When an attack lands, the system acts first, and every step stays auditable.
The government and critical-infrastructure edition of MIANGAI combines DNS security, mail defence, intrusion detection, edge coordination, runtime detection and baseline audit in one loop. Clear-cut attacks are handled inside written authority; anything beyond it escalates to a human.
Four field problems, first
Agency networks usually share the same pattern: scattered assets, noisy alerts, slow response and thin evidence.
Scattered assets & entry points
Websites, mail, APIs and remote access sit in different systems. Nobody can state the full exposure in one pass.
Mail gateways under pressure
Phishing, spoofed senders and SASL probes keep hitting the gateway. Probes that disconnect early never reach the failure logs older filters rely on.
Alerts that stop at notification
Detection fires, then blocking, isolation and re-verification wait in a human queue while the attack window stays open.
Audit evidence in pieces
Response reasoning spreads across logs and chats. Reviews cannot reconstruct who changed what, or when.
System make-up
Each layer deploys on its own. Together they close the loop.
DNS & mail defence in depth
Local recursive resolution with list coordination, sender-policy checks, gateway screening, authentication-probe detection and rate governance.
- Local recursive resolution, coordinated lists
- Sender policy checks: SPF, DKIM, DMARC aligned
- Gateway screening and disconnect-probe detection
- Connection and sending rate governance
Detection & automated blocking
Community-intelligence intrusion detection, authentication-attack jails, edge WAF coordination and IP response, all written to an audit chain.
- Community-intelligence intrusion detection
- Authentication-attack jails, set and released automatically
- Edge WAF and IP response in coordination
- Every action written to the audit chain
Host & runtime detection
Malware scanning, runtime threat detection, file-integrity baselines and host security audit, with baseline drift queued for re-verification.
- Malware scanning and runtime detection
- File-integrity baselines and drift alerts
- Host security audit baselines on file
- Drift queued for re-verification automatically
Response console
Assets, alerts, authority scope, response records and monthly re-verification reports in one workspace, visible by role.
- Assets and alerts on one screen
- Authority scope and escalation on display
- Response records open by role
- Monthly re-verification reports archived
How the platform connects
Defence is not sold as an island.
Threat-intelligence feed
The situational core supplies public threat and event data, cross-checked against local alerts.
ONE managed operations
Monitoring, response and re-verification run on the operations foundation. High-impact actions keep human approval.
Institutional identity
Institutional One ID separates who can change policy from who can approve a response, with access logged.
Delivery & deployment
Start with one real-environment deployment and audit re-verification, then set the managed scope. Every step leaves something you can inspect.
Asset inventory
List domains, mail, hosts, edge and remote entry points. Draw the exposure first.
Deliverables: the asset and exposure inventory, and an entry-point map.
Baseline deployment
Deploy detection and policy against the client environment, reconciling legacy rules one by one.
Deliverables: the deployment record, a policy crosswalk, and a disposition for every legacy rule.
Controlled exercise
Test detection, blocking and rollback with probes and replayed samples. False positives are recorded separately.
Deliverables: the exercise report (hits, latency, false positives) and the rollback verification record.
Acceptance & operation
After the baseline passes re-verification, go live into managed operation or hand over to the client team.
Deliverables: the acceptance sheet with the four checks, and a managed-operation plan or handover list.
- Sensors and agents sit inside client infrastructure. The console can run on approved cloud, customer premises or a dedicated network.
- System supply, implementation and managed security operation can be contracted separately.
- Acceptance checks four things: detection hits, response time, false-positive record and audit-chain completeness.
Compliance & authority limits
Automated defence is fast because the authority is written down first.
Response inside authority
Block targets, durations and escalation conditions are fixed in writing before launch. The system does not widen its own scope.
Supply-chain screening
Equipment and component lists are screened line by line against Section 889. Listed vendors stay out of the design and out of our own estate.
Data minimisation
Defence logs are retained and exported under client policy. Access is role-based; third-party sharing needs client approval.
Review cooperation
Project reviews receive the system architecture, component inventory, sample response records and the baseline re-verification method, checked item by item with the client.
Questions, answered
Does the system block on its own, and what if it blocks wrongly?
It acts only inside written authority, and stops at the line. Block targets, durations and escalation conditions are fixed before launch. Every action lands on the audit chain, false positives are recorded separately, and a policy that fails re-verification rolls back.
Where does it run, and does our data leave our premises?
Sensors and agents run inside your infrastructure; data stays under your policy. The console can run on approved cloud, on your premises or in a dedicated network. Log retention and export follow the contract, and third-party sharing needs your approval.
How does it sit with the security tools we already run?
Inventory first, align second, replace only where it conflicts. Baseline deployment reconciles legacy rules one by one: what can coordinate is connected, what conflicts gets a written disposition before replacement, and the whole change stays on record.
How is the supply chain kept compliant?
Every equipment and component line is screened against Section 889. Listed vendors stay out of the design, the delivery and our own estate. The component inventory carries versions and sources, checked item by item during project review.
What does acceptance actually check?
Four things: detection hits, response time, false positives, audit-chain completeness. A controlled exercise comes first; all four checks pass before the system moves into operation, and the conclusions land on the acceptance sheet.
How is it priced?
Scope first, then a written quote. No prices are published. Send the asset scope and your current security tool list. The first reply covers the deployment route, the authority limits and the acceptance checks; the formal quote follows once scope is confirmed.
Where to next
Trust & compliance
Deployment models, data sovereignty, security operations, supply-chain screening and use limits, in one place.
National intelligence network
Defence needs intelligence feeding it. The public-source awareness graph is the other half.
Start with one environment audit
Send the asset scope and the current security tool list. The reply covers deployment route, authority limits and acceptance checks.
