HodeiShield®

From signed evidence to verifiable attestation, in one integrated platform.

HodeiShield is a web console, an endpoint agent, a copilot, a Trust Center and a read-only developer surface. One cycle ties security, compliance and third parties together: SENSE, PREDICT, ACT and ATTEST.

Request a demoRead the docs (opens in a new tab)
  • Console in six languages (Spanish, English, German, French, Italian and Basque).
  • EU infrastructure (OVH, Gravelines), with Cloudflare in the request path.

In

  • Endpoint agent (signed observations)
  • External vendor sources
  • SBOMs, questionnaires and uploaded evidence

Console

HodeiShield

  1. SENSE · collects evidence and lets it expire
  2. PREDICT · quantifies and simulates
  3. ACT · HodeiAI proposes, a person approves
  4. ATTEST · signs per-framework bands

Out

  • Alerts to 9 destinations
  • Trust Center and attestation
  • Read-only API, CLI and MCP
Inputs on the left, the console in the middle, outputs on the right. What comes out can be verified or consumed by a third party without an admin account.

The cycle, part by part

SENSE feeds PREDICT; PREDICT prioritises what ACT proposes; ATTEST proves the result to third parties. Each phase claims only what the console does today, with its scope.

  1. SENSEcollect

    Collect verifiable signals and let them expire.

    Parts involved

    • Endpoint agent
    • External scanning
    • SBOM
    • Questionnaires

    1. An agent for Windows, macOS and Linux runs 172 checks and sends observations digitally signed; the console rejects any that fail verification.

      In the demo · a machine's detail

      Scope. The telemetry is signed, not the installer. 143 of the checks are open L1 baselines that don't feed the compliance score yet.

    2. Evidence expires: a device that stops reporting stops counting as compliant, with seven days of freshness by default.

      Docs · Compliance (opens in a new tab)

      Scope. Documentary evidence is uploaded or linked; it isn't pulled from the cloud on its own.

    3. For each vendor: an external scan of exposed ports, CVEs and known breaches using Shodan and Have I Been Pwned data, plus its CycloneDX or SPDX SBOM matched against OSV.dev.

      Docs · Risk engine (opens in a new tab)

      Scope. Periodic re-scans based on vendor criticality, not continuous monitoring. SBOMs in JSON only. Vendor data is orchestrated with n8n; there is no in-house scanner.

  2. PREDICTquantify

    Turn evidence into comparable risk.

    Parts involved

    • Risk engine
    • FAIR/ALE
    • Simulator
    • Dependency graph

    1. FAIR/ALE exposure in euros per vendor and across the portfolio: a parametric point estimate with its simulated uncertainty band (uncalibrated), reproducible.

      Docs · Risk engine (opens in a new tab)

      Scope. It uses the model's sector parameters, not your organisation's loss data.

    2. A deterministic simulator with 7 scenario types propagates impact through your dependency graph, up to 5 levels deep, and returns the affected vendors, score deltas and paths.

      Docs · Simulator (opens in a new tab)

      Scope. It returns score deltas, not euros. No language model is involved.

    3. A 3-hop blast radius and an HHI concentration index over your declared dependencies; actively exploited CVEs (CISA's KEV catalogue) weigh more in the 0 to 100 score.

      In the demo

      Scope. It works on the dependencies you declare; it isn't an automatic map of nth parties. The weights are model constants.

  3. ACTact

    Propose an action and run it only with human approval.

    Parts involved

    • HodeiAI
    • Risk register
    • Alert routing

    1. HodeiAI proposes. Running anything takes explicit approval from a user with a write role: single use, valid for 15 minutes and bound to the hash of the exact proposal.

      In the demo

      Scope. Today the only executable action is creating an entry in the risk register.

    2. The default level is “suggest”, and an administrator switches on approval to execute. Autonomous execution is blocked in the database, the API and the executor, and a per-organisation kill switch stops the agent and fails closed.

      In the demo

      Scope. ACT doesn't patch, isolate devices, revoke access or contact vendors.

    3. Every proposal, approval, rejection and execution, with who did it, lands in an append-only action ledger, hash-chained and batch-signed with ML-DSA-65, verifiable with the public key.

      In the demo

      Scope. It proves what was proposed, who decided and in what order; not that the decision was the right one.

    4. Alerts route to 9 destinations: ServiceNow, Jira, Slack, Teams, email, signed webhook, SIEM, PagerDuty and Opsgenie.

      Docs · Connectors (opens in a new tab)

      Scope. They notify or open a ticket according to your rule; they don't remediate on their own.

  4. ATTESTprove

    Show a third party the state, without asking them to take your word.

    Parts involved

    • Trust Center
    • Open verifier
    • Public key

    1. Every published Trust Center issues attestations signed with ML-DSA-65 (FIPS 204), with the signature kept separate from the attested document. They attest each framework's maturity band and the weakest one: never scores, euros or vendor detail.

      Docs · Attestation verifier (opens in a new tab)

      Scope. It's a self-assessment signed by HodeiShield: it proves integrity, origin and time, not that what's attested is true. It doesn't replace an audit.

    2. Anyone can verify it offline with the open-source verifier (Apache-2.0) and the public keys at /api/public/attest/keys, using OpenSSL 3.5 or later.

