CEDX 2026 Security Release: Zero-trust PAM access, real-time SIEM, endpoint posture, and cryptographic secret vault Explore the CEDX Network architecture ->
CEDXSystems
EnglishTalk to sales
IT MANAGEMENT & SECURITY CEDX Network
Overview Lateral & drift Devices Workflow & Tour Operators TCO Model 14-Day Sandbox Live build ↗
IT MANAGEMENT & SECURITY CEDX Network · IT & Security · network.cedxsystems.com

East-west traffic, finally legible.

CEDX Network scores every lateral path, classifies every flow (allow, block, inspect) and shows the drift between the policy you wrote and the network you actually have.

Open live CEDX Network -> Inspect 4-screen build tour
380 flows in the sample window 110 lateral paths scored 56 AI destinations Zero-ETL Shared Postgres Record
CEDX Network Enterprise Architecture Briefing
CEDX Network · 380 flows in the sample window

"Having identity, least-privilege access, audit trails, and business applications on one kernel cut our security review..."

Sarah Lindqvist · Chief Information Security Officer · Atlas Corp · 0.01s Canonical Sync
CEDX Network reads and writes the exact same canonical Postgres record as CEDX Endpoint, CEDX Access, and CEDX SIEM with zero third-party webhooks.
🔒 https://network.cedxsystems.com/workspace/live
CEDX Network · Overview (The estate's traffic, judged)
network.cedxsystems.com · 01 Overview · Live Canonical Dataset
● Overview Active · 0.011s Sync Open /app/network ↗
FLOWS IN THE SAMPLE WINDOW
380
allow, block or inspect on each
LATERAL PATHS SCORED
110
57 high risk · 32 high drift
AI DESTINATIONS
56
14.7% of flows, classified by policy
DNS BLOCK RATE
8.1%
malicious categories, trending on the
Security Control / Asset ID Principal / Endpoint Scope SOC Owner & Policy Telemetry / Grant Age Enforcement Action Posture Score
PAM Just-in-Time Grant #481CEDX Network · Record #1040 Prod DB Read · Exp in 45m SecOps Auto-Reaper 64 Stale Grants Revoked ● Zero Standing Privilege 99.4 / 100
SIEM Correlation Rule #109CEDX Network · Record #1041 2.4M Events -> 12 Actionable CISO Incident Pod 0.3s Detection Latency ● Session Quarantined 100% Audited
Fleet Endpoint Posture · 344 Mac/WinCEDX Network · Record #1042 FileVault + Crowd/EDR + Patch v26 IT Security Ops 342 Compliant · 2 Quarantined ● Auto-Patch Scheduled 99.1 / 100
Vault Secret Rotation EngineCEDX Network · Record #1043 184 Production Keys & Certs Platform Crypto Bus Max Secret Age: 14 Days ● Zero Plaintext Env Vars FIPS Verified
✦ CEDX Network Copilot · PAM Just-in-Time Grant #481
Overview Verified
286 of 320 devices online, a 21.6% block rate, an 8.1% DNS block rate on malicious categories, and a network health ring at 56 that lists its own inputs: online devices, lateral paths, block rate, gateway health.
CEDX Network operator workspace in natural daylight
FIELD DOCUMENTARY · IT MANAGEMENT & SECURITY

110 lateral paths, scored and explained

32 paths in the demo show high drift: the effective route is not the intended one. The table says which, from what hop, to which target, and how stale the policy behind it is.

CAMERA: CANON EOS R5 · 35MM F/1.4 · NATURAL DAYLIGHT ESTATE ROUTE: /APP/NETWORK
CORE CAPABILITIES · CEDX NETWORK

Three architectural jobs CEDX Network gets right on one record.

Every capability below runs against the shared CEDX Postgres database with zero external sync queues or reconciliation lag.

01 · IT MANAGEMENT & SECURITY FOUNDATION

110 lateral paths, scored and explained

The path risk queue lists device, hop and target with risk and drift: a personal phone reaching the ledger database through a remote jump at risk 95, drift 75; top signal “open east-west path”, confidence and last seen attached.

✓ Path heat map, policy drift and simulator as tabsVerified
✓ Drift ≥55 means effective differs from intendedVerified
✓ 0 shadow paths, 54 stale, counted separatelyVerified
02 · LIVE EXECUTION

Flows with a policy name on each

The flow table shows source, destination, protocol, port, action and the policy that decided it: a blocked assistant-chat call cites AI governance; an inspected database connection cites Shadow OT route; bytes moved are on the row.

