What each function does · Sentinelleai docs

Every function each plan covers, defined in one line. A plan sells only what is marked in place; anything still in observation is listed here and never billed as delivered. No amounts on this page — those are on the pricing page.

Read before relying on any result

Sentinelleai is an automated security monitoring platform. Nothing it produces is an audit, a penetration test, a compliance opinion, or a guarantee that a system is secure. "No findings" means the tools that ran found nothing, never that nothing is there; anything a tool could not check is reported as unknown, not as clean. For decisions that carry real money or real liability, engage qualified professionals and treat Sentinelleai's output as their starting material.

How to read this page

One section per plan, in the same order as the home page, each with the functions that plan advertises. Two tags appear against a function:

in place — the function runs today, and the plan that lists it sells it.
in observation — the function is built but not yet complete enough to be sold. It is shown here so the gap is visible, and it is never counted as delivered in a plan's price.

Each definition says what the function looks at and, where the answer is bounded, what it stops short of — a language it does not cover, an action it refuses, an answer it returns as unknown rather than guessing. Those limits are part of the definition on purpose. For amounts, see the pricing page, which repeats each plan below with its functions and its price.

Code & Software Supply Chain

Static analysis and taint tracking, dependencies, secrets, SBOM, provenance and install-hook behaviour on your repositories. 21 functions in place. Price of this plan · How this surface is scanned

Multi-language Rulesin place: Runs Semgrep with rule packs kept in sync with the official Semgrep registry, covering many programming languages.
OWASP Application Top 10in place: Flags OWASP Top 10 application weaknesses in source code, including injection, cross-site scripting, cross-site request forgery and unsafe deserialization.
OWASP API Top 10in place: Checks source code for OWASP API Top 10 weaknesses statically; it inspects code as written and performs no data-flow analysis.
OWASP LLM Top 10in place: Covers the OWASP Top 10 for large language model applications, limited to the categories that can be detected by inspecting code.
Framework Surfacein place: Maps the surface a Next.js project exposes, covering its routes, server actions and middleware.
Noise Managementin place: Manages scan noise through false-positive handling, suppressions and rules written in-house, so results stay reviewable.
Language Coveragein place: Renders the data-flow path, and not only the verdict, for the seven supported languages beyond JavaScript and TypeScript.
Inter-procedural Taint Analysisin place: Traces tainted data from sources to sinks across files using a real TypeScript syntax tree and recognises sanitizers; JavaScript and TypeScript only, neither path- nor alias-sensitive.
Binary Analysisin place: Reads ELF headers, symbols and strings to check hardening flags such as RELRO, NX, PIE, stack canaries and FORTIFY, plus risky imports and embedded credentials, never executing the binary.
Dependency Vulnerabilitiesin place: Matches declared dependencies against known vulnerabilities by version range and states the remedy: an exact version to pin, or that no fix is published.
Asset Inventoryin place: Builds a dependency inventory from npm, pnpm, yarn, Cargo, pip and Go lock files, and keeps it across scans rather than discarding it.
CI/CD Securityin place: Examines GitHub Actions workflows for risks such as mutable tag references and excessive job permissions.
Typosquattingin place: Compares package names against a typosquatting list and generates lookalike domain variants with dnstwist.
License Compliancein place: Identifies the licences of the project's dependencies so licence obligations and incompatibilities can be reviewed.
Container Imagesin place: Scans container images for known vulnerabilities in their installed packages using Trivy.
Malicious Packagesin place: Resolves a package's install hooks to the files they actually execute, follows the import graph and classifies the behaviour, raising severity only on combined signals.
Secrets & Keysin place: Detects secrets and tracks each one's lifecycle across five states: present in the current tree, rotated, removed but still in history, outside version control, or unknown.
SBOM Generationin place: Produces a CycloneDX 1.6 software bill of materials validated against the official schema, with per-ecosystem package URLs; SPDX output is not available yet.
Provenance & Signingin place: Verifies signing certificates hop by hop up to a Fulcio authority listed in Sigstore's trust root, judging every validity window at the signing instant attested by Rekor.
Reproducible Buildsin place: Rebuilds a package from the attested source repository and revision inside a Docker sandbox, then compares it against the published registry tarball by hash and file by file.
Vendor Riskin place: Lists third-party vendors only where a line of the scanned code names one, and checks each vendor's external TLS, headers, DNS, DMARC, SPF, DKIM and certificate transparency posture.

