Is this safe to run on production?
Learning never enforces. It observes connections and reports them; it does not write a firewall rule unless you turn protection on, which is a separate deliberate action per host.
Blast radius
What can one compromised
machine reach today?
Most people cannot answer this about their own network. It takes twenty minutes to set up and a week of watching to find out, it fits inside the trial, and you do not have to change a single firewall rule to get the answer.
How it works
Three steps, no enforcement.
This is the first week of a trial, used deliberately. Nothing here changes a rule on any host.
day 1 · 20 min
01
Install on the ones that worry you
A domain controller, a file server, whatever a laptop can reach. The trial covers ten servers, which is enough to see who reaches them.
days 1–7
02
Let it watch
Learning records what those hosts actually talk to, with the process behind every connection. Nothing is blocked and nothing is changed.
day 7
03
Read the answer
The map shows what those hosts reach. The preview shows what least privilege would close. The gap between the two is your blast radius.
Day 1 · Learning
Day 30 · Protected
An example estate. Your own answer comes from the first week of the trial.
What you'll learn
Usually three uncomfortable things.
We have never run this on an unsegmented network and found nothing.
A path you didn't know existed
Something reaches the domain controller, the backup server or the database that has no business doing so — usually a management tool nobody remembered installing.
A dependency nobody documented
The flow that would have broken production if you had ever got as far as writing firewall rules by hand.
How wide "internal" actually is
The number of hosts a single foothold can talk to is almost always larger than the guess people make before measuring it.
And one reassuring thing
A concrete, ordered list of what to close first — rather than a segmentation project with no obvious starting point.
Questions
Before you install anything.
The reasonable objections to putting an agent on a production server.
What does it cost?
Nothing. It fits inside the 30-day trial. If you stop there, you never pay us anything.
What data leaves my network?
Connection metadata — addresses, ports, protocol, the owning process and container, and counts. No packet contents. The full detail is on the trust page.
Can I get this as a document?
Yes. Reports → Evidence pack exports one PDF, or one CSV per section: protection per host and workload, your critical systems and what can reach them, every published rule, and every approval in the period. It's generated from the console, so it shows what's enforced today, not a consultant's summary.
What if I don't want to buy anything afterwards?
Then don't. You keep the answer, and you can write the firewall rules yourself with a much better idea of what they should say. Or use the rest of the trial to protect what you found, and run the same question again on day 30.
Find out this week.
Twenty minutes to install, seven days of watching, and an answer — with three weeks of trial left to act on it.