Everything Defneo does, in one place

Publish sites and applications through Traefik, managed from the panel, without editing configuration files.

• Backends by domain and path, with several servers
• Load balancing and health checks
• Security headers and compression applied uniformly
• Disable without losing configuration
• Immediate apply, without restarting sites

Let's Encrypt certificates issued and renewed automatically for every published domain.

• Issuance on the first HTTPS request
• Renewal before expiry
• Automatic HTTP → HTTPS redirect
• Modern TLS configuration

Domain and path redirects managed in the same place as backends.

• Old domain → new domain
• Permanent or temporary redirects
• Automatic certificate for the redirected domain too

Per-backend request limiting profiles, with defaults adjustable from settings.

• Default, strict and per-site profiles
• Pre-selected for new backends
• Correct client IP behind a proxy layer

Behavioural analysis of every request and automatic banning of attack sources at the edge.

• Scenarios for scanning, brute force, CVE exploitation and L7 floods
• Defneo scenarios for distributed scans and fake crawlers
• Legitimate crawlers verified and spared
• MITRE ATT&CK mapping
• Fail-closed blocking

Defneo installations share confirmed attackers; the list is corroborated by independent sources and digitally signed.

• Only IP, scenario and time are sent
• Published only after confirmation from several sources
• Signed list, refused if the signature is invalid
• Public blocklists included
• Source of each ban visible in its reason

Ban decisions are also enforced in the server firewall, not only in the proxy, for traffic that is not HTTP.

• Automatically updated nftables sets
• Covers traffic forwarded to containers too
• Anti-lockout protection for administrative access

For any IP: the decision, scenarios, requests and a risk score, with one-click ban or unban.

• CrowdSec alerts with their events
• Risk score by request category
• Unban recommendation for false positives
• Refuses to ban the panel's own address

Choose per backend whether to allow AI crawlers, block only training, or block them all.

• Three levels: off, training, all
• Blocked in the proxy, without loading the application
• Classic search engines unaffected

Request content inspection and blocking of known-vulnerability exploitation before the application.

• Virtual-patching rules for known CVEs
• Lasting bans for sources that keep trying
• Dedicated ban-duration profile for scanners

Country-based traffic blocking, with an exception list for IPs that must get through.

• Country selection from the panel
• IP exceptions
• Effect visible immediately in analytics

Detection of automated content harvesting, with crawler verification by operator and a monitor mode before blocking.

• Crawler verification via published ranges and FCrDNS
• Proof of a human from one week of history
• Escalation IP → subnet → autonomous system
• Monitor mode by default

Decoy paths ban scanners, and sensitive files exposed by mistake are hidden at the edge.

• Identical 404 for known sensitive paths
• Automatic ban on traps
• Required paths (for example /.well-known/) stay open

Indicators of compromise from external feeds, matched automatically against new traffic.

• Periodic import from threat-intelligence feeds
• Manually added indicators
• Automatic ban on match
• Unmaintained feeds are rejected

Traffic bursts are analysed, an AI model proposes rules, and a deterministic validator and an administrator decide.

• Pseudonymised summary sent to the model
• Refuses to ban IPs with evidence of human browsing
• Applied by administrators only, with re-validation
• Local or external model, your choice

Primary and canary variants with a traffic weight; the new variant is withdrawn automatically if it degrades.

• Configurable traffic weight
• Error-rate and latency monitoring
• Automatic rollback

Phishing, malware and spam are checked before delivery, with the same rules as the Site Shield mail filter, with no queue of its own.

• Executable, password-form HTML and macro attachments
• Senders from hijacked networks and abuse lists
• Optional ClamAV antivirus
• Modes: monitor, tag to Junk, reject
• Never an open relay; a sender's own verdict is ignored

Outlook on the web, ActiveSync and EWS published through Defneo, with the known exploits blocked and push mail working.

• ProxyShell, ProxyNotShell, ProxyLogon refused and banned
• Admin centre closed to the internet
• Dedicated timeouts for push on phones
• Brute force counted on failed logins

Visitors, pages, countries, sources and technologies, computed from the real requests passing through the proxy.

• No page script and no tracking cookies
• Real pages only or all requests, your choice
• Bot filters by category and banned-IP exclusion
• Long history with an optional analytics engine

Requests from the last few seconds, with country, path and response code.

