Threaded through what you already govern.
NEBU works across your clouds, clusters and data centres from inside your boundary. It reads what a fix needs and changes only what an approver, or a policy you agreed, has cleared.
Book a callThree layers, one fabric.
Each layer has one job: decide, act or remember. Four controls are threaded through all three.
-
01 Supervision
People and policy decide. Nothing else does.
A consequential change waits for a named approver. Anything else must fit a policy you agreed, and NEBU never approves its own work.
- Checks every proposed action against policy
- Routes consequential changes to the right approver
- Works with your identity provider
- Ties each change to your change record
-
02 Orchestration
A plan first, then agents built for each step.
Each finding becomes a plan, and a specialized agent carries out each step. No agent can approve.
- Runs each fix step by step, as planned
- Acts through the tooling your teams already use
- Issues a short-lived credential per step, then revokes it
- Stages a way back before anything moves
-
03 Knowledge
It remembers what your team confirms.
Validated context is built from your own decisions, never shipped pre-loaded, and it compounds with every fix.
- Keeps a model of your estate and your decisions
- Brings the right context to each plan
- Shields names and secrets before a model reads them
- Runs inference on a private endpoint in your boundary
-
04 Across every layer
Four controls run through all three.
They hold in every layer at once, so no part of NEBU works outside them.
- Zero trust: every request proves who it is and what it may do
- Evidence: every action is signed and reaches your SIEM
- Data custody: everything runs and stays inside your boundary
- Observability: metrics, logs and traces flow to your monitoring
What your architects will ask.
Deployment
Inside your own environment: in your cloud accounts, on-premises or in a private cloud, and in air-gapped sites, which update from signed offline bundles.
Access
Your team decides. NEBU staff start with no access, and any access you grant is time-boxed and recorded.
Failure
NEBU sits outside the request path of your workloads. If it stops, your infrastructure keeps running and pending fixes wait. A compromised part can act only within the one action it was cleared for.
Can our architects go deeper?
Yes, with your environment in mind.
We take your architects and security team through how each layer would run in your estate, and answer the questions your security review asks.
Questions
Which platforms does NEBU work with?
Cloud, hybrid, multicloud and on-premises estates, virtualized and air-gapped sites included, through connectors for each platform and the tools around it.
What does a connector need from us?
An identity with the read scopes the connector lists, and write scopes granted one step at a time, issued through your own identity and access tools, so your team can review or revoke them at any time.
See where your own estate stands.
A posture assessment is a read-only review of your environment, scoped with your team, with a written report.
See how it would sit in your estate.
On a call, we map your environments to the connectors and show what each one would read and change.