Complete discovery platform
From live run monitoring and topology mapping to asset triage, evidence review, and AI-assisted analysis — every discovery workflow has a dedicated workspace.
Customer product guide
Fourteen guided workspaces. One discovery run.
Every workspace ships with a looping video guide, an interactive spotlight tour, and per-panel AI analysis. Breakwater turns authorized local collector evidence into a complete discovery platform for network security teams.
Every identity claim has a source
Device class, vendor, protocol, firmware, and confidence score are tied to method-specific evidence collected by an authorized local collector inside the customer network.
Video strip, tour, and AI
Each workspace ships with a looping video walkthrough, an interactive spotlight tour with keyboard navigation, and a one-click Ask AI button primed with the current panel context.
What ships today
- Fourteen workspaces, each with a collapsible video guide, interactive spotlight tour, and contextual Ask AI integration.
- Authorized local collector with signed policy, nonce replay protection, schema validation, and evidence attestation.
- Google OAuth website login with allow-list access control and per-session audit trail.
- MCP integration for Claude and ChatGPT — read-only evidence summaries, topology explanation, and review queue access.
- Evidence-backed identity: class, vendor, protocol, firmware, confidence score, and unresolved questions per asset.
- Discovery-only boundaries: the hosted cloud service does not scan private LANs, execute exploits, or perform later-phase analysis.
Summary
Run overview, five stat cards, three action items, and the discovery timeline.
Topology
Canvas-based network map with subnet clusters, VPN/OT/IT grouping, confidence overlay.
Asset Inspector
Guided and expert evidence passport. Identity path, confidence score, unresolved questions.
Inventory
Searchable, filterable asset table with class and confidence filters.
Review Queue
Impact-ranked unknown assets. Evidence review and one-click resolution.
Collectors
Enrolled collector agents, live status, enrollment token, version tracking.
Reports
Executive summaries, operator review packets, and technical evidence appendices.
History
Run comparison and trend analysis across discovery runs.
Live Run
Real-time event stream and discovery grid while a collector run is in progress.
Settings
Collection mode, retention policy, secret redaction, default scan profile.
Results Explorer
Evidence graph with node grouping modes and detail inspection.
AI / MCP
Predefined AI analysis templates and MCP tool listing for connected AI assistants.
Export
Filtered CSV and JSON exports with full evidence chain and source provenance.
This Device
Local collector environment: host identity, network interfaces, running services.
Every workspace is a guided experience.
Each of the fourteen workspaces ships with three layers of in-product guidance: a looping screencast strip demonstrating the workflow, an interactive spotlight tour walking analysts through each control step by step, and a contextual Ask AI button that primes any AI assistant with the exact evidence and run state visible on screen.
Three layers on every panel
- Video strip — collapsible looping screencast per workspace, dismissible and localStorage-persisted per panel.
- Interactive tour — spotlight overlay with keyboard navigation (arrow keys, Escape) and step-by-step tooltips anchored to live UI elements.
- Ask AI — one-click prompt that sends current panel context (run ID, asset count, confidence, evidence count) to your AI assistant.
First screen for every run
Five stat cards (Assets, Changed, Review, Confidence, Signals) with click-through navigation. Three prioritized action cards. Discovery timeline with pipeline phase details. Posture banner clearly distinguishes simulator fixtures from authorized real-network runs.
Start with the map, not a spreadsheet
Canvas-rendered network map that groups devices into subnet clusters. Clusters show device class distribution, confidence distribution, and review state at a glance. Click any cluster to filter the inventory and open related asset evidence.
Searchable, filterable asset table
Full-text search across device names, IPs, and discovery paths. Class and confidence filters. Confidence badges (HIGH / MED / LOW) with both color and text encoding. Per-row inspection opens the asset drawer without leaving the table.
Watch discovery happen
Real-time event log streams collector output as it arrives. Discovery grid populates with found assets as each pipeline phase completes — useful during active runs or for reviewing what a collector found and when.
Track what changed between runs
Timeline of completed discovery runs. Compare any two runs to see new assets, removed assets, and changed identities. Trend charts show confidence and asset count over time.
Evidence graph
Visual graph of discovery evidence relationships. Grouping modes organize by class, subnet, confidence level, or protocol. Detail panel shows the full evidence chain for any selected node.
Triage the unknowns first.
The Review Queue surfaces every device Breakwater could not fully identify, ranked by impact. Each card shows available evidence, the confidence score, and the specific question the system could not answer. Analysts resolve items one at a time, with the full evidence passport one click away.
Impact-ranked unknowns
- Every low-confidence or unresolved device surfaces automatically.
- Cards rank by impact — devices on sensitive segments or with partial protocols appear first.
- Resolution records who reviewed, what decision was made, and when.
- Resolved items clear from the queue; the count updates in the Summary stat card in real time.
For the first look
Guided view shows identity (class, vendor, model), address (IP, MAC, hostname), location fields (owner, site, rack), confidence score with contributing factors, and unresolved questions that explain why confidence is below 100%. Designed for operators making a quick triage decision.
For deep investigation
Expert view shows the raw evidence chain: every protocol response, banner string, service fingerprint, and probe result that contributed to the identity claim. Engineers can independently verify every field by tracing it to its source observation.
How Breakwater got there
The identity path strip shows the sequence of discovery phases that contributed to the final identity claim — active probing, passive observation, banner parsing, protocol fingerprinting. Each step links to its evidence record.
What the score means
Confidence is a weighted aggregate of identity method quality. Passive observation scores lower than active protocol response; vendor match from a banner scores lower than cryptographic certificate match. The score reflects evidence strength, not just observation count.
Private network discovery stays local.
A self-contained collector binary runs inside the authorized network boundary. It communicates outbound only — the hosted cloud service never reaches inbound into customer infrastructure. The collector signs its output with a bounded policy before uploading, so the cloud verifies scope, expiry, and integrity on every ingest.
What stays on premises
- All active probing, passive listening, and device contact occurs on the collector host inside the customer network.
- Raw packet captures and full protocol transcripts never leave