• Updates every few seconds
• Errors and blocked requests highlighted
• Click an IP for details

Click a country, page, IP, source or status code and see every aggregate narrowed to that value.

• The same aggregates for any dimension
• Drill-down total matches the number clicked
• Strict value validation

Which pages each visitor viewed, in what order, and where they hit errors.

• Sessions split by inactivity
• No bots, scanners or banned IPs by default
• Per-visitor timeline

Correlates routes declared in the sitemap with real 404/5xx errors, so you find broken pages.

• Errors on legitimate routes vs. probes
• Fast visit reports
• Export for the development team

A natural-language traffic report with sessions, bounce rate, time on page and conversions.

• Sessions and engagement for humans only
• Conversions on goal paths you define
• Template fallback without an AI model

Dozens of technical SEO checks plus citability in AI answer engines, off-page and competitors.

• Checks in seven categories
• Citability in ChatGPT, Perplexity and AI Overviews
• Self-hosted metasearch, no third-party keys

Important events reach the panel inbox and email, webhook, Slack, Discord or Telegram.

• Rules by event type and severity
• Merging of repeated events
• Recovery announcements
• Daily ban digest

Every-minute check of all proxy routers, with an immediate alert if a public site is no longer served.

• Severity by consequence
• “Unknown” state when the proxy cannot be read
• Blocking component shipped locally

Independent check of the certificates actually served, with an alert before expiry.

• Expiry date per domain
• Invalid certificate detection
• Configurable notifications

Passive daily assessment of each site: TLS, headers, security.txt, SPF and DMARC.

• The grade's arithmetic shown
• No guessed paths, no probing
• Checks that could not run are left out

The home page that gathers alerts from every module into one feed, without duplicates.

• More than ten sources in one feed
• Failed source shown as unavailable, not zero
• Off-site backup status

What happened overnight: bans, new CVEs on your software, silent agents, deadlines, security news.

• Natural-language text with an AI model
• Optional audio version
• Security news in Romanian

The executive picture: posture, threats, compliance, AI governance, inventory and key indicators.

• Key indicators with drill-down
• Strategic PDF report
• Sections degrade honestly when a source is missing

Eight automatically provisioned dashboards for the proxy, CrowdSec, network, platform and web applications.

• Embedded in the panel, behind its login
• Real host network metrics
• 15-day metrics retention

Over 70 alerting rules for system, network, proxy, CrowdSec and platform components, automatically tested.

• Thresholds relative to your own baseline AND absolute
• Packet floods, conntrack, connection queues
• Routing through AlertManager

Every platform component with its status, resources and limits, safely adjustable.

• Limits sized automatically to the hardware
• Warning when reservations do not fit
• Tells you whether a change is live or needs a recreate

Certificates issued by anyone for your domains, from the public CT logs.

• Detection of unauthorised issuance
• New subdomains appearing in certificates
• Notification on new entries

Reports the inventory, security posture and telemetry of each Linux server.

• Enrolment with a single-use token
• Signed reports with anti-replay protection
• Panel identity verified on every connection
• Offline install package

Inventory, posture and events for Windows workstations and servers, with a preconfigured installer.

• Installer with the token embedded
• Full verification before any write, with rollback
• Windows Update and patch-level status

System, packages, services, ports, processes and end-of-life runtimes for each host.

• EOL runtimes from public calendars
• Processes with hash checks against public sources
• Network topology and discovered assets
• AI assistant for host posture

Compares domain computers with installed agents and shows untracked machines.

• LDAP connector configured from the panel
• List of machines without an agent
• Coverage percentage

Automatic CIS-inspired configuration checks on each host, with score and remediation.

• SSH, passwords, services, permissions, logging, firewall
• Fleet-wide picture
• Documented exceptions

Detects changes to system and configuration files, comparing with vendor hashes.

• Comparison with package hashes
• Acknowledgement of legitimate changes
• Hosts without a hash database show as “not verified”

Each host's network behaviour: beaconing, DGA, DNS tunnelling, abnormal volumes and new destinations.

• Context: process, destination, baseline age
• AI interpretation per finding
• Known-noise suppression, reason shown
• Suppressed alerts stay in history

A resident service that scans new files, evaluates processes and blocks malicious connections and URLs, alongside Defender.

