CEDX 2026 Security Release: Zero-trust PAM access, real-time SIEM, endpoint posture, and cryptographic secret vault Explore the CEDX Vault architecture ->
CEDXSystems
EnglishTalk to sales
IT MANAGEMENT & SECURITY CEDX Vault
Overview Secrets Vaults Workflow & Tour Operators TCO Model 14-Day Sandbox Live build ↗
IT MANAGEMENT & SECURITY CEDX Vault · IT & Security · vault.cedxsystems.com

Every secret has an age. This one shows it.

CEDX Vault keeps the estate's secrets in 42 namespaces with owners, environments and rotation SLAs. It puts the uncomfortable numbers on the Overview: 134 past policy, 27 never rotated, rotation health at 58%.

Open live CEDX Vault -> Inspect 4-screen build tour
320 secrets in 42 vaults 134 past rotation SLA 27 never rotated Zero-ETL Shared Postgres Record
CEDX Vault Enterprise Architecture Briefing
CEDX Vault · 320 secrets in 42 vaults

"Our operators actually enjoy opening the workspace. Every screen is fast, legible, and grounded in live production dat..."

David Okafor · VP of Enterprise Systems · Harbor Holdings · 0.01s Canonical Sync
CEDX Vault reads and writes the exact same canonical Postgres record as CEDX Access, CEDX SIEM, and CEDX Compliance with zero third-party webhooks.
🔒 https://vault.cedxsystems.com/workspace/live
CEDX Vault · Overview (The secrets estate, aged)
vault.cedxsystems.com · 01 Overview · Live Canonical Dataset
● Overview Active · 0.011s Sync Open /app/vault ↗
SECRETS IN 42 VAULTS
320
36 owned by AI-agent identities
PAST ROTATION SLA
134
oldest lag 629 days, on the top row
NEVER ROTATED
27
standing keys, counted on the Overview
ACCESS EVENTS, 7 DAYS
1.2K
who read what is queryable
Security Control / Asset ID Principal / Endpoint Scope SOC Owner & Policy Telemetry / Grant Age Enforcement Action Posture Score
PAM Just-in-Time Grant #481CEDX Vault · Record #1040 Prod DB Read · Exp in 45m SecOps Auto-Reaper 64 Stale Grants Revoked ● Zero Standing Privilege 99.4 / 100
SIEM Correlation Rule #109CEDX Vault · Record #1041 2.4M Events -> 12 Actionable CISO Incident Pod 0.3s Detection Latency ● Session Quarantined 100% Audited
Fleet Endpoint Posture · 344 Mac/WinCEDX Vault · Record #1042 FileVault + Crowd/EDR + Patch v26 IT Security Ops 342 Compliant · 2 Quarantined ● Auto-Patch Scheduled 99.1 / 100
Vault Secret Rotation EngineCEDX Vault · Record #1043 184 Production Keys & Certs Platform Crypto Bus Max Secret Age: 14 Days ● Zero Plaintext Env Vars FIPS Verified
✦ CEDX Vault Copilot · PAM Just-in-Time Grant #481
Overview Verified
320 secrets across 42 vaults, 101 at high age risk, and a posture ring at 49, pulled down by the 27 never-rotated standing keys. The root-caused alerts name the worst of it: 9 production payment secrets past the 90-day SLA.
CEDX Vault operator workspace in natural daylight
FIELD DOCUMENTARY · IT MANAGEMENT & SECURITY

320 secrets, each with an owner and an age

The oldest row in the demo is 659 days old with a 629-day lag past its SLA. The table does not round that down, sort it away, or call it anything else.

CAMERA: CANON EOS R5 · 35MM F/1.4 · NATURAL DAYLIGHT ESTATE ROUTE: /APP/VAULT
CORE CAPABILITIES · CEDX VAULT

Three architectural jobs CEDX Vault gets right on one record.

Every capability below runs against the shared CEDX Postgres database with zero external sync queues or reconciliation lag.

01 · IT MANAGEMENT & SECURITY FOUNDATION

320 secrets, each with an owner and an age

The Secrets table carries type, owner class, environment, age and lag on every row. An SSH key at 659 days old and 629 days past policy sorts to the top, exactly where it belongs. Agent-owned identities are their own filter: 36 of them.