Application

Scanning of a running application you have proven you control: authenticated crawling, authorization tests, fuzzing, browser and API security. 9 functions in place. Price of this plan · How this surface is scanned

Web Vulnerability Scanningin place: Probes running web applications with Nuclei and its community template set for known vulnerabilities and exposures.
Liveness Verificationin place: Checks that each target endpoint actually responds before results are drawn from it, so a scan is not reported against a dead host.
Fuzzingin place: Fuzzes HTTP, GraphQL, WebSocket and gRPC services; properties requiring introspection are left unanswered, and without a schema definition gRPC message content is not fuzzed.
Application Crawlingin place: Crawls an authenticated application while holding session state, groups URLs by shape so identifier-bearing routes cannot exhaust the budget, and re-proves the session at a fixed cadence.
Authenticated DASTin place: Derives access-control test plans from observed journeys; a derived case needs a marker present for the owner and absent for the other identity, otherwise it stays disarmed.
Authorization Testingin place: Tests vertical privilege elevation and multi-tenant isolation using roles and tenants that are declared rather than inferred; an absence measured with a guessed identifier stays inconclusive.
Browser Securityin place: Routes DOM cross-site scripting through the same taint engine as server-side flaws, giving a numbered path, and checks prototype pollution, CDN dependencies and subresource integrity.
IAST / RASPin place: Instruments the running application to observe where attacker-controlled input lands across 24 sinks, grading findings strong or weak; blocking mode is disarmed by default and weak findings never block.
Mobile Securityin place: Reads APK and IPA packages, including Android binary XML and Apple binary property lists, and hands native libraries to the binary scanner; no decompilation and no DEX analysis.

Surface & Network

Ports, TLS, headers, DNS posture, exposure and certificates on your targets, and the intrusion-detection sensor you supply. 13 functions in place, 4 in observation. Price of this plan · How this surface is scanned

Service Discoveryin place: Uses nmap to discover which hosts are reachable and which ports and services they expose.
TLS Configurationin place: Inspects TLS endpoints for cipher suites, protocol versions, chain and expiry, reading the certificate even when the handshake would otherwise be rejected.
HTTP Headersin place: Reviews HTTP response headers, including content security policy, HSTS, cookie attributes and referrer policy.
DNS Posturein place: Applies 67 DNS rules covering delegation and dangling records, and judges DNSSEC against an explicit validating resolver rather than the local stub resolver.
External Exposurein place: Looks for externally exposed assets belonging to the organization and for its accounts appearing in known breaches.
Attack Surface Managementin place: Reconciles the known external surface on each scan and raises a webhook alert, with silence judged by staleness since host sweeps run at most once a week.
Certificates & PKIin place: Tracks certificates over time and compares each observation against the previous one, drawing on certificate transparency logs including certspotter; a source that failed removes nothing from the inventory.
Segmentation Validationin place: Proves segmentation by sending packets between Docker containers; cloud rule analysis and manifest declarations are reported as weaker, clearly separated tiers of evidence.
Network Intrusion Detection (IDS)in place: Reads Suricata alerts from the Emerging Threats Open ruleset with a per-file cursor that survives rotation; it detects and alerts on network traffic but blocks nothing inline.
NDRin place: Persists observed appearances from one sampling tick to the next, records when the sampler was awake, and measures rhythm with median absolute deviation rather than standard deviation.
Flow Analysisin place: Samples live connections from packet capture and connection tracking and flags sustained flows; eBPF and bpftrace are out of reach, leaving three of four sources in use.
DNS Filteringin place: Reads resolver query logs, preferring the lookup line emitted for every query including cache hits, falling back to the other form, and never adding the two together.
Zero Trust & Accessin place: Judges zero-trust posture from the code during a scan and persists its findings; a reference to a product is not counted as an access decision.
Wireless Securityin observation: Reads the wireless radios the system can see and scans on request, refusing to transmit frames or change radio state itself. An empty cache returns unknown rather than a verdict.
WAF / Inline Protectionin observation: Filters inbound requests inline at the proxy. Nothing on this surface reaches it as a hostile request today — the findings here are configuration weaknesses such as a weak content security policy, missing headers or open ports — so it stays in observation.
Anti-DDoS & Rate Limitingin observation: Judges request bursts volumetrically at the proxy in observation mode: every request is still served and none refused. Arming it is not currently possible, and the checks need ten active minutes of traffic.
Bot Defensein observation: Judges credential stuffing, scraping and signup fraud at the proxy in observation mode. Ordinary requests draw silence from the inline engines; hostile-shaped ones are judged and still allowed through.

