CUI obligations, assessment regimes with teeth, and environments where a vendor's cloud is not an option.
Two things make federal and defense work different. The information has handling rules attached to it by law, and the infrastructure often cannot reach the internet at all.
CAVER classifies CUI against the NARA Registry categories, maps control by control to NIST SP 800-171, requires its own storage to be encrypted, and runs fully air-gapped with offline license activation and offline evidence verification.
It also states plainly what it is not. We support FIPS 140-3 mode; we do not hold a CMVP validation certificate, because a certificate is issued to a cryptographic module rather than to a product that uses one. That sentence is in here because it is asked in every assessment and a vague answer reads as a yes.
The obligations are specific, checkable, and increasingly evidenced rather than attested.
CAVER charges a flat fee per deployment. There is no charge per gigabyte.
That is a pricing decision, but it only works because of how the system is built. On a storage lake, what a search costs depends on how many files it opens, not how many bytes you have kept. CAVER continuously merges small files into fewer, larger, sorted ones.
On a real production system running about 100GB a day, that change did two things:
Older data moves to a sealed tier that is simply a folder. Months outside your search window are never opened at all. There is no separate index to rebuild before a search or an alert can reach that folder: detections and dashboards query it directly, measured at 172 milliseconds for an alert and 76 milliseconds for a dashboard panel over a million events.
What this means for you: "how far back can I search" becomes a storage question, not a performance question. You stop choosing between logging everything inside the boundary and staying inside budget.
CUI is different from other sensitive data in one important way: it is supposed to be marked.
So the strongest signal is the marking itself. CAVER reads banner and portion markings, resolves the category against the NARA Registry, and attaches the law that controls it. CUI Specified is distinguished from CUI Basic, because Specified carries handling requirements from the underlying law that override the Basic defaults.
Marking failures are the most common finding in a real assessment, far more common than storage failures. So content detection runs regardless, and a match with no marking is its own finding: this looks like CUI and nobody marked it.
NOFORN on a file sitting in a system foreign nationals can reach is a violation even when the storage, the access control and the transport are all correct. No amount of encryption fixes it, so CAVER reports the control alongside the finding.
The practical value is the second list rather than the first. Anybody can search for the string CUI. The finding that changes a program is the document that carries every characteristic of controlled information and no marking at all, sitting in a share that was never scoped for it, because that is the one an assessor finds first and the one an incident turns into a reportable event.
It does not determine that a document is CUI. That authority belongs to the originating agency and to the contract. CAVER finds what is marked, what looks like it should be, and where both are sitting, which is the input to that decision rather than a substitute for it. A tool that claimed the determination would be wrong about the law and would put the program rather than the vendor at risk when it was.
Control by control, cited against Rev. 2, because that is what DFARS 252.204-7012 and CMMC Level 2 are written against and what your assessor has open. Rev. 3 identifiers are carried alongside where a control was renumbered.
| Control | Requirement | CAVER |
|---|---|---|
| 3.3.1 | Create and retain audit logs | Covered: the platform exists for this |
| 3.3.2 | Trace actions to individual users | Covered |
| 3.3.5 | Correlate audit review and reporting | Covered |
| 3.3.8 | Protect audit information from modification | Covered: append-only custody, encrypted storage |
| 3.13.16 | Protect confidentiality of CUI at rest | Partly: required on our storage, refused if absent. We do not encrypt your other systems |
| 3.4.1 | Baseline configurations and inventories | Partly: generated from observed traffic, which cannot see a system that has never communicated |
| 3.5.3 | Multifactor authentication | Not covered: we evidence it, we do not issue it |
| 3.13.11 | FIPS-validated cryptography | Not covered: see below |
| 3.10.1 | Physical access control | Not covered: a physical safeguard |
The uncovered rows are printed on purpose. The standard has 110 requirements and CAVER addresses the subset a data platform touches; the rest are organizational, physical and network controls that no logging tool provides. A mapping of only the flattering controls cannot be used to plan, which is the only reason you want one.
The compliance report also assesses against NIST SP 800-53 r5, NIST SP 800-82, NIST CSF 2.0, the CISA Cross-Sector Performance Goals, CISA BOD 26-04, NERC CIP, IEC 62443, the USCG maritime cyber rule and the NCSC OT secure-connectivity guidance. Where a control cannot be evidenced from data, the report says unevidenced rather than passing it. CUI markings and the 800-171 mapping export as evidence.
Access control and audit answer 3.1 and 3.3.2 directly. Roles are capability-gated, a read-side index ACL is enforced as a row-level predicate, every search is audited with the scope that was applied, and refused requests leave audit rows too. Sensitive searches can be audited in hash mode.
