Deployment & stack fit
Protecting your network before the afternoon standup.
Nodal CyberBrain deploys passively on a mirror port in under an hour and starts recognising campaign activity immediately. No re-architecting. No disruption to deploy the thing that prevents disruption.
Stack fit
Keep everything you've built.
You chose your stack for good reasons. Nodal CyberBrain works with it rather than around it: it takes in what your tools already see, connects it to the attack path on the network, and acts through the controls you already own. Nothing gets ripped out or replaced.
- 01
Ingest signals from your tools
Endpoint telemetry and security events from the tools you run join the network evidence in one correlation.
- 02
Connect them, then dig deeper
An alert from another tool is placed on the attack path it belongs to, and triggers a deeper investigation when it lands on one.
- 03
Block C2, contain devices
External command-and-control hosts are blocked at your firewall, and compromised devices contained through your EDR.
- Arctic Wolf
Complements the stack you already run — replaces nothing
01
What do you finally get full value from?
Not 'what do you turn off' — nothing. Nodal CyberBrain complements your firewalls, endpoint protection, and MSSP or MDR monitoring, and fills the east-west visibility gap between them. Your firewall becomes the enforcement point. Your MSSP contract finally sees campaigns. The stack you've already paid for gets smarter.
02
It talks to what you own.
Tickets push via API to your SIEM and post-threat tooling. Disruption actions can enforce through your existing firewall. Your MSSP or MDR keeps its role — with campaign intelligence it didn't have yesterday.
For security architects
Sensors observe east-west traffic from a mirror or SPAN port. Nothing sits inline, no agents are installed on endpoints, and neither routing nor segmentation changes. Correlation runs on coordination and timing patterns between devices rather than on signatures or a learned baseline, which is why there is no observation window before the system is useful.
Straight answers
The four questions everyone asks.
- Do we need to install agents?
- No — deployment is passive, from a mirror port. Nothing touches your endpoints.
- Is there a learning or baselining period?
- No. Nodal's custom-built AI recognises adversary campaign patterns from the moment it's deployed — no learning window against your environment, effective from the first hour, including in networks that are already compromised.
- Will deployment interrupt anything?
- No. Passive means passive: no inline devices, no routing changes, no downtime.
- What does it replace?
- Nothing. It's built to complement the stack you already own.
- Passive deployment on a mirror port, in under an hour
- Works with the stack you own and replaces none of it
- Advised by former US defense, intelligence and industry security leaders
First time here?What we mean by a campaign
A campaign is a coordinated, multi-stage adversary operation conducted across devices over time — reconnaissance, lateral movement, staging, and command-and-control working together toward an objective. Your existing tools report the isolated events. The campaign is what those events add up to — and it's what most stacks never see.
Explore the rest of the Nodal platform.
See it work
Bring your network diagram — we'll show you where it fits.
Thirty minutes with a Nodal engineer, your topology on the screen, and a straight answer about the mirror port, the API, and the constraints you're working under.