The product's own user guide. Every screen shows Aldervane Health, a fictional organization. All data is synthetic.
14. Questions security teams ask
The questions CISOs and security teams most often ask before adopting Ciphren, answered directly.
About the collection
Will the collection set off our intrusion detection or firewall alerts? It's unlikely. The collection observes your systems the way a web browser does: it requests public pages and reads what your servers announce. It doesn't log in, exploit anything or test a weakness (chapter 1).
How often does it run? Typically every 7 days. It depends on the size of your estate, your requirements, and the plan you choose. Each organization's profile shows when it was last collected and when the next collection is due.
How does a new instance start? Your own picture builds from your first collection. Before it, the pages are empty; after it, they fill in. History builds from the second collection onward: what changed, what was fixed, how fast.
How does Ciphren know which systems and suppliers are ours? From your organization's setup: your organization, affiliates, domains, key suppliers and locations. It's agreed with Ciphren when you're onboarded, and the collection also discovers systems around it.
How do we add a subsidiary, or correct something attributed to us by mistake? Today, by contacting Ciphren; we update your setup, and the next collection reflects it. Doing it from within the product isn't available yet.
About findings
Can we mark a finding as a false positive, or as an accepted risk? Not from within the product today. A finding stays until the collection no longer observes it, because an outside-in record is only useful if it shows what is really there. If you believe a finding is wrong, tell us and it's reviewed.
We fixed something. When does it disappear? At the next collection that no longer observes the weakness. Ciphren counts a finding as fixed only when it sees an upgrade from the affected version. A finding that simply stops appearing is reported as no longer observed, not verified, because it may have been patched, retired, or just not reached (chapters 4 and 9).
Why is a finding "not confirmed"? Most findings come from the version a system announces, which is strong evidence but not proof. Confirmed means the exact build was compared against the fixed build (chapter 2).
About your data
Where is Ciphren hosted? On Oracle Cloud Infrastructure (OCI). The AI features use Amazon Bedrock (chapter 10).
Who owns the data? The observations Ciphren collects (what your systems show the internet, and the news about your sector) are Ciphren's intelligence, which you're licensed to use. Anything you give us, such as your setup and your requests or corrections, remains yours.
How long is data kept? As set in your agreement. The longer collection runs, the more history Ciphren can show: trends, patch cadence, and how quickly exposure is dealt with.
Can the application be used to reach our network? No. The application only receives data, one way, and never connects to your systems or to the collection (chapter 1).
Who can see what inside our instance? Each person sees only what their access level allows, and every action is recorded in the audit log (chapter 12).
About connecting it to other tools
Does it integrate with our ticketing system or SIEM? Not directly today. You can export findings as CSV (chapter 4), and API tokens give scripts read access to your data where your policy allows it (chapter 12).
Can we run it without the AI features? Ask us about your deployment. The hosted demonstration runs with them off and shows saved examples instead (chapter 10).
Start with thirty minutes