NUMBROOT is the world’s first hybrid Continuous Threat Exposure Management and endpoint control platform. It unifies agentless subnet vulnerability assessment with granular endpoint hardware enforcement in a single multi-cloud platform — discovery and containment in the same console, on any cloud, on-premise, or fully air-gapped.
100% surface coverage
Managed endpoints, rogue devices, network switches and IoT hardware — scanned without gaps and without an agent on any of them.
Contextual prioritisation
Real-time subnet findings mapped against endpoint enforcement state, so you remediate actual business risk instead of a CVE count.
Instant containment
From discovering a zero-day exposure to hardware-level isolation of the affected host in seconds, from the same console.
10 min
Full subnet re-scan cycle
<30 s
Satellite install time
<15 MB
Leaf agent memory
1-click
Hardware isolation
Built for regulated enterprises, hyperscale fleets and air-gapped networks
Traditional vulnerability management is broken, and bolting an EDR agent onto it does not fix the half of the estate that no agent will ever reach.
They sit outside your firewalls and return 500-page PDFs of non-contextual CVEs, days after the exposure appeared and with no idea which asset actually matters.
They consume real system memory on every workstation while offering zero visibility into unmanaged legacy devices, IoT hardware or guest subnets — precisely where the risk hides.
Blocking a USB port means authoring a policy, waiting for a sync window and hoping the device checks in. That is not containment, it is paperwork.
NUMBROOT closes the gap by merging agentless subnet discovery and deep system control into one unified enterprise dashboard — so the thing that finds the exposure is also the thing that can shut it down. It is attack surface management, continuous vulnerability assessment and endpoint device control in a single exposure management platform, rather than three consoles that never agree on what an asset is.
One Hub. One Satellite per subnet. One Leaf per endpoint. Everything speaks back over encrypted, auto-reconnecting WebSocket tunnels.
NUMBROOT Hub
AWS · Azure · GCP · Oracle · Bare metal · Air-gapped
Satellite Engine
CTEM and host discovery across the whole segment, with no agent on any target.
Leaf Agent
Hardware and shell control at SYSTEM / root, driven from the Hub console.
The central brain
Deploy anywhere — AWS, Azure, Google Cloud, Oracle Cloud, bare-metal servers or a localised air-gapped data centre.
Agentless subnet CTEM
One Satellite per subnet, installed from a native binary with administrator privileges in under thirty seconds.
Endpoint enforcement
A lightweight agent on workstations, servers and remote laptops, running at SYSTEM / root and answering to the Hub.
The whole estate comes online in the order shown below — Hub first, a Satellite into each network segment, then a Leaf agent on every corporate endpoint, all reporting back over their own outbound tunnels.
NUMBROOT Server
awaiting satellites
Satellite
10.20.4.0/24
Head office · 8 machines
Satellite
10.31.9.0/24
Data centre · 8 machines
Satellite
192.168.7.0/24
Plant floor · 8 machines
No agent on the target. No credentials to distribute. The Satellite enumerates the segment autonomously and fingerprints what it finds.
ARP · ICMP · SYN
Three discovery methods, so silent hosts still surface.
Banner grabbing
Service and version identification straight from the wire.
OS identification
Fingerprints the platform without touching the filesystem.
TLS cipher audit
Flags TLS 1.0/1.1 and weak suites the moment they appear.
Running at SYSTEM or root with a kernel-level watchdog, the Leaf agent turns a console click into a hardware-level fact on the endpoint — at layers a policy-sync tool never reaches.
Blocking a USB port is table stakes. What separates an enforcement agent from a policy engine is the class of attack it can reach — keyboards that are not keyboards, drivers that are signed but vulnerable, and memory read straight off the bus. Open any control to see what it stops.
Baseline — table stakes, included and assumed
Beyond the baseline — what a policy-based tool cannot reach
Streaming a shell is easy. Governing it is not: dual approval before it opens, a hash-chained keystroke ledger, destructive commands refused by the agent itself, and a session that stays alive after you cut the host off the network.
Dual approval
no single admin can open a shell
Hash-chained ledger
every keystroke, tamper-evident
Survives isolation
control rides the agent's own tunnel
Network killswitch
Drop the host off the network in one click while keeping your session alive.
Forced system lock
Lock the console immediately, wherever the laptop physically is.
Volume unmount
Detach mounted volumes before anything can be copied off them.
Reboot or shutdown
Power-state control from the Hub, with the action written to the audit log.
Most tools flood the SOC with duplicates: one entry for the IP, one for the hostname, one for the agent GUID. A deterministic fingerprint makes that impossible.
Automatic reconciliation
When a Satellite scans a host that also runs a Leaf agent, both feeds merge into a single asset record within 24 hours.
Telemetry fusion
Satellite findings give the external exposure view — open ports, external CVEs, response times. Leaf telemetry enriches it with patch level, running processes and hardware block state.
Inventory you can report on
Because the count reflects real machines rather than observations, it can be handed to an auditor without a reconciliation spreadsheet.
Satellite record
Leaf record
SHA256( hardware_uuid || primary_mac || system_serial )
A deterministic key, so the same machine can never enter the inventory twice — however many feeds report it.
| Capability | Legacy VMTenable / Qualys | Standard EDRCrowdStrike / SentinelOne | Traditional MDMIntune / Jamf | NUMBROOTHybrid platform |
|---|---|---|---|---|
| Agentless subnet discovery | Yes — slow scans | No | No | Yes — real-time, every 10 minutes |
| Zero-day exposure mapping | Yes | Partial | No | Yes |
| Hardware restriction (USB / HDMI / BT) | No | Limited | Yes — complex policy setup | Yes — instant one-click action |
| Interactive remote web CLI | No | Yes — expensive add-on | No | Yes — built-in over WebSockets |
| Subnet-level satellite engine | No | No | No | Yes — one Satellite per subnet |
| Automatic asset deduplication | Poor | Poor | None | Yes — hardware UUID hash |
| Cloud-agnostic / on-premise option | Cloud-dependent | Cloud-dependent | Cloud-dependent | 100% anywhere deployment |
Comparison reflects the standard product tiers of each category as commonly deployed. Product names are trademarks of their respective owners and are used here for identification only.
Built for tech-giant fleets and Fortune 500 estates, with no performance degradation as endpoint counts climb into the millions.
When a segment is breached, lock down every Leaf agent on it and isolate the whole subnet from one console action.
Satisfies CTEM, SOC 2 Type II, ISO 27001, HIPAA and PCI DSS requirements for continuous asset discovery and access control.
Leaf agents run under 15 MB of RAM, so security operations never show up as a slow laptop on an employee's desk.
Every tier includes full access to both the Satellite (agentless CTEM) and Leaf (endpoint control) binaries. No module upsells, no per-feature gates.
Mid-market organisations and SMBs standardising their first continuous exposure programme.
Large enterprises running segmented networks across multiple sites and regions.
Fortune 500 estates, hyperscalers and defence operators running dedicated or air-gapped infrastructure.
Annual licence per organisation. Indian customers may be invoiced in INR; GST extra where applicable. Multi-year, reseller and government procurement terms available on request.
Deploy NUMBROOT and see enterprise-grade CTEM with endpoint enforcement running in under fifteen minutes. Speak to the engineers who built it — on the phone or on WhatsApp.
30-day enterprise trial · air-gapped deployment available · no data leaves your network
Prefer to write first? Contact the PITOWINGS team. You may also want CBOMASTER for post-quantum cryptography posture, or our VAPT and offensive security services to validate what NUMBROOT surfaces.