Cloud & Containers

Read-only posture of a cloud account, container images, Kubernetes and infrastructure-as-code, with drift and effective permissions. 9 functions in place. Price of this plan · How this surface is scanned

IaC Scanningin place: Checks infrastructure-as-code for insecure settings across Terraform, CloudFormation, Kubernetes manifests and Docker Compose files.
Configuration Auditin place: Reads the real configuration files present in the scanned project, not only templates, and reports insecure settings.
Drift Detectionin place: Reports what has changed in configuration since the previous observation, so unexplained changes surface.
Container Hardeningin place: Checks a live Docker daemon and the Compose files under the scanned path; it covers neither Kubernetes nor ECS, and that limit travels with every result.
CSPMin place: Reads S3, EC2, IAM and CloudTrail settings read-only, and when no cloud credentials are available reports unknown with the reason instead of folding it into a clean result.
CIEMin place: Evaluates eighteen privilege-escalation paths in AWS, each requiring a conjunction of conditions, and declares the check skipped when no AWS identity is configured rather than reporting a clean account.
Kubernetes Securityin place: Queries a live Kubernetes API server over REST with mutual TLS or a token, without kubectl, to read effective RBAC, registered admission webhooks and running pods.
Container Runtimein place: Streams Docker runtime events into the telemetry pipeline, so actions such as a shell opened inside a container are observed live.
Hardening Benchmarksin place: Reports a ratio of how many hardening controls this pass could query alongside the failures; it is not a CIS benchmark evaluation, and unreadable controls name the privilege they need.

Host & Ransomware

File integrity, ransomware detection and decoys on each host. Containment of a process is a separate add-on, behind its own consent. 8 functions in place. Price of this plan · How this surface is scanned

File Integrityin place: Fingerprints the files it monitors and raises an alert when one of them is modified.
Host Monitoringin place: Evaluates the detection rule pack against the host telemetry feed every hour and records the alerts it produces.
Ransomware Detectionin place: Flags ransomware by calibrated combinations of file entropy, mass renaming and decoy files; backup-deletion detection is Linux-only, as its Windows equivalent is invisible to a file watcher.
EDRin place: Examines the process tree, injection signals and persistence when an incident opens; memory maps the host refuses to expose are reported as not examined, never as clean.
Malware Analysisin place: Scans with ClamAV using the EICAR test file as a positive control, and returns unknown with the database date when signatures are stale rather than asserting a clean result.
Backup Integrityin place: Opens declared archives and rates restorability on a five-rung ladder, naming ceilings: an uncompressed tar carries no checksum, and bundle verification can pass on corrupted data.
Patch Managementin place: Cross-references the installed host packages against synchronised CVE and KEV feeds each night, and explains a zero result rather than presenting it as clean.
Application Controlin place: Observes application-control posture such as AppArmor profiles and enforces nothing, allowing for the fact that an unprivileged caller cannot read the full profile set.

Identity & Data

Authority matrix, exposed credentials, sessions, OAuth, personal-data discovery and encryption posture. 11 functions in place, 3 in observation. Price of this plan · How this surface is scanned

Authority Matrixin place: Maps who holds authority over on-chain contracts, HTTP routes and cloud IAM permissions in one matrix; directory services are not covered.
Authentication Posturein place: Judges single sign-on, password policy, dormant accounts and application authentication, querying IAM Identity Center separately; service roles are explicitly out of scope for dormancy.
Session Securityin place: Judges session fixation, absolute and inactivity expiry, revocation and token theft by reading source code, returning unknown where reading alone cannot decide.
OAuth & Federationin place: Analyses OAuth connector source code without network calls, against four rules including excess scope compared with actual use and input-derived redirects, which are flagged but never proven open.
Personal Data Discoveryin place: Detects personal data in text and files, which is a distinct question from secret detection.
Encryption at Rest & Key Managementin place: Checks encryption at rest by reading the local database header and looking for a LUKS or dm-crypt layer across block devices and mounts, and whether any key manager is present.
Data Classificationin place: Classifies every table and column in the data store by the class it carries, such as credentials, identifiers, contacts and financial data, and which routes reach them.
Leak Preventionin place: Inventories the outbound destinations the code declares and compares them with observed egress samples, each flow attributed to the process that produced it.
Database Posturein place: Checks database file permissions including the write-ahead log, which holds recent rows in plaintext, confirms ignore status with version control itself, and reports queries escaping ORM parameterization.
Privacy Compliancein place: Resolves ten GDPR obligations at run time against the deployment's real artifacts rather than a static catalogue, and reports how many are actually substantiated.
Backup Governancein place: Checks where backups live and who can reach them, reporting when every copy resolves to a single device under one account with no off-host copy, and reading immutability attributes.
Compromised Credentialsin observation: Checks accounts and domains against an external breach database, treating a rejected key as unknown rather than as no leak. No authenticated call has been made yet, since no key is configured.
Privileged Accessin observation: Reuses the three-state permissions verdict and adds tenure, distinguishing permanent privilege from requested privilege. An expiring role assumption is not treated as just-in-time elevation, because the right to invoke it never expires.
Behavioral Analysisin observation: Parses console sign-in outcomes from cloud provider event records and escalates a failed sign-in, stating its fallback when no readable response exists. The verdict stays thin until more sign-in history accumulates.

