A security platform that never leaves the building.

One console for the entire estate.

The single place your team works. Every Mirrored Maple product, every customer, every site and device: one sign-in, one hierarchy, one audit trail.

• Organization → site → device hierarchy with zero-touch adoption
• MSP clients managed with the customer’s consent on record, audited on both sides
• Every state change written to a tamper-evident audit chain
• Presents capabilities; never owns the engines behind them

The intelligence layer that shows its working.

Correlation, entity resolution, risk and incidents across every product at once, not one tool’s narrow view.

• A finding cannot exist without the events that produced it, enforced in the type system
• Risk is a transparent 0–100 with every contribution visible, never an opaque number
• Every event explained in plain words, each sentence tied to the fields it came from
• Deterministic detection first; AI only adds, never decides alone, and runs on our hardware

Passwords and secrets nobody else can read.

A password manager encrypted on your devices before anything reaches us. It starts with a personal vault: logins, secure notes, one-time codes and AutoFill, in the browser and inside Canopy.

• Our servers hold ciphertext only; no Mirrored Maple key opens a vault
• A new device joins only with an approval from one you already trust
• Recovery is a kit you keep plus a code to your email, not a support ticket
• Sharing and business vaults come after the first release

The SIEM that ingests anything you point at it.

Centralized security monitoring built for estates nobody standardized. If a device emits a log, Sapwatch reads it, with no waiting on a vendor to write a connector.

• Reads RFC 5424, RFC 3164, CEF, LEEF, JSON and key=value
• Priced per connected source (each firewall, console or endpoint), never per gigabyte
• Alert tuning per customer, in the product, with every change kept in history
• Identifiers pseudonymized at ingest, so erasure never breaks the audit trail

The endpoint agent that is also the site collector.

One small agent for Windows, macOS and Linux that sends endpoint events to Sapwatch, and on one machine per site listens for the firewall’s and switches’ logs too, so no site needs an appliance.

• Every request signed by the device’s own key; nothing shared between devices
• What it can collect is compiled in: a policy names a catalogue entry, never a query or a path
• Syslog over UDP, TCP and TLS, and SNMPv3 read-only, from local senders only
• Updates signed by a release key that never touches a server

The analyst’s workspace.

Queues, triage, cases, evidence and shift handoff built around Sapwatch: the operational layer an MSSP actually runs on.

• Case management with evidence attached
• Shift handoff and SLA tracking
• Built for multi-customer operations

Response that asks before it acts.

Visual playbooks with human approval gates, dry-run mode and complete action auditing. Automation you can let near production.

• Approval gates on every destructive action
• Dry run before anything executes
• Rollback and compensating actions

Hypothesis-driven threat hunting.

Cross-source hunting with Sigma and YARA, ATT&CK mapping, and a straight path from a hunt that found something to a detection that catches it next time.

• Sigma and YARA support
• MITRE ATT&CK mapping
• Hunt-to-detection conversion

Threat intelligence with source confidence.

Indicator management, actor and campaign tracking, STIX/TAXII feeds and internal sightings: intelligence that ages honestly instead of accumulating forever.

• Indicator ageing and expiry
• STIX/TAXII
• Per-tenant intelligence

Network threat detection and prevention.

Shared IDS/IPS capability across the estate, feeding the same detection engine everything else uses.

• Shared detection engine
• Inline and passive modes

Continuous offensive assessment.

Continuous, authorized assessment of your own estate: the attacker’s view, on a schedule, with findings that land in Sapwatch beside the detections.

• Authorized and scoped by design
• Findings land in the same pipeline as detections

Know what is actually on the network.

Discovery, inventory and secure management for the network itself. MapleMesh records what it observed, then resolves it into one record per real device.

• Bounded discovery: no policy means nothing is scanned
• Weighted identity resolution; a shared address never merges two devices
• Honest classification: “unknown” when it does not know
• Collectors enroll with least-privilege capability sets

Asset discovery and exposure.

External and internal discovery of what you actually expose, before someone else maps it for you.

• External attack-surface mapping
• Continuous rediscovery

Purpose-built hardware.

Appliances designed for the platform rather than adapted to it: secure boot, measured boot and remote attestation from the factory.

• Secure and measured boot
• Hardware root of trust

Who, where, and under what conditions.

Principals, roles, scoped grants and explainable decisions. Every denial explains itself, because a bare “access denied” is a support ticket someone has to reproduce.

• Single sign-on with Microsoft Entra ID
• Multi-factor that is verified, never merely claimed
• Just-in-time elevation with expiry and conditions
• Approval gates: holding a permission is necessary, not sufficient

A certificate that carries its tenant.

Device and service identity for the whole estate. One issuing authority per customer, so a stolen signing key is one customer’s incident rather than everyone’s.

• One issuing CA per tenant
• Short-lived certificates as the primary revocation path
• Unknown revocation status fails closed

Secrets that rotate without an outage.

Envelope-encrypted secret storage with leases for machines, break-glass for humans, and a rotation model that does not punish you for rotating.

• Machine leases instead of gates that get routed around
• Break-glass requires a quorum and a reason
• The previous version stays readable through a grace window

The pipeline between every producer and consumer.

Buffering, backpressure, sampling, delivery guarantees and data-quality checks, so products never have to know about each other.

• At-least-once delivery whose batch id survives a retry
• Sampling that cannot silently break threshold detections
• Notices a source that has gone quiet

The protocol that reaches devices you cannot dial.

Mutually authenticated, long-lived device sessions. Commands expire on the platform’s clock, because “reboot now” six hours late is not the same instruction.

• Mutual authentication with MaplePKI certificates
• Per-class command expiry
• Platform-time deadlines, not device-time

The shared core everything imports.

One normalized event, one severity scale, one tenancy model, one audit chain. The reason products built years apart still agree on what a device is.

• One 0–4 severity scale; vendor scales convert on the way in
• Raw input preserved: normalization never destroys the original
• Tamper-evident audit chains