Circuit builds an Asset Graph from the tools you already run, decides with deterministic policy, acts through your own controls with your approval — and proves the result.
Circuit is in development. This page describes the architecture we’re building and proving; the screens are from Circuit 1.0 Alpha in our lab.
Every use case runs through the same stages, each with its own component. Each stage is explicit, so you can see what Circuit knew, what it decided, who approved, what changed and how it was proven.
Connectors ingest the facts decisions need — identities, sessions, privileges, assets, vulnerabilities, network observations and data classification — rather than all of your raw telemetry.
Entities are resolved by stable identifiers, never by display name — and shown to people by name. Every relationship keeps its source system, observed time and freshness, and a path exists only when every condition is backed by evidence; observed activity stays distinct from theoretical reachability.
Deterministic, versioned policy decides whether a path is material and what may be done about it. Unknown or stale evidence lowers confidence and is shown — it is never assumed.
Circuit ranks every control point that can actually break the path and recommends one — reversible where possible. Before anyone approves, any other can be used instead, or a companion added alongside; the rest stay ready if enforcement fails.
The approver reviews the exact change and signs it with a FIDO2 security key. The signature is bound to that command and nothing else, and whoever asked for the change can’t approve it.
An executor in your environment checks the signature, the approval and your signed policy, then applies the command through your control — endpoint, identity, cloud or network. A failure is explicit, never silent.
Circuit re-reads the authoritative sources and recomputes the path. It is marked broken only when fresh evidence shows it no longer resolves end to end; residual risk stays open, with an owner.
Every outcome — the path, each agent run, the approval, the command, the downstream response and the verification — is sealed once and in order in a tamper-evident log in the style of RFC 6962, signed with your key and copied to your own write-once storage. The same record drafts the CERT-In report.
Three agents, each with its own identity, typed tools, budgets and an autonomy level set by policy. Every run — its plan, each tool call and the digest of what came back — is sealed in your evidence log. In our lab, Circuit AI calls no model: its output is scripted from the facts, and every AI output is labelled.
Settles a path’s waiting conditions with typed, read-only queries from a catalogue — checked against the connector’s allowlist and arguments at every call, within a budget per run and per hour. The records it reads go through the same normaliser rules; it never writes a relationship or a verdict.
Compares the control points with a what-if for each, the guardrails, open alerts and history, and recommends one with reasons, a counter-argument and citations. Its digest is bound into the approval request, so the approver signs over the brief they read.
What was at risk, what was done and what remains — written from Circuit’s read models, never from a source directly. Figures first, one time axis, at most two sentences, every figure cited.
Clear layers separate what Circuit knows, what it decides, what it does and what it can prove — so each layer can be secured, scaled and replaced on its own. The parts that can change your environment run in your environment.
Circuit is designed as a cybersecurity mesh: composable, distributed and coordinated through shared context, policy and identity.
Composable controls coordinated through shared context, policy and identity. Circuit is the coordination layer; your tools remain the controls.
CSMA conceptDesigned so every request is authenticated and authorized — between people and services, between services, and between our cloud and your environment.
NIST SP 800-207 principlesFacts, decisions, commands and results flow as events, so a path is recomputed as soon as a supporting fact changes.
CloudEventsContext, decision, enforcement and evidence are separate layers with separate privileges, so the cloud that decides can’t act on your environment by itself.
Separation of dutiesMateriality, permitted actions and approval rules are versioned and tested like software. AI can explain a decision; it never makes one alone.
Deterministic, tested policyOpen formats at every seam, so Circuit fits your stack and your data stays portable.
OCSF · OpenC2 · CloudEvents · OpenAPI · FIDO2Circuit is designed so that a compromise of Cyberplane’s cloud alone can’t change your environment: the executor in your account holds the write credentials and acts only on commands signed by your approvers or allowed by a policy you signed.
Write credentials stay in your environment. The executor runs in your account; our cloud never holds write credentials for your controls.