Compliance & Governance

Control map for SOC 2 and ISO 27001, evidence over a declared period, risk register and remediation tracking. 8 functions in place. Price of this plan · How this surface is scanned

Policy as Codein place: Expresses policies as machine-checked rules covering actuator arming, service-level targets by severity and availability of required evidence, then resolves each rule against the live environment.
Audit Evidencein place: Exports the evidence chain on its own and recomputes each SHA-256 fingerprint from that export alone, propagating the calculated hash rather than the stored one.
Compliance Frameworksin place: Maps controls to frameworks such as SOC 2 Type II and separates the few controls whose evidence covers a period from the majority that remain point-in-time.
Risk Registerin place: Collects risks from the mechanisms that carry them, grades each by the rigor of the decision behind it, and flags those with no review date.
Remediation Trackingin place: Tracks each finding through its lifecycle with an owner and a due date, and marks a fix verified only after a fresh run re-reads the code.
Cyber Insurancein place: Answers an insurance underwriting questionnaire from the modules that measure each point, marking answers unsubstantiated rather than substituting a nearby control that does not match.
Coordinated Disclosurein place: Checks whether the target publishes a security.txt contact under RFC 9116, treating an expired file as a violation and an unreachable host as unknown.
Business Continuityin place: Records recovery point and recovery time objectives with an owner and a review date, then reconciles them against real archives and reports an untested objective as never exercised.

Operations & Response

Log collection and correlation, detection rules, threat hunting, incidents, forensics, playbooks and vulnerability feeds. 16 functions in place, 1 in observation. Price of this plan · How this surface is scanned

Automated Responsein place: Separates detection triggers from response actions and, on a real detection, issues a notification only, reporting the attempt honestly rather than claiming an effect.
Log Collection & Correlationin place: Correlates collected events across producers during each detection pass and reports how sparse the shared fields are instead of returning a silent zero.
Detection Rulesin place: Reports, for every detection rule, whether a producer capable of feeding it exists and whether it has ever fired, naming the missing producer for each blind rule.
Threat Huntingin place: Runs hunting hypotheses that return one of three outcomes: found, not found within a stated time horizon, or impossible to ask with the available data.
Incident Managementin place: Moves incidents through seven states, including stopped without explanation, and measures detection delay from the first event rather than from when the ticket opened.
Forensicsin place: Captures volatile host state such as processes, sockets, ARP entries, kernel modules, mounts and sessions in RFC 3227 order of volatility, recording the privilege ceiling reached.
Orchestration Playbooksin place: Runs playbooks limited to safe actions such as evidence capture, incident notes, tickets and approval requests, while a containment action stays declared only and is always refused.
Decoysin place: Plants URL canary tokens whose route answers byte-for-byte like a dead link, while AWS and DNS decoy forms are refused for lack of a trail and a nameserver.
Vulnerability Feedsin place: Reads vulnerability advisories from NVD and OSV.dev, including NVD product trees, so advisories can be matched to named products where the data provides them.
Web3 Incident Corpusin place: Draws on public Web3 incident records from DefiLlama, SlowMist, DefiHackLabs and Rekt for context on past on-chain attacks.
Public Audits & Contestsin place: Searches published audit and contest findings from Code4rena, Sherlock, Cantina, Solodit and Anza for issues already reported in comparable code.
Findings Prior Artin place: Looks up prior art for a finding across public advisories well beyond Web3, returning pointers to comparable reports rather than corroboration of the finding's severity.
Bug Bounty Program Watchin place: Monitors public bug bounty programs and their in-scope assets through the Immunefi API, announcing only later changes and returning unknown when a fetch fails.
New CVE Alertingin place: Watches new CVE publications on an ongoing basis and raises an alert when a newly published vulnerability matches the monitored scope.
Real-world Exploitabilityin place: Sequences CISA KEV, EPSS scores and a public exploit index to judge real-world exploitability, keeping unknown distinct from zero.
Indicators of Compromisein place: Holds indicator feeds of URLs, hashes, address ranges and domains from keyless public sources, and reports which indicator types are actually present before matching.
Underground Monitoringin observation: Monitors only public, lawfully accessible sources, accessing no criminal marketplace, authenticating nowhere and bypassing no access control. It stays partial, since closed-community coverage requires an analyst's human access this function does not provide.