• Post-write scanning and quarantine
• IP blocking before connection
• URL filtering in Chromium browsers
• Content analysis in an isolated process
• Open-source library inventory, correlated with CVEs

App and site blocking and screen time on children's Windows profiles.

• Schedule by day and hour
• Warnings before time runs out
• Session lock without losing work

Process termination, host isolation and firewall rules, executed only with another person's approval.

• Second-person approval, expires in 30 minutes
• Opt-in per host
• Target identified stably, not just by PID
• Isolation that keeps the panel link

Vulnerabilities matched to the versions actually installed on each host, plus the platform's own dependencies.

• OSV, NVD (vetted mapping) and MSRC
• Prioritisation by CISA KEV and EPSS
• Minimum fixed version
• Per-host remediation plan
• “Not verified” when no reliable mapping exists

Passive or active scans of your own sites, with remediation and recurring schedules.

• TLS, headers, DMARC, security.txt, HTTP methods, open redirect, GraphQL, clickjacking
• Content fuzzer in active mode, with consent
• AI remediation and playbooks for coding assistants
• Scan-to-scan comparison

Network scans run by agents, authorised per target, with exclusion lists that always win.

• Signed per-target authorisation
• Fail-closed kill switch
• Assets are retired, never deleted

Classic pentest tools started on demand in an isolated container, with target guards.

• Off by default, auto-stop when idle
• Intrusive tests for administrators only, with typed confirmation
• The whole target range is checked

Every module's findings on assets, with an explainable risk score, KPIs and verified remediation.

• Score factors add up exactly to the score
• KPIs with the list behind the number
• Remediation “verified” only after a confirming scan
• Risk acceptance with reason and expiry
• PDF/CSV and SIEM export

An inventory of third-party API keys with an additive risk score — without storing the secrets.

• Age, permissions, IP restrictions, data volume
• Empty fields raise the risk
• Automatic discovery of some integrations

What is public about your domains, IPs and addresses, without probing them, plus a remediation plan grouped by action.

• Certificate Transparency, DNS, public engines, published content
• Domain tree and orphaned CNAMEs
• “Could not check” kept apart from “not found”
• Sequential scan of discovered hosts

Discovers on demand the domains imitating your brand and estimates whether they clone your site.

• Letter variations, other extensions, added words
• Clone score with its factors shown
• Domains on the same server as the original recognised as yours

Continuous tracking of look-alike domains, with analysis of who is behind them and the fastest way to stop them.

• Notifications on new findings only
• Cloaking detection (the page seen from ads)
• Correlation, never firm attribution
• Takedown paths per registrar and host

SPF, DKIM and DMARC checks on your domains, with explanations of what is missing.

• All domains in one view
• Concrete recommendations
• Signal for compliance controls

Checks whether the organisation's addresses appear in public breaches and whether passwords are compromised.

• Local breached-password database, queryable offline
• Passwords never sent out
• Monitoring of organisation addresses

Reads the audit logs and flags risky actions in your GitHub organisation and Azure AD (Entra ID) tenant.

• New SSH keys, OAuth apps, repositories made public
• Role changes and application consents
• Risky sign-ins and MFA failures

59 controls across 12 domains, derived from NIS2 Art. 21, with a score and a gap list.

• Practical explanation per control
• ISO 27001 mapping
• Gaps ordered by importance

Ordered steps with deadlines, the entity profile and controls that tick themselves from what other modules do.

• “What to do next”, with reason and instructions per step
• Live signals: backup, MFA, training, monitoring
• Management training tracked separately
• Audit PDF report with each evidence source

A significant incident starts the 24h, 72h and 30-day clocks, with pre-filled forms.

• Deadlines derived from the previous stage
• Clocks in UTC
• Overdue deadlines stay visible after closing
• DNSC registration stages

The controls of Regulation (EU) 2022/2554, assessed from system state where possible, for financial entities.

• ICT risk framework, protection, detection, response, backup
• ICT third-party risk — at most “partial” without your confirmation
• Narrative and audit report

The record of processing, data-subject requests, breaches, processors and Art. 32 measures.

• Gaps per processing activity
• 30-day clock for requests, 72h for breaches
• Technical measures proven from the platform
• DPIA screening
• PDFs: ROPA, Art. 32 evidence, draft notification

Clauses 4–10 and all 93 Annex A controls, with live signals and the Statement of Applicability.