CMMC Phase II, the third-party certification rollout, is suspended pending review. Phase I remains in force: a defense contractor must still complete a NIST SP 800-171 self-assessment and post a senior-official affirmation to SPRS. The self-assessment is the live requirement.
We scored ourselves first. RedEye holds its own house to NIST SP 800-171 Level 2 and self-assesses at 109 of 110, indicative, with all controls documented against real evidence, a written policy set, a tested incident response plan and continuous monitoring. The single open item applies only once we hold a specific type of federal data; it is a build-on-contract item rather than a gap. Our workforce is U.S. persons only, which is what makes ITAR and export-controlled work possible at all.
The full posture is published at threat-intelligence.redeyesecurity.com/cmmc. Regulatory status moves, so confirm the current phase before relying on any of it in a proposal.
CAVER supports FIPS 140-3 mode, routing cryptography through the Go Cryptographic Module, and checks at startup that your storage configuration can run under it. CAVER does not hold a CMVP validation certificate. A certificate is issued to a module, not to a product that uses one, so confirm the module's certificate status for the version you deploy. Note also that CMMC certifies an organization and never a product: no tool can be "CMMC certified".
In August 2026 CISA published a Logging Reference Architecture implementing OMB memorandum M-26-14. It is not a list of sources to collect. It asks whether a logging capability can be shown to still be working, and it names the failure modes that make a healthy-looking estate useless.
| CISA asks for | CAVER |
|---|---|
| 4.7 Detect coverage gaps and delivery failures even when systems appear to be functioning | A source that goes quiet is a finding, not a quiet week. Agents heartbeat on the channel they ship on, and the coverage screens report last-seen time per source rather than a count. |
| 6.2.5 Endpoint records with process context rich enough for lateral-movement analysis and timeline reconstruction | Process lineage is part of the event contract, from Sysmon and from Carbide, so a chain joins across event types. |
| 7.1, 7.2 Durable normalization, with source-native context preserved | The raw event is kept and the normalized class is a layer over it, applied on the way in. Every event names the normalizer and version that produced its view. |
| 8.2 Integrity at collection, in transport, in storage and during access | The Evidence Locker: hashed on arrival, an append-only transparency ledger, signed export, verifiable offline by someone who does not trust us. |
| 4.5 Separate actively searchable data from lower-cost retrievable tiers, and decide how long each stays searchable | Set per index, and re-measured in the product. 48:1 compression (raw log volume against what the lake stores) is what decides whether the answer is a year or ninety days. |
The full mapping, in CISA's numbering, is at getcaver.com/cisa-logging. The most useful version of the conversation is section by section against your estate, including the parts where the answer is that you have work to do.
It is a reading of a public document against a product, done by the product's vendor. It is not an endorsement, a certification or a relationship with CISA, and nothing here should be read as one.
OMB issued Memorandum M-26-14 on May 22, 2026, replacing M-21-31 and giving federal agencies one standard for two things: Continuous Event Monitoring, catching what is happening now, and Threat Hunting, Investigation, Response and Forensics, reconstructing what already happened. The memo sets eleven baseline logging activities and five maturity elements graded Level 0 through Level 4, and CISA's Logging Reference Architecture, published August 20, 2026, turns that grading into an architecture with its own milestone schedule.
The compliance report gains two frameworks built for this memo specifically: m-26-14, the eleven Appendix B activities and five Appendix C maturity elements, and cisa-lra, the architecture sections the memo's own reference implementation asks for. They are keyed on the same section numbers the public getcaver.com/cisa-logging mapping uses, so the report an assessor reads and the page a prospect reads describe the same thing twice, not two different countings of it.
Appendix C's two computable elements, Inventory Visibility and Collection Coverage, are graded per system: Level 0 under 70%, Level 1 at 70 to 79%, Level 2 at 80 to 89%, Level 3 at 90 to 94%, Level 4 at 95% and up. A system's overall level is the lower of its two scores, not the average, because a system with perfect source coverage on half its fleet is not covering the other half. The agency-wide composite follows the same rule across every system: one system stuck at Level 0 holds the whole agency at Level 0, which is Appendix C's own reading of maturity as a floor rather than a mean.
Collection Operations, Data Retention and Log Management are attested by an operator, because no product can observe them on its own: who claimed what level, on what evidence, and until when. Two of the three print a computed reading beside the claim so it can be cross-checked: Collection Operations shows the percentage of a system's hosts with a live agent heartbeat, and Data Retention shows the level the configured storage window actually supports. A lapsed or missing attestation stops counting toward the level the moment it lapses.
