITO remediation applied
Patch rollup + registry hardening, policy-gated
After
Exploit re-run and failed
Same payload, same host, no code execution
Proof-of-Remediation certificate
Ed25519
If the finding quietly reopens, the certificate is marked reopened — so the audit trail reflects the estate rather than the ticket queue.
CycloneDX CBOM
cbom-1.6.json
0 quantum-vulnerable objects
RSA-2048
TLS · 412 certificates
Quantum-vulnerable→ ML-KEM-768
ECDSA P-256
Code signing · 38 keys
Quantum-vulnerable→ ML-DSA-65
3DES
Legacy VPN · 2 tunnels
Deprecated→ AES-256-GCM
AES-256-GCM
Data at rest · fleet-wide
Quantum-resistant—
SHA-384
Integrity · fleet-wide
Quantum-resistant—
NUMBROOT inventories the cryptography running across your estate — algorithms, key sizes, protocols, certificates — and produces a CycloneDX Cryptographic Bill of Materials.
A real inventory
Not a policy document. What is actually negotiated on the wire and signed on disk, discovered the same way assets are.
Quantum-vulnerable, flagged
RSA and ECC surfaced wherever they run, with the count that makes the migration a project rather than an intention.
CycloneDX CBOM
An open standard your other tooling can already read, not a report format only we can open.
A mapped migration path
Each flagged object carries its post-quantum successor, so the work can be scheduled before Q-Day rather than after it.
Exposure translated into trend lines and dollar-risk on top; underneath, a record of every action taken in the platform and who was allowed to take it.
Board-ready in trend lines
Exposure over time, dollar-risk and progress against target — no security jargon required to read it.
Tamper-evident activity log
Who did what, when, and what changed. Hash-chained, so an edited history is a detectable one.
Role-based access control
Separation of duties enforced in the product: the person who approves an action is not always the person who runs it.
NUMBROOT streams findings, detections and signed remediation proofs to your SIEM and SOAR, opens and closes work in your ticketing system, and reads group and role from your identity provider — so the triad is closed without being a silo.
| Capability | Legacy VMTenable / Qualys | Standard EDRCrowdStrike / SentinelOne | Traditional MDMIntune / Jamf | NUMBROOTHybrid platform |
|---|---|---|---|---|
| Agentless subnet discovery | Yes — slow scans | No | No | Yes — real-time, every 10 minutes |
| Zero-day exposure mapping | Yes | Partial | No | Yes |
| Hardware restriction (USB / HDMI / BT) | No | Limited | Yes — complex policy setup | Yes — instant one-click action |
| Interactive remote web CLI | No | Yes — expensive add-on | No | Yes — built-in over WebSockets |
| Subnet-level satellite engine | No | No | No | Yes — one Satellite per subnet |
| Automatic asset deduplication | Poor | Poor | None | Yes — hardware UUID hash |
| Cloud-agnostic / on-premise option | Cloud-dependent | Cloud-dependent | Cloud-dependent | 100% anywhere deployment |
Comparison reflects the standard product tiers of each category as commonly deployed. Product names are trademarks of their respective owners and are used here for identification only.
Built for tech-giant fleets and Fortune 500 estates, with no performance degradation as endpoint counts climb into the millions.
When a segment is breached, lock down every Leaf agent on it and isolate the whole subnet from one console action.
Satisfies CTEM, SOC 2 Type II, ISO 27001, HIPAA and PCI DSS requirements for continuous asset discovery and access control.
Leaf agents run under 15 MB of RAM, so security operations never show up as a slow laptop on an employee's desk.
Every tier includes full access to both the Satellite (agentless CTEM) and Leaf (endpoint control) binaries. No module upsells, no per-feature gates.
Mid-market organisations and SMBs standardising their first continuous exposure programme.
Large enterprises running segmented networks across multiple sites and regions.
Fortune 500 estates, hyperscalers and defence operators running dedicated or air-gapped infrastructure.
Annual licence per organisation. Indian customers may be invoiced in INR; GST extra where applicable. Multi-year, reseller and government procurement terms available on request.
Deploy NUMBROOT and see enterprise-grade CTEM with endpoint enforcement running in under fifteen minutes. Speak to the engineers who built it — on the phone or on WhatsApp.
30-day enterprise trial · air-gapped deployment available · no data leaves your network
Prefer to write first? Contact the PITOWINGS team. You may also want CBOMASTER for post-quantum cryptography posture, or our VAPT and offensive security services to validate what NUMBROOT surfaces.
