Keep your hardware. Bring it under Faction protection.

Faction Network security, on hardware you already own. Faction provides a suite of services, support, tools and/or AI Skills that enable you to convert existing hardware into a Faction network node.

Once enabled, it can only connect to your Faction Network, and any machine or device behind it is unreachable from the public Internet. You keep local admin access to and control of your hardware. Compatibility identified by Faction.

Your Canopy-enabled hardware sits behind your existing modem, router or other upstream gateway, which are never trusted. Every connection is authorized by keys you control, and its only route for that equipment is the encrypted tunnel to your Faction Network.

That mitigates the threats from vulnerable or compromised foreign-made routers and smart hardware already inside your networks. No additional firewall to deploy or configure, no software agents on endpoint devices, no rip-and-replace of existing hardware or network infrastructure.

• Owner-controlled keys. Keys and certificates are controlled and issued by the Network Owner, and distributed only to authorized members. Faction never has access to them.
• Off the public Internet. Equipment behind your Canopy-enabled hardware has no path to the Internet, and is reachable only from inside your Faction Network.
• Out-of-band authentication. A direct key exchange that isn't exposed to external observation or attack.
• Nothing on the equipment. No agent, no software and no changes to the machines and devices you protect.
• Zero knowledge of content. Faction never has access to your keys, so it can never read your data. It sees only the routing metadata of encrypted traffic crossing your Faction Network.
• Zero anonymity of action. Every action on your network is tied to a verified device or user, and that record is under your control.
• Contained by design. A compromised machine or device behind it can't reach the Internet or call home, and Faction Groups limit what it can reach.

Devices compatible for Canopy conversion require:

• A secure tunnel for the encrypted Faction connection.
• Local access only, with vendor cloud access restricted or off.
• A firewall that denies by default.
• NAT for the network behind it.

Limitations:

• No hardware assurance on either route: hardware already in the field cannot go through the ORION process. Where hardware assurance matters most, choose Faction Pods & Portals.
• Hardware enabled with Canopy is protected by default-deny to the extent possible while keeping it usable. You keep local administration access, and are responsible for that security and meeting our requirements.

Available option:

• Monitored: vulnerability and patch monitoring through our partner OSec, coming soon. It covers the cyber integrity of your Faction Network, and does not extend to the hardware itself or its vendor firmware.