SafeHarbor evolves beyond CAASM into a unified control plane that observes, decides, and enforces across the full security lifecycle — asset intelligence, vulnerability prioritization, compliance automation, and closed-loop remediation in a single platform. Built for regulated enterprise and federal environments. Air-gapped from day one.
Legacy CAASM tools surface drift but leave you opening tickets. SafeHarbor closes the loop with policy-driven enforcement across connectors.
Single Go binary. No cluster, no sidecar sprawl, no cloud dependency. Ships as an offline bundle for IL5, IL6, SIPR, and JWICS.
SSP auto-generation, continuous monitoring, OSCAL 1.1.2 export. POA&M lifecycle with an auto-close worker that actually closes.
SafeHarbor observes every asset, scores every vulnerability, drafts every SSP, and executes every remediation. Built as a single Go binary so it runs the same way on your laptop, on a hardened enclave appliance, and on a cATO-authorized SIPR node.
2,000+ connectors stream into a DGraph-backed asset graph with 23 AD edge types. ClickHouse handles the analytics side-car. NATS JetStream keeps the ingest pipeline durable even across air-gap transfer windows.
Every asset is scored with a Vulnerability-Threat-Criticality (VTC) model, enriched with EPSS, CISA KEV, and Tenable VPR. Snapshots persist to ClickHouse so you can query the 4am incident from last Thursday.
NIST 800-53 Rev 5, FedRAMP, CMMC 2.0, CISA BOD, CISA ZT, DISA STIG, PCI DSS, HIPAA. Auto-generated SSPs, evidence collection, and OSCAL 1.1.2 export (SSP, SAR, POA&M, Component Definition). eMASS v3.22 and Xacta 360 integrations ship in the box.
Policies declare desired state. SafeHarbor detects drift, opens change records, executes remediations through the same connectors it reads from — then proves the fix held. Every action signed and logged to the tenant-isolated audit stream.
Click a framework to see how SafeHarbor maps controls to evidence, automates the drudgery, and exports in OSCAL. All eight frameworks ship in the binary.
Axonius can self-host. We're the one architected for IL5, IL6, SIPR and JWICS natively. Verifiable in the binary — no cloud dependency, no outbound sidecar, no K8s control plane required.
BoringCrypto cryptographic module. In validation, Level 1.
Architected for classified enclaves. SIPR and JWICS deployments supported.
SSP · SAR · POA&M · Component Definition. Exports that actually import.
RMF 7-step automation with ConMon workers that actually close POA&M items.
"We replaced three tools with one binary. The first OSCAL export from SafeHarbor passed eMASS ingest on the first try — we'd never seen that before."
Community runs the same binary as Enterprise — just with a 50-asset cap. Upgrade only when your asset count demands it.
50 assets. All connectors. OSCAL export. Local auth. The full binary, on your laptop or homelab.
For commercial security teams. Unlimited users, SAML, automated remediation, 9×5 support.
Air-gap, FIPS, IL5/IL6, CAC/PIV, eMASS, Xacta. Dedicated TAM. Contract vehicles available.
30 minutes. No deck. We spin up a live SafeHarbor against your sample connectors and walk through your own asset graph. Federal briefings available with AO/PM present.