Offensive Validation

Exploitation run rather than asserted, mutation testing, symbolic execution, exploit chains and validation of your own detections. 5 functions in place, 4 in observation. Price of this plan

Mutation Testingin place: Plants deliberate bugs in the code and measures whether the existing test suite actually catches them.
Symbolic Executionin place: Explores contract execution paths symbolically with Mythril to surface conditions that ordinary testing is unlikely to reach.
Vulnerability Reachabilityin place: Traces tainted input through to its sink so a reported issue comes with the concrete path that reaches it, including regular-expression denial-of-service cases.
Exploit Chainsin place: Combines separate medium-severity findings into a single chain when their preconditions connect, and declines to report a chain when they do not.
Pentest Reportin place: Produces an engagement-style report in which scope is a first-class section, naming what was not tested and listing every unknown capability as a limitation.
Proof by Exploitationin observation: Backs a finding with an exploit actually executed rather than asserted; three are verified by hand today, one of them against a third-party contract from the public SmartBugs corpus.
Attack Simulationin observation: Replays scenarios tied to named MITRE ATT&CK techniques through the same evaluation the detection pass uses, with a planted positive and a hardened twin. Two of eleven techniques have no matching rule, and the run stays in memory rather than the live event store.
Detection Validationin observation: Validates a customer's own detection rules, events and producer inventory using that customer's taxonomy exclusively, so a foreign rule name is never mistaken for a built-in one.
Adversarial Load Testingin observation: Measures sustained saturation, concurrency and volumetric behaviour against a disposable server the test itself starts and stops, reporting latency, rejection and per-payload cost.

Smart Contract Verification

Eight on-chain ecosystems, a multi-model panel with a judge, and on-chain proof on a fork of the target chain. Automated verification — not an audit, and it carries no assurance or guarantee. 10 functions in place. Price of this plan · How this surface is scanned

Solidity Static Analysisin place: Analyses Solidity source statically with Slither, Aderyn, Mythril and in-house rules, without executing the contract.
Multi-model Panelin place: Reviews the same code with several language models assigned distinct roles, then consolidates their output through a judging step.
Invariants & Propertiesin place: Fuzzes the contract against declared invariants and properties, guiding the search deeper to find inputs that break a stated rule.
Economic Securityin place: Models market behaviour and participant incentives to surface conditions where a protocol's economics, rather than its code, can be turned against it.
Fork Diffin place: Compares a forked contract against the audited original it was derived from and reports exactly what was changed.
Deployed Driftin place: Checks whether the bytecode actually deployed in production still matches the source that was reviewed.
On-chain Monitoringin place: Watches deployed contracts for administrative events, bytecode changes and shifts in the values returned by read-only functions.
Multi-ecosystemin place: Covers EVM chains plus seven non-EVM ecosystems — Solana, Tron, Starknet, Aptos and Sui, Cosmos-based chains and Near — each with pattern-matching analyzers and, where the compiled program is available, an adversarial on-chain campaign on a local fork or sandbox.
Source Verificationin place: Retrieves verified source from Etherscan V2, Routescan, Blockscout, Sourcify and Kaiascan across more than thirty-five EVM chains — plus Tronscan and Voyager for Tron and Starknet — following a proxy through to its implementation contract.
Cross-chain Securityin place: Reads bridge and messaging source for seven failure classes, including who can mint or release, replay protection and unverified payloads; it reads code rather than executing it.

