See every device.
Prove every claim.
Breakwater is a discovery-only command center that builds an evidence-backed picture of everything connected to your network — then explains how it knows.
Product guide
Discovery you can audit, line by line
Every asset opens into an evidence-backed passport: what it is, how confident we are, and what supports that read. Explore the full product guide for each capability.
Discovery
A repeatable, simulator-backed sweep across IT, IoT, OT, cameras, printers, servers, and unknown devices — with summary metrics that are clickable workflow shortcuts.
Open product guide →Evidence chain
Confidence is not a magic number. It is built from DNS, SMB, HTTP, RTSP, MQTT, Modbus, BACnet, mDNS, SNMP and ARP signals — each with a raw excerpt and reasoning.
Open product guide →Collectors
Real discovery runs through an authorized local collector inside a network you own. The cloud receives evidence — it never scans private LANs from AWS.
Open product guide →AI / MCP, read-only
Claude and ChatGPT connect over MCP with OAuth and a read-only discovery scope. The AI is evidence-bound: it explains what Breakwater knows, never invents scans.
Open product guide →Reports
Turn discovery data into customer-ready artifacts — inventory, review queue, evidence and topology — clean for executives, detailed for operators.
Open product guide →Topology
A group-first explorer maps subnets, classes and trust boundaries so operators understand structure before they triage the inventory table.
Open product guide →Security by design
A layered, evidence-bound threat model
Breakwater is discovery-only and read-only by design. The trust boundary is the product: the hosted service receives evidence, the local collector performs bounded discovery, and nothing scans private LANs from the cloud.
Methodologies applied
- Read-only MCP scope (
breakwater.discovery/read) — no exploitation, offensive actions, or remediation. - Evidence-bound AI that cannot invent scans or bypass operator authorization.
- No scanning of private LANs from the cloud — bounded, authorized local collectors only.
- Privacy modeled with LINDDUN; data-flow diagrams with explicit trust boundaries.
Each layer maps STRIDE/PASTA/LINDDUN threats to attack trees, detection coverage, and the OWASP Top 10 — with validation artifacts required at every step.
Live demo
Explore a pre-loaded industrial environment
Sign in with Google for instant access to a sample discovery run — then connect a local collector to discover the real devices on your own network.
Sign in with Google Sample run now · connect a local collector for real discovery