The LRA's publication date drives four milestones: 2026-11-18, 2026-12-18, 2027-02-16 and 2027-07-06. Every plan item an agency enters is graded on track, at risk or lapsed against its milestone, rolled up per milestone and agency-wide, with an alert the moment an item is at risk or has lapsed.
The posture page answers what a compliance officer opens the tool to find out: will we make it, a composite level with a trajectory against the last reading; what needs me now, a single ranked list of lapsed and at-risk attestations, lapsed and at-risk plan items, regressed systems and silent hosts; and what is next, the nearest mandate milestone and what it requires. A fourth reading, THIRF readiness, shows measured time-to-contain and how many evidence bundles have been verified, so forensic readiness is a number rather than an assumption.
Appendix C's Data Retention band reads a deployment's configured storage window against two floors the memo sets, six months for Level 1 and twelve months for Level 2. Because CAVER's storage compression is measured, clearing either floor on your own storage is a budget line, not a tradeoff against how far back you can look. The pitch, plainly: other tools attest retention. CAVER measures it, because the storage tiers are CAVER's own to read. Other tools attest that operations ran. CAVER's agents write down every run, whether or not they found anything.
Inventory Visibility counts hosts CAVER observes sending telemetry, not the percentage of a centralized HWAM/SWAM inventory the element technically grades; reconcile the two rather than read one for the other. This is not legal advice on whether a specific agency meets the memo, and not a CISA or OMB endorsement.
The reason teams turn detections off is not that the detections are wrong. It is that nobody is left to work the output.
Roughly a third of alerts are never investigated, an investigation takes over an hour, and an analyst closes twenty to thirty in a shift. A three-digit queue does not fit inside a staffed team by arithmetic. So CAVER ships named workers rather than more alerts: each one holds a single job, runs it on its own beat, and reports what it found.
An agent that speaks only when it finds something is indistinguishable from one that is broken, and the second is far more common than anyone admits. Every run is written down whether or not it found anything, carrying what it checked and over what window. A quiet morning becomes evidence rather than an absence of evidence.
Twenty of the thirty-six are rules, joins and thresholds: the same data gives the same answer on any day, and it can be explained to an auditor as a query. The other sixteen are baselines, peer groups and rarity, which is still arithmetic over your own history. Five can use a language model to write their summary in prose; turn it off and you lose the wording, not the finding.
The roster runs entirely on your own hardware and history. Nothing in it calls out to a model provider, which is why it works in an isolated environment at all.
Every agent ships disabled, and you enable them one at a time from the product. That is deliberate. It also means the workforce can be assessed rather than taken on faith. An agent is a named thing with one job, a declared scope of what it may read that is enforced rather than merely documented, a named reviewer, and a run history an assessor can read. That is a control an assessor can evaluate, which is not true of a prompt.
The workforce, the roster and the controls are shipped and in the product. The connections that feed individual agents land per data source, so an agent whose source is not connected yet says exactly that and names what it needs, rather than reporting a confident nothing. Ask us which of the thirty-six are live against your feeds before you count on any one of them.
Most estates buy endpoint telemetry from somewhere, and CAVER reads what you already run: CrowdStrike, Defender, SentinelOne, Sysmon, syslog and the forwarders on your servers. For the hosts where the options are bad, CAVER ships its own agent, Carbide, at no extra charge.
Sysmon process, network, file, registry, module-load, DNS and memory events all arrive as OCSF with the parent and child identifiers carried in the event, so a chain of executions joins across hosts rather than only inside one log line. A coverage screen shows which Event IDs are arriving now, which were seen in the last week and not in the last day, and which hosts are reporting. Every freshness figure is the time of the last event, never a count, because a count is satisfied by history: a source that died last week still has a large one.
| Same host, same workload | Kernel capture | Polling |
|---|---|---|
| 300 short-lived processes in a loop | 300 captured | 0 captured |
That row is why the agent exists. A process that starts and exits between two polls is most of what execution telemetry is for, and a poller cannot see it.
Carbide ships for Linux, Windows and macOS, installed as a system service. AIX coverage is available to design partners. Where you already run CrowdStrike, Defender or SentinelOne, Carbide sits beside it or CAVER reads that instead. Sysmon process, network, file, registry, module-load, DNS and memory events are all normalized to OCSF and addressed by the same detection content.
Beyond watching, the platform acts, proves and updates without a vendor connection.
A vulnerability list ranked by severity score tells you what could be exploited. Two public feeds tell you what is.
CAVER ingests CISA's Known Exploited Vulnerabilities catalog, about 1,200 CVEs with confirmed exploitation, and FIRST's EPSS scores, an exploitation probability for roughly 200,000 CVEs, every day, and joins both onto your findings by CVE. The vulnerability screen gains an exploited-in-the-wild filter and a sortable probability column.