Web3 Monitoring

Continuous watch of a deployed protocol: drift against the reviewed source, governance and upgradability, scam shapes and wallet approvals. 5 functions in place. Price of this plan · How this surface is scanned

Governance & Upgradabilityin place: Measures a timelock's delay and who can change it, reporting an admin-guarded delay change as a bypass and returning unknown rather than zero when the value cannot be read.
Scam Detectionin place: Flags honeypot, hidden blocklist, unbounded minting and rug-pull shapes as capabilities present in the code, never as a confirmed intent to use them.
Wallet Securityin place: Finds token approvals from event logs, then confirms each one's current value with a live contract call so a revoked approval is not reported as active.
MEV & Orderingin place: Assesses sandwich exposure, oracle manipulation surface and reorg sensitivity, showing manipulation by overwriting a real storage slot and reporting slot-not-found when none is identified.
On-chain Compliancein place: Screens addresses against the fetched OFAC sanctions list, judging the list's freshness by its own publication date and matching only on exact equality after normalization.

AI & Agents

OWASP LLM Top 10 read from the code, tool and MCP security, model provenance, agent guardrails and retrieval pipelines. 5 functions in place, 2 in observation. Price of this plan · How this surface is scanned

Static OWASP LLM Top 10in place: Checks the OWASP Top 10 for LLM applications, limited to the categories that can be decided by reading the code.
Transcript Leakagein place: Scans agent transcripts for exposed credentials using key prefixes and secret-shaped assignments; it detects leaked values after the fact and does not prevent leakage.
Model Provenancein place: Judges model artifact format risk, separating checkpoints that execute code on load from safetensors files, and states plainly that it cannot detect a poisoned model.
Autonomous Agent Guardrailsin place: Evaluates an agent deployment for bounded actions, spending ceilings, attributable audit trails and human approval, returning unknown where no step actually acts on the world.
RAG Pipeline Securityin place: Reads a retrieval pipeline's code for ingestion and retrieval risks, never the contents of an index, and returns unknown where no pipeline is present.
Runtime Prompt Injectionin observation: Runs a hostile prompt corpus only against an endpoint the operator explicitly declares and consents to, and counts one stated test condition as the evidence that a prompt was obeyed.
Tool & MCP Securityin observation: Inventories configured MCP servers, classifying each as mutating, read-only or of unknown capability, and flags any that carry a credential in plain text.

Email & CEO Fraud

Executive-fraud and impersonation detection on a mailbox you connect read-only, with the pretext surface an attacker can see. 1 function in place, 4 in observation. Price of this plan · How this surface is scanned

Email Securityin place: Detects CEO fraud and impersonation and inspects attachments through read-only Gmail and Microsoft Graph connections, raising an event for every attachment it could not examine.
Phishing Simulationin observation: Prepares phishing simulation material but cannot send it, since the function contains no mail transport or network client at all, by construction rather than by a setting.
Awareness Trainingin observation: Assigns targeted follow-up training after a measured failure and tracks assignment and completion; a completion rate is not a measure of competence.
Pretext Surfacein observation: Reports which names, roles and address formats are publicly discoverable and whether DNS, SPF and DMARC posture eases impersonation, under a recorded authorization and out-of-scope register.
Insider Riskin observation: Assesses account access only: it scores no employee, infers no intent and monitors no behaviour, returning satisfied, violated, unknown or not applicable per check.

The three protections

These are not scans. Each one runs continuously and acts on your own production — a contract, a server, a process — so each is sold on its own, never inside a bundle, and each requires a signed consent before checkout will proceed. None of them ever reverses itself: reopening is always your decision.

Auto-pausein place: Watches contract ownership, bytecode and proxy implementation across two independent RPC endpoints and can send only pause; it never unpauses, and refuses to start if that limit is widened.
Site lockdownin observation: Signals the customer's own reverse proxy to serve a read-only site, engaged by customer command or by a critical alert on that host, and never released automatically. It counts as in observation until it has been rehearsed on a real customer server.
Host containmentin place: Kills or reversibly isolates a process only on a host the customer armed by command and again locally, reporting every outcome, including no observed effect, as evidence.

Read the instructions before arming any of them: auto-pause, site lockdown, host containment. Their amounts are on the pricing page.

What is not on this page

Functions that are absent, and functions that changed

A function the platform does not have is not listed here at all — it is recorded as absent in the internal atlas and no plan advertises it. The counts on the home page state how many of the tracked functions fall in each of the three states, so the absent ones stay countable even though they are not described.

These definitions describe behaviour, not a promise of a result. A function that runs and finds nothing has found nothing with the method described here — see limitations and responsible use for what each family of checks stops short of proving.