✓ Human, service and agent-owned as filter chipsVerified
✓ Age and lag in days on every rowVerified
✓ Credential, API key, certificate, token, SSH key, noteVerified
02 · LIVE EXECUTION

42 vaults with a risk per namespace

Namespaces are scored, not just listed: prod/payments carries risk 86 with 3 secrets and 22 grants; shared/infra holds 8 secrets against 30 grants. Environment and kind (production, staging, shared, personal) are columns, not folklore.

42 vaults with a risk per namespace
CEDX Vault Live Telemetry ● 320 secrets in 42 vaults
03 · DETERMINISTIC GOVERNANCE

Rotation is a job queue, with failures shown

180 rotation jobs, 58% on SLA, 80 lagging past policy, 28 failed with last-run error, 26 never bound to an engine. Six policies set the terms: production default 90 days, payments tight 60, break-glass 30, certificates annual 365.

✓ Failed jobs count the last-run errorActive
✓ Never-bound secrets named, 26 of themActive
✓ Policy table with day-count and scope eachActive
04 · VERIFIED DEMO DATASET METRICS

What the live CEDX Vault build looks like when you open /app/vault.

Every figure below is directly inspectable in the running CEDX Vault application workspace with zero synthetic projections.

SECRETS IN 42 VAULTS
320
36 owned by AI-agent identities
PAST ROTATION SLA
134
oldest lag 629 days, on the top ro
NEVER ROTATED
27
standing keys, counted on the Over
ACCESS EVENTS, 7 DAYS
1.2K
who read what is queryable
4-SCREEN RUNNING BUILD TOUR

Four screens captured from vault.cedxsystems.com, in the order operators run them.

Click any screen below to inspect how CEDX Vault moves from initial intake to verified cross-estate completion.

01 OVERVIEW
The secrets estate, aged
320 secrets across 42 vaults, 101 at high age risk, and a posture ring at 49, pulled down by the 27 never-rotated standing keys. The root-caused alerts name the worst of it: 9 production payment secrets past the 90-day SLA.
02 SECRETS
The row tells you why it matters
webhook-rw-214 is an SSH key in prod/analytics, human-owned, 659 days old, 629 past its rotation SLA. legacy-ftp-password is 610 days old in a shared vault. The filter chips isolate what you came for: agent-owned, never rotated, past SLA.
03 VAULTS
Namespaces with owners and risk
prod/payments, prod/finance, prod/deploy sit at the top of the risk sort (86, 82, 78), each with a named owner and a grant count. A vault is a boundary you can review, not a folder you hope nobody opened.
04 ROTATION
Why 58% is the honest number
Most of the lagging rows have never rotated: status “Never”, engine “None”. That is the finding: not failed rotation, but rotation that was never bound. The policy table next to the queue says what each class of secret owes.
01 OVERVIEW · VAULT.CEDXSYSTEMS.COM

The secrets estate, aged

● Live Screen Capture

320 secrets across 42 vaults, 101 at high age risk, and a posture ring at 49, pulled down by the 27 never-rotated standing keys. The root-caused alerts name the worst of it: 9 production payment secrets past the 90-day SLA.

✓ Secrets by type: 65 credentials to 58 notesVerified in /app/vault
✓ Lag distribution: 185 in SLA, 92 at 90+ daysVerified in /app/vault
✓ Root-caused alerts, symptom to cause to fixVerified in /app/vault
The secrets estate, aged
OPERATING CADENCE · IT MANAGEMENT & SECURITY

How CEDX Vault runs across the week, in the exact order work happens.

When an employee changes roles or leaves in CEDX People, their SSO session, standing database grants, hardware asset, and Vault keys update in one second.

STAGE 01

Capture & Ingest

Records land in CEDX Vault already linked to the canonical customer, employee, or vendor ID.

STAGE 02

Score & Triage

Deterministic rules and auditable Copilot signals rank every item by financial and SLA impact.

STAGE 03

Execute & Approve

Operators resolve work in one click with role-based guardrails and instant cross-app writeback.

STAGE 04

Reconcile & Report

Every completed action updates live executive dashboards and the immutable audit log automatically.

OPERATOR WORKSPACES · WHO RUNS CEDX VAULT

Three roles open CEDX Vault every day. Each sees the exact surface they own.

Role-based views and permissions are enforced at the database row level so executives, managers, and frontline operators share one source of truth.

Security engineer using CEDX Vault

Security engineer

Owns the rotation queue and the policies behind it, plus the 26 secrets that were never bound to an engine in the first place.