      GitHub · hodeishield-attest-verifier (opens in a new tab)

      Scope. Short-lived: 15 minutes by default and one hour at most, with optional challenge-response.

    3. A signed, published status list can revoke a key or every earlier attestation from an organisation.

      Docs · Attestation verifier (opens in a new tab)

      Scope. It doesn't revoke single attestations; their short lifetime covers that.

The cycle does not close on its own: every turn goes through a person.

The parts, with what they do and what they do not

Six parts. Each says what it covers and where it ends.

Web console

The place where you look and decide: third-party risk, compliance, evidence and reports.

See the solutions
  • A composite risk score from 0 to 100: scan, questionnaire and CVE signals, adjusted by access level, staleness, dependencies, certifications and concentration.
  • Evidence mapped to the canonical catalogue of each of the 17 frameworks.
  • An evidence engine with owner, validity and status: expired evidence does not count.
  • PDF reports, an executive dashboard and a report centre.

Scope: Cloud evidence (Microsoft 365, AWS, Google, Azure) is uploaded or linked by hand.

Endpoint agent

A lightweight program for Windows (.msi), macOS (universal .pkg) and Linux x86_64. It observes a machine's security configuration and reports it to your organisation.

Endpoint security
  • 172 checks, 143 of them open baselines (SCAP Security Guide, NIST mSCP, DISA STIG), level L1.
  • Ubuntu 22.04 and 24.04, macOS 14 and 15, Windows 11 and Server 2022.
  • It does not collect file contents, browsing, processes or credentials. It does send hostname, public IPs and operating system information.

Scope: Baselines are endpoint evidence and do not yet feed the compliance score. The signature covers the telemetry, not the installer. The agent does not update itself or remediate.

HodeiAI

A copilot that queries your organisation's live data through tools and proposes actions. It uses Mistral AI.

HodeiAI
  • HodeiAI and the virtual CISO pseudonymise recognised personal data before sending; the risk analysis of supplier scans does not.
  • An administrator can switch it off; it never acts without explicit confirmation.

Scope: It is not RAG and it does not act on its own: it proposes, and a person decides.

Trust Center

A public page for your posture, with public or restricted access (NDA / manual review), and the signed attestation as proof.

Trust Center and ATTEST
  • An audit trail of requests and events, and double opt-in for subscriptions.
  • The attestation contains only per-framework maturity bands.

Scope: It is a self-assessment signed by HodeiShield, not a certification.

API, CLI and MCP

Three ways to read your data from outside the console, all over the same public /v1 API.

For developers
  • A read-only REST API at api.hodeishield.com, with limited-scope access keys or standard authorisation (OAuth 2.1).
  • An open-source CLI (Apache-2.0), version 0.3.1.
  • A hosted MCP server with 11 read-only tools.

Scope: None of the three changes your organisation's data.

Alert routing

Each rule in your organisation decides which system receives each alert, so the notice shows up where the team already works.

Docs · Connectors (opens in a new tab)
  • Nine destinations, listed just below.

Scope: It notifies or opens a ticket in your system according to the rule. It does not run remediation.

Nine alert destinations

The notice lands in the system your team already uses.

Each destination declares its capabilities: Jira opens issues, Slack and Teams carry posture summaries, and the webhook forwards every alert, signed, to an HTTPS address you control.

  • ServiceNow
  • Jira
  • Slack
  • Microsoft Teams
  • Email
  • Signed webhook
  • SIEM
  • PagerDuty
  • Opsgenie

Who uses it, and in which language

The same console adapts to each profile and each team.

Profiles with their own guide

  • Administrator
  • MSSP
  • Security team
  • Executive leadership
  • Compliance
  • Board
  • Vendor
  • Trust Center visitor

Each profile sees and can do what fits its role. There are also periodic digests and outbound webhooks.

Role guides in the documentation (opens in a new tab)

Console languages

  • Españoles
  • Englishen
  • Deutschde
  • Françaisfr
  • Italianoit
  • Euskaraeu

The public documentation is in Spanish and English.

Go where you need to

Questions about the architecture

Answers based on what the platform does today.

What do I have to install?

Nothing to use the console: it is a web application. The endpoint agent is optional and only needed on the machines you want first-hand evidence from.

Does HodeiShield act on its own?

No. HodeiAI proposes and a person with a write role approves every action; approval is single-use and expires after 15 minutes. Today the only executable action is creating an entry in the risk register.

Is it a bundle of modules or a platform?

An integrated platform: SENSE evidence feeds the PREDICT risk, which prioritises the ACT proposals, and the ATTEST attestation comes out of that. Frameworks are a view over the same body of evidence.

Can I connect my own systems?

Alerts go out to nine destinations (ServiceNow, Jira, Slack, Teams, email, signed webhook, SIEM, PagerDuty and Opsgenie) and your data can be read through a public read-only API. Automated cloud evidence collection does not exist yet: evidence is uploaded or linked by hand.

Where is it hosted?

In the EU: application, database and storage managed by OVH in Gravelines, France. Cloudflare, a US company, handles DNS, CDN and TLS in the request path. The detail is on the security and sovereignty page.

See the cycle running on your case

In the demo we walk the four phases with your frameworks and your vendors, and show what each part does and where it stops.

Request a demoRead the docs (opens in a new tab)

A working conversation, no commitment.