Each approval signs one exact command with a hardware-backed key. Change the command and the signature no longer verifies.
The person who asks for a change can’t approve it. Approvers come from a roster your admins signed, and your executor checks every approval against it before it acts.
Discovery uses read-only access. A distinct, least-privilege identity performs only the actions your policy permits.
The record is append-only and its integrity can be checked outside Circuit, with a write-once copy in storage you control.
Circuit is designed to ingest decision-relevant facts rather than centralize your raw telemetry. Raw data such as flow logs can stay with you.
Every connector implements the same six operations, so adding a control means writing an adapter — not new architecture. The aim: new use cases arrive as entities, policies and connectors.
Circuit is designed to run in regional cells, India first. In our lab it runs as a Cyberplane-operated cell with a lightweight edge in your own cloud account; every model keeps write credentials, signing keys and your evidence copy with you.
Circuit runs in a regional cell — in the lab, the India cell in AWS Mumbai, with backups in Hyderabad. A lightweight edge in your account runs the executor and the relay.
A cell for your organization alone, in the region you choose, built from the same infrastructure modules.
Circuit in your own cloud account or data centre, operated by your team.
Whichever model you use, these never leave it — in the lab and by design.
Circuit is in development. Circuit 1.0 Alpha runs the full loop — from context to verified interruption — in our lab, with fictional data, and we’re inviting design partners to shape what comes next. If you’d like to be one, talk to us.
At first, you don’t have to. Circuit starts with recommendations and human approval. Automation expands only to actions your policy explicitly permits — bounded and preferably reversible — and every action keeps its evidence, authorization, execution status and verification.
You choose. Circuit ranks every control point that can break the path and recommends one; before anyone approves, any other can be used instead, or added alongside. High-impact actions stay approval-gated, whoever asks never approves, reversible actions are preferred, enforcement failures are explicit, and rollback is supported wherever the downstream control allows it.
Then it isn’t a success. Execution and verification are separate stages: Circuit re-reads the relevant state and recomputes the path. An intervention succeeds only when fresh evidence confirms the intended change.
No — it drafts, you submit. When an attack path is confirmed, Circuit drafts the report CERT-In’s Directions ask for from its sealed records, runs the 6-hour clock from the confirmed path (or from the first alert, if your admin prefers the stricter start), shows CERT-In’s four 6-hour tests as Circuit reads CERT-In’s guidance — for your counsel to confirm — and asks what only you can answer, such as whether personal data was accessed. Circuit never contacts CERT-In; marking the report submitted seals the time and the reference.
In our lab, Circuit runs in its India cell — AWS Mumbai, with backups in Hyderabad — and the tenant’s data stays in India; other regions are planned. Raw flow logs, write access to your controls, your evidence copies, your keys and your approvers’ security keys stay in your own account.
No. SOAR runs predefined workflows after an alert or case exists, CTEM tools discover, prioritize and validate exposure, and BAS simulates attacks. Circuit serves the mobilization stage of a CTEM program: it decides whether intervention is warranted, acts through a permitted control and verifies the result. It uses their findings as context, and SOAR can be one way it acts.
No. Circuit is designed to ingest the context its decisions need instead of centralizing your raw telemetry, which keeps cost, exposure and noise down. Raw data such as flow logs can stay in your environment.
Circuit AI has three agents. The investigation agent asks your tools typed, read-only questions to settle what a path is waiting for; the decision brief recommends a cut with reasons, a counter-argument and citations, and a person decides; the executive summary explains what happened from Circuit’s own records. Whether a path exists is decided by the path spec, actions are decided by policy and approved by people, agents have no write access, and every run is sealed as evidence. In our lab, Circuit AI calls no model: its output is scripted from the facts, and every AI output is labelled.
Bring an exposure you care about. We’ll walk you through how Circuit is designed to prove it, break it and prove it’s broken.