Product

Veribound is a Pre-Session Edge Access Control (PEAC) platform. It keeps the firewalls and cloud controls you already run informed of your trusted origins, the networks your trusted users are connecting from right now, so your edge accepts those connections and stops replying to the rest of the internet.

It is additive by design, and it replaces nothing: not your identity provider, not MFA, not your access gateways, endpoint security, or monitoring. Nor does it claim to be an entire Zero Trust architecture. It is one control, placed earlier than the others, and your own equipment still does the enforcing.

Today, without Veribound

Your edge blocks the sources it already knows are bad and lets everything else through, so every control you own starts working only after a stranger has already made contact. Scanning, fingerprinting and credential stuffing all live in that gap, and the exposure is real before anything has been attempted.

  • ✕Anything on the internet can reach the service
  • ✕Credentials are evaluated after contact, so a stolen one still reaches the login surface
  • ✕Static allowlists need maintaining by hand as people move between networks
  • ✕A new control means a replacement or a redesign
  • ✓Only origin networks you have trusted can reach it
  • ✓Reachability is decided before credentials are seen, so a stolen one has nowhere to be presented
  • ✓Trusted origin networks update continuously as people move
  • ✓Your existing edge does the enforcing, unchanged
What your edge knows, today and with Veribound One flow from the internet through your edge to your service, shown in two states. Today the edge blocks some sources and allows most, which is a partial answer, so malicious sources that are not on a blocklist are allowed to make contact and your controls, the login, credentials, the second factor, and Zero Trust access, react after contact. With Veribound the same edge is kept informed of your trusted origins, so untrusted origins get no reply and everything downstream meets only people you trust. Unknown machines, anywhere Your Edge Your service Some sources blocked, most allowed Non-blocklisted malicious sources are allowed to contact Login shown Credentials checked Second factor Zero Trust access Untrusted origins get no reply Only trusted origins continue Everything downstream still runs, and it only ever meets people you trust. keeps your edge informed of your trusted origins

How it works

Six steps, in order, and none of them touches your network path: the platform runs as SaaS, the agents run on devices you already manage, and enforcement stays on the equipment already standing in front of your services. Agents are built platform-native for Windows, macOS, Android and iOS, so attestation sits as close to each platform’s hardware root of trust as it allows.

1

Provisioning and activation

An administrator provisions the person, either individually or from the users and groups synchronized out of your identity provider. The agent reaches the device however your organization already ships software. The person then activates their own token, signed into their own account on that device, the way an authenticator app is set up. Activation is per person, per device: two people sharing a laptop each hold their own, and neither can use the other’s.

2

Continuous attestation

The agent attests device posture on an ongoing basis, and the platform maintains each device’s history. This is the part that makes the model hold up over time: a device that was trustworthy at enrollment is not automatically trustworthy in six months. Laptops get rebuilt, phones get replaced, and machines change hands. Attestation that only happened once would be describing a device that may no longer exist.

3

Trust decision

The trust-scoring engine evaluates each device’s consistency against its own history and produces a per-device trust decision. The engine is Veribound’s core intellectual property, and how it reaches a decision is not published, because publishing the reasoning would be publishing the evasion guide. What is published is its contract: one decision per device, updated as that device changes. This engine is the one thing Veribound operates; everything else in the picture is yours.

4

Orchestration

What flows outward is a trusted origin: the verified network location, in practice the public address, that an active trusted device is connecting from. It reaches the firewalls and cloud controls you already operate through least-privilege adapters, arriving as membership of the groups your own policies already act on. Veribound writes that state; your systems keep their rules, their change process, and their authority. The node that does this writing runs inside your environment, on-premises or in your own cloud, and it is the only component holding credentials for your enforcement points. We never have them. The adapter it uses holds the narrowest permission that lets it do that one job, so the integration’s blast radius is bounded by design rather than by trust in us.

5

Your edge decides at first contact

When a request arrives, your own infrastructure already knows whether it is coming from an origin network it has been told to trust. Traffic from those networks is allowed through; everything else is refused there, at your edge, before the service is exposed to it at all. This is the step that matters most and the one Veribound is least involved in. By then the decision has already been delivered, and your equipment is acting on its own rules. You also choose how much of your estate this covers: most environments begin with one or two surfaces, a VPN portal or an administrative console, small enough to reverse and specific enough to measure, and widen once the model has proven itself.

6

Trust changes and revocation

Trust is not permanent. Decisions update as devices change, and administrators can revoke a device at any time: a laptop left in a taxi, a contractor whose engagement ended on Friday. Revocation propagates to your edge through the same orchestration path that granted trust in the first place, so taking access away is exactly as reliable an operation as giving it.

See what it costs, or check what it works with.

The calculator prices your own token count, and the pilot before it is free. The integrations page names what is supported today, and the list grows.

See Pricing and Pilot OptionsSupported Integrations