• Practical guidance per control
• SoA export as PDF
• ISO 27017, 27701 and 22301 skeletons

One view across all frameworks, where a control proven once serves every framework that requires it.

• Score per framework with drill-down to the evidence
• List of items needing attention
• Unavailable framework ≠ 0%
• Bilingual text, with legal quotes kept in the original

Snapshots of compliance state, cryptographically chained and protected against modification and deletion.

• Chain verification points to the first altered entry
• Each snapshot lists unavailable sources
• No edit or delete routes

Suppliers, their access, contracts and assessments, with history kept after revocation.

• Access by accounts, keys and connections
• Revocation without deletion
• Export as a starting point for the DORA register of information
• Correlation with events, not attribution

Every AI system used in the organisation, with owner, purpose, data and AI Act risk tier.

• Tiers: prohibited, high, limited, minimal
• Art. 9–15 obligations for high-risk only
• Cost, benefit and implementation phase

Organisation-level controls, with ordered steps and the deadlines of Regulation (EU) 2024/1689.

• AI literacy, transparency, general-purpose models
• Urgent steps = obligations already in force
• PDF documents for audit

Declare the AI agents and automations that access your services and follow their behaviour.

• Identification by User-Agent and IP
• Behavioural anomaly detection
• AI explanation with template fallback

Every model call, proposal, human decision and action, in an append-only, cryptographically chained journal.

• Prompts kept only as fingerprint and length
• The API token that triggered the action
• Chain integrity verification

Briefing, remediation, anomaly explanations and interpretations written by an OpenAI-compatible model you choose, including a local one.

• Fully functional without a model, on templates
• IPs pseudonymised before sending
• The model proposes, a human decides

Bilingual microlearning courses with quizzes, reminders and organisation-wide coverage, management included.

• Included, editable catalogue
• Learner portal without an account, with swipeable lessons on mobile
• Only a passed quiz closes an enrolment
• Management tracked separately
• Certificates and PDF report

Simulated phishing campaigns with realistic scenarios and a direct link to training.

• Scenarios: delivery, lock screen, collaboration, urgent payment
• Opens, clicks, credentials, reports
• Automatic course enrolment after a click

Internal policies published and confirmed by each employee, tied to the version.

• Republishing invalidates old confirmations
• Periodic re-confirmation
• Empty register ≠ 100%

An internal portal for employees, equipment and inventory, managed from the panel.

• Tracking of allocated equipment
• Joiners and leavers
• Link to the technical inventory

Three roles with default deny on every change, two-step verification and WebAuthn keys.

• Administrator, operator, viewer
• TOTP and passkeys (FIDO2)
• Persistent brute-force lockout
• New routes protected from day one

Automated API access for scripts, MCP servers and AI agents, with a capped role and expiry.

• Effective role recomputed on every request
• Expiry of at most 90 days
• Stored only as a hash, shown once
• A token cannot manage tokens

Every change is saved, applied, checked and rolled back automatically if the proxy is unhealthy.

• History with author and date
• Version comparison
• Manual restore

The installer checks requirements and sizes each service's memory limits to the hardware.

• Requirement checks before installing
• Refuses an install that does not fit in memory
• Upgrade with a verified backup and rollback

Every release is described by a digitally signed manifest, verified before installation.

• Signature verification on the server
• Downgrades and disallowed jumps refused
• Manual import for isolated servers

The panel announces new versions and applies them with a backup, health check and automatic rollback.

• Typed confirmation, administrators only
• Distinct outcomes: applied, rolled back, refused, failed
• “Up to date” only after a successful check

Platform configuration and data sent automatically to Google Drive, an SSH server or WebDAV.

• Automatic schedule
• Destination configurable by administrators only
• Last backup status on the Overview

Defneo events delivered to your SIEM, with a queue, retries and undelivered messages kept.

• Syslog (UDP/TCP/TLS), webhook, Splunk HEC, Microsoft Sentinel, Elastic
• CEF and ECS formats
• Secrets masked after saving

Additional proxy nodes in other locations, managed from the same panel.

• Enrolment with a single-use token
• Signed requests, no replay
• Backends assigned per node

The panel published on your own domain with a Let's Encrypt certificate, with fallback access on the IP.

• Applied with checks and rollback
• Fallback access that never closes
• Warning when agents would communicate unencrypted