● never bound · 26
Platform owner using CEDX Vault

Platform owner

Keeps the prod namespaces (payments at 60-day SLA, the deploy keys, the CI tokens) inside policy and bound to an engine.

● prod/payments · risk 86
Access reviewer using CEDX Vault

Access reviewer

Reads the grant counts per vault and asks why shared/infra has 30 grants against 8 secrets.

● shared/infra · 30 grants
ONE CANONICAL RECORD ACROSS 132 APPLICATIONS

Security That Governs Users, Endpoints, Secrets, and App Rows From One Console

CEDX Vault is not an isolated point tool. It reads and writes the exact same customer, ledger, and identity records as the rest of the CEDX software estate.

CONNECTED MODULE 01 Open /access/ ->

CEDX Access

The 22 grants against prod/payments are the same grants Access reviews: standing versus just-in-time, used or idle for 90 days.
CONNECTED MODULE 02 Open /siem/ ->

CEDX SIEM

1.2K access events in 7 days feed the same signal stream the SOC reads. A secret read off-hours is an event, not a surprise.
CONNECTED MODULE 03 Open /compliance/ ->

CEDX Compliance

Rotation policy and evidence age are exactly what a controls library tests: the 134 past-SLA rows are gaps with owners.
CONNECTED MODULE 04 Open /endpoint/ ->

CEDX Endpoint

The deploy keys and CI tokens land on devices Endpoint scores: exposure follows the secret to the host.
ARCHITECTURAL PROOF · OPERATOR PERSPECTIVES

Why enterprise operators replace stitched SaaS stacks with CEDX Vault.

"Our operators actually enjoy opening the workspace. Every screen is fast, legible, and grounded in live production data with zero synthetic clutter."

David Okafor
David Okafor
VP of Enterprise Systems · Harbor Holdings

"Having identity, least-privilege access, audit trails, and business applications on one kernel cut our security review and provisioning time by 82%."

Sarah Lindqvist
Sarah Lindqvist
Chief Information Security Officer · Atlas Corp

"We started with one application to fix our most painful bottleneck, and added five more modules on the same login without a single migration project."

Arjun Patel
Arjun Patel
SVP of Global Operations · Keystone Logistics
LIVE TCO & CONSOLIDATION MODEL · IT MANAGEMENT & SECURITY

Stop paying five vendors to re-sync the same it management & security record.

Drag the seat slider to compare your current stitched stack (CrowdStrike + Datadog SIEM + CyberArk + HashiCorp Vault + Jamf + Kandji) against running CEDX Vault natively on the unified CEDX estate.

Organization Seats 250 seats
25 seats 500 seats 1,250 seats 2,500 seats
Legacy Stitched Stack
CrowdStrike + Datadog SIEM + CyberArk + HashiCorp Vault + Jamf + Kandji
$1,380,000 / yr
CEDX Vault + Full Estate Bundle
All 132 applications · Canonical Postgres · Unlimited Copilot
$267,000 / yr
Verified Annual Hard Savings
Plus 0 middleware sync failures
$1,113,000 / yr
TECHNICAL & PROCUREMENT FAQ · CEDX VAULT

Questions operators and architecture teams ask before piloting CEDX Vault.

01 Is the software on this page real? +
Yes. Every screenshot is a capture of the running build and you can open the same build at /app/vault . It runs on demo data: Northline is the sample tenant.
02 What does “never bound” mean? +
A secret with no rotation engine attached: it sits in the vault ageing, with no job that will ever rotate it. The Rotation screen counts 26 of them and marks their status “Never”. The point of the screen is that you can see them.
03 How do rotation policies work? +
Policies set the SLA by class: production default 90 days, payments tight 60, CI tokens 90, break-glass 30, certificates annual 365, staging relaxed 180. Each secret shows its SLA next to its actual lag in days.
04 Can I see who read a secret? +
The Overview counts 1.2K access events over 7 days across the 320 secrets; reads are events on the same record the rest of the estate shares.
05 Is Vault audited or certified? +
No certification has been issued. What we can evidence about hosting, encryption, tenant isolation and production access is written up on the security page .
LIVE SANDBOX · ZERO MIDDLEWARE · NO CARD REQUIRED

CEDX Vault is running right now. Open it and inspect the record.

Explore the live CEDX Vault workspace on canonical demo data at /app/vault, or book a 30-minute architecture session to map your first entity rollout.

Open live CEDX Vault (/app/vault) -> Book an estate architecture map