The effect on a real board is the difference between "4,000 findings" and "these eleven are being exploited right now, start here".
In 2026 CISA published an advisory in which two organizations faced the same red team with the same tradecraft and both fell to full domain compromise. One isolated three phished workstations in 10, 2 and 20 minutes and cut the command channel. The other actioned zero alerts. The difference was not the tooling and not the detection content; it was how fast a person acted on what the tooling already knew.
So CAVER measures that interval, per incident, from the case record:
We publish compression and query speed as first-class numbers because they are how CAVER beats a per-gigabyte platform. Time to contain is the number that decides whether any of that mattered, and it is on the same screen.
Detection, the case and the response action live in one product. There is no second orchestration platform to license, deploy or keep in sync.
Playbooks trigger off the same findings the detection engine produces. A playbook runs when a finding or an incident is created, when a case field changes, on a schedule, or by hand. It branches on conditions, it can be built on a visual canvas or in a form editor, and every definition is versioned with its history kept.
An incident carries its severity, owner, linked findings and indicators, tasks, a traffic-light handling marking and an append-only activity history. A per-severity service-level timer stamps a breach when a case runs past it, and that breach can itself trigger a playbook. A case can be sent to Jira, ServiceNow, Slack, Microsoft Teams or email from where the analyst is working, and its evidence can be exported and deposited in the Evidence Locker described under "Evidence that holds up".
Our internal parity audit, dated July 12, 2026 against CAVER version 0.4.3, scored 24 capabilities of the Splunk SOAR feature set. Weighted coverage, counting partial support as half, was about 48 percent; 33 percent was fully covered. The engine, triggers, branching, approvals, credential vault, case management and audit trail were covered. The gaps it named were a visual playbook canvas, scheduled triggers, loops, custom code blocks, a broad connector marketplace, a step-through debugger, multi-tenant separation and automation reporting.
Since that audit, the visual canvas, scheduled triggers, per-severity service-level timers, automation reporting and screens for run history, approvals and credentials have shipped, along with Jira, ServiceNow and chat connectors, on-call routing, ChatOps with per-user roles, and Carbide response actions. Loops and custom code blocks are delivered on request. The figure above is the July baseline, not today's, and we re-score the audit for an evaluator on request.
The parity audit this section cites scores each capability against the source that implements it, file by file. We share it with an evaluator on request, together with source access to check it.
Rural control sites run on radio. A pump station reports back to the plant over an unlicensed 900 MHz SCADA radio, and that link sits before the firewall, before the VPN, outside every network segment, and off the internet entirely. Every control a site bought protects the wire. The radio is not on the wire.
So the softest way into a control process is often the one no security tool watches. Someone parks near the fence line with the same $25 receiver a hobbyist uses, listens to the traffic, and on most rural links reads it in the clear, because the radios were installed to move telemetry, not to keep a secret. Replaying or injecting a frame from there steps around the firewall, the VPN and the segmentation at once, and no exposure scanner will ever index a link that was never on the internet.
A software-defined radio the size of a thumb drive, plugged into the Windows machine already sitting at the site, listens to the band and learns its normal picture: which radios are present, on which frequencies, at what strength, hopping in what pattern. From that learned baseline it reports the departures rather than a wall of raw signal:
Watching a whole band around the clock sounds expensive to keep. It is not. The spectrum picture, the learned baseline and the departures together come to a few megabytes a day per site, because CAVER stores a compact snapshot and the events instead of a raw firehose. A site holds years of its own radio history and queries it the way it queries everything else, on storage it already owns.
And it lands where the plant already lives. A radio becomes an asset next to the controller it talks to, a departure becomes a detection on the same triage board as the wired alerts, and the link's health sits beside the process it carries. No platform that pairs a radio sensor to its own data store has drawn that picture, because no incumbent owns both halves.
The Caver RF add-on runs this sensor continuously and streams to your deployment. Sweeps, learned baselines and departures land as OCSF events beside the wired traffic. Sub-GHz SCADA radio profiles are configured per site and are available to design partners. The limit that never moves: the sensor only listens, it never transmits. Where a link is encrypted, reading it needs your own radio key, which on your own site you already hold. Everything else is receive-only by design, which is what keeps an RF capability on the defensive side of the line.
Most facilities run their physical security, badge access, door contacts, cameras, entirely apart from the cyber side. Caver takes the events those systems emit, not the raw video, into the same store as the network and identity record.
That is where the cross-silo detections live: a badge at a restricted door while that account is logged in elsewhere, a tailgate followed by a login from inside the room, a terminated worker whose badge and account are both used after the end date.