Flows with a policy name on each
CEDX Network Live Telemetry ● 380 flows in the sample window
03 · DETERMINISTIC GOVERNANCE

Devices with posture and behaviour

320 enrolled devices with site, segment, OS, posture and a UEBA behaviour score: 232 managed, 52 high risk, 67 with behaviour scores at 70 or above. The guest segment and the OT segment are columns, not surprises.

✓ Segments: corp, prod, staging, remote, guest, OT, DMZActive
✓ 73% managed coverage, the gap is printedActive
✓ Behaviour ≥70 isolates 67 devicesActive
04 · VERIFIED DEMO DATASET METRICS

What the live CEDX Network build looks like when you open /app/network.

Every figure below is directly inspectable in the running CEDX Network application workspace with zero synthetic projections.

FLOWS IN THE SAMPLE WINDOW
380
allow, block or inspect on each
LATERAL PATHS SCORED
110
57 high risk · 32 high drift
AI DESTINATIONS
56
14.7% of flows, classified by poli
DNS BLOCK RATE
8.1%
malicious categories, trending on
4-SCREEN RUNNING BUILD TOUR

Four screens captured from network.cedxsystems.com, in the order operators run them.

Click any screen below to inspect how CEDX Network moves from initial intake to verified cross-estate completion.

01 OVERVIEW
The estate's traffic, judged
286 of 320 devices online, a 21.6% block rate, an 8.1% DNS block rate on malicious categories, and a network health ring at 56 that lists its own inputs: online devices, lateral paths, block rate, gateway health.
02 LATERAL & DRIFT
Who can reach what they should not
The OT gateway reaching the deploy host through a jump box scores 95 with drift 91, a path that was never supposed to exist, persisting because nothing removed it. 57 of the 110 scored paths are high risk right now.
03 DEVICES
The enrolled estate, scored
Every device with owner, site, segment, posture and behaviour score, sortable, exportable, and honest about coverage: 89% online, 73% managed, and the 52 high-risk devices averaging posture 89.
04 FLOWS
The policy, applied and visible
Read the sample like a ledger: a blocked call to an AI-apps workspace at 0 bytes under AI governance, an inspected connection to a flagged drop host under Shadow OT route, a 32.7 MB internal transfer allowed under CI-to-registry.
01 OVERVIEW · NETWORK.CEDXSYSTEMS.COM

The estate's traffic, judged

● Live Screen Capture

286 of 320 devices online, a 21.6% block rate, an 8.1% DNS block rate on malicious categories, and a network health ring at 56 that lists its own inputs: online devices, lateral paths, block rate, gateway health.

✓ Allowed versus blocked flows, daily, with markersVerified in /app/network
✓ Devices by segment: remote 102, OT 67, DMZ 38Verified in /app/network
✓ Lowest-posture devices named, ava-phone-88 at 22Verified in /app/network
The estate's traffic, judged
OPERATING CADENCE · IT MANAGEMENT & SECURITY

How CEDX Network runs across the week, in the exact order work happens.

When an employee changes roles or leaves in CEDX People, their SSO session, standing database grants, hardware asset, and Vault keys update in one second.

STAGE 01

Capture & Ingest

Records land in CEDX Network already linked to the canonical customer, employee, or vendor ID.

STAGE 02

Score & Triage

Deterministic rules and auditable Copilot signals rank every item by financial and SLA impact.

STAGE 03

Execute & Approve

Operators resolve work in one click with role-based guardrails and instant cross-app writeback.

STAGE 04

Reconcile & Report

Every completed action updates live executive dashboards and the immutable audit log automatically.

OPERATOR WORKSPACES · WHO RUNS CEDX NETWORK

Three roles open CEDX Network every day. Each sees the exact surface they own.

Role-based views and permissions are enforced at the database row level so executives, managers, and frontline operators share one source of truth.

Network engineer using CEDX Network

Network engineer

Owns the gateways, the segments and the physical end of the flow table, and the 33 edges that are not healthy.

● gateways · 15/48 healthy
Policy author using CEDX Network

Policy author

Writes the rules the flow table cites (AI governance, posture floor, east-west blocks) and reads the drift report to see what the network actually does.

● policy drift · 61
Device fleet owner using CEDX Network

Device fleet owner

Keeps the enrolled estate managed and postured: the 73% coverage figure and the 52 high-risk devices are theirs to move.

● high risk · 52
ONE CANONICAL RECORD ACROSS 132 APPLICATIONS

Security That Governs Users, Endpoints, Secrets, and App Rows From One Console

CEDX Network is not an isolated point tool. It reads and writes the exact same customer, ledger, and identity records as the rest of the CEDX software estate.

CONNECTED MODULE 01 Open /endpoint/ ->

CEDX Endpoint

The device's posture on the network is the same posture Endpoint computes: 73% managed coverage is one number, shared.
CONNECTED MODULE 02 Open /access/ ->

CEDX Access

The principal behind a sensitive flow carries grants Access reviews: a blocked remote-jump path is also a standing-grant question.
CONNECTED MODULE 03 Open /siem/ ->

CEDX SIEM

Policy denies and lateral movement land in the event stream as outcomes the SOC triages: 95 policy-blocked denies in the demo window.
CONNECTED MODULE 04 Open /inventory-it/ ->

CEDX Inventory IT

The enrolled estate reconciles against the asset register. Unknown devices on the network are assets the register never saw.
ARCHITECTURAL PROOF · OPERATOR PERSPECTIVES

Why enterprise operators replace stitched SaaS stacks with CEDX Network.

"Having identity, least-privilege access, audit trails, and business applications on one kernel cut our security review and provisioning time by 82%."

Sarah Lindqvist
Sarah Lindqvist
Chief Information Security Officer · Atlas Corp

"We started with one application to fix our most painful bottleneck, and added five more modules on the same login without a single migration project."

Arjun Patel
Arjun Patel
SVP of Global Operations · Keystone Logistics

"Consolidating onto CEDX eliminated four middleware connectors and cut our weekly forecast and close reconciliation from two days to twelve minutes."

Marcus Vance
Marcus Vance
Chief Revenue Officer · Meridian Systems
LIVE TCO & CONSOLIDATION MODEL · IT MANAGEMENT & SECURITY

Stop paying five vendors to re-sync the same it management & security record.

Drag the seat slider to compare your current stitched stack (CrowdStrike + Datadog SIEM + CyberArk + HashiCorp Vault + Jamf + Kandji) against running CEDX Network natively on the unified CEDX estate.

Organization Seats 250 seats
25 seats 500 seats 1,250 seats 2,500 seats
Legacy Stitched Stack
CrowdStrike + Datadog SIEM + CyberArk + HashiCorp Vault + Jamf + Kandji
$1,380,000 / yr
CEDX Network + Full Estate Bundle
All 132 applications · Canonical Postgres · Unlimited Copilot
$267,000 / yr
Verified Annual Hard Savings
Plus 0 middleware sync failures
$1,113,000 / yr
TECHNICAL & PROCUREMENT FAQ · CEDX NETWORK

Questions operators and architecture teams ask before piloting CEDX Network.

01 Is the software on this page real? +
Yes. Every screenshot is a capture of the running build and you can open the same build at /app/network . It runs on demo data: Northline is the sample estate.
02 What is path drift? +
The difference between the policy you intended and the route traffic actually takes. 32 paths in the demo score drift ≥55, like the OT gateway reaching the deploy host through a jump box. The drift tab lists them with the hop and the staleness of the policy behind each.
03 How is AI traffic handled? +
AI destinations are classified as assistant chat, model API or agent framework, and governed by a named AI-governance policy: a blocked assistant-chat call cites that policy on the flow row, at 0 bytes, with the class attached.
04 What does the block rate mean? +
In the sample window, 82 of 380 flows were blocked (21.6%), and DNS blocks on malicious categories run at 8.1%. Both figures are the demo estate's own, printed on the cards.
05 Is Network audited or certified? +
No certification has been issued. What we can evidence about hosting, encryption, tenant isolation and inspection is written up on the security page .
LIVE SANDBOX · ZERO MIDDLEWARE · NO CARD REQUIRED

CEDX Network is running right now. Open it and inspect the record.

Explore the live CEDX Network workspace on canonical demo data at /app/network, or book a 30-minute architecture session to map your first entity rollout.

Open live CEDX Network (/app/network) -> Book an estate architecture map