Events and counts only, never the raw video, and never a face. Anything that identifies or tracks a specific person is off by default and governed, an explicit and audited choice, so the capability stays on the defensive side of the line.
Real measurements from a production system handling about 100GB per day.
| Search | Time |
|---|---|
| Empty hour | 6 ms |
| One hour of data | 38 ms |
| 24 hours of data | 453 ms |
| 48 hours across two data centers | 627 ms |
Published figures show searches under 50 ms at the 95th percentile. The counterpart matters just as much: a 120-second ceiling still applies to large summarized searches, and searches over recent data under load run around 1.1 to 1.2 seconds. We are working on that ceiling. Both numbers are published because a best case is not a guarantee.
Ask any vendor, including us, for the range across your own data types during a trial. Not just one blended figure.
| Area | Typical SIEM | CAVER |
|---|---|---|
| Pricing | Per gigabyte; retention becomes a budget lever | Flat per deployment |
| Data ownership | Often vendor-hosted, proprietary format | Your storage, your keys, open format |
| Archived data access | A restore or rehydration job, often billed per query | Queried directly from your own bucket, no restore step |
| Encryption at rest | Assumed, rarely verified | Checked before start; refuses to run on storage it cannot confirm |
| CUI classification | Generic DLP patterns if any | NARA Registry categories with cited authority, marked and unmarked |
| 800-171 mapping | A spreadsheet somebody maintains | Control by control, Rev. 2 and Rev. 3 |
| Logging architecture | Graded after the fact | Mapped to the CISA LRA, section by section |
| Air-gapped operation | Often unsupported | Supported today, including offline licensing and verification |
| Your existing detection content | A rewrite, or left behind | Sigma, Splunk, Elastic, Sentinel, QRadar and Defender rules convert in, with a report on what did not |
| Evidence handling | Export logs; chain of custody is manual | Cryptographic custody, verifiable offline |
| Compliance reporting | Usually a separate product | More than 20 frameworks built in, signed export |
| Where it runs | Many are cloud only | Cloud, on-premise, air-gapped, single box |
An established SIEM has real advantages we will not pretend away:
Those are genuine switching costs. Our answer is the parallel-run and collector-only options above, which let you measure the difference instead of taking it on faith.
For the moment an incident becomes a legal, regulatory or contractual matter.
At that point someone outside your security team needs to trust the record without trusting your vendor. The Evidence Locker is built for that:
What this means for you: a record an assessor or investigator can verify without ever touching your infrastructure.
The AES-256 password protects the contents of the archive. The list of file names and their sizes is still readable without the password, which is how the ZIP format works. If a file name would itself reveal something, rename it before export.
One product, not a different tool for every environment.
CAVER runs on Kubernetes, a virtual machine, an isolated network, or a single box. License activation does not need an internet connection, and a lapsed license gives you a 14-day grace period rather than shutting off mid-incident.
This is your risk decision. Both are real products. Neither is a discouraged version of the other.
SAML 2.0 and OpenID Connect are both configured in the product: paste or fetch your identity provider's SAML metadata, or point at your OIDC issuer for discovery, then map the attributes or claims to roles. Test against the live provider before you can turn it on: enable is refused without a successful test in the last 24 hours. A saved change or a disable takes effect on the next request, no restart, and local login stays reachable so an identity-provider outage cannot lock your operators out. An OIDC client secret is sealed in the product's credential vault, never stored in the clear.
SCIM provisioning is configured the same way: an operator mints a bearer token for the identity provider, shown once and stored only as a hash, revoked on the very next request rather than the next restart. Group membership from SAML, OIDC, or SCIM maps to roles by the same rule.
Everything here works with no outbound connectivity.
| Category | How it reaches CAVER | Status |
|---|---|---|
| Federal and enterprise IT | Standard audit trails and endpoint telemetry | More than 400 vendor packs |
| Facility and industrial systems | More than a dozen protocols decoded passively | Included |
| Badge and physical access | Genetec Security Center, C-CURE 9000 and Lenel OnGuard, with antipassback and physical-logical impossible travel | Included |
| Scanners and vulnerability data | Ingested, correlated with behavior | Supported |
| Classified-adjacent enclaves | Fully air-gapped, offline licensing | Supported today |
More than 400 ready-made vendor packs ship for the common systems, so the bespoke work is the exception rather than the starting point.
A trial is 60 days, $25K to $75K, credited fully toward your first year if you proceed. If you are replacing Splunk, a displacement credit of 25% to 50% off year one is available separately.
Do not take this paper on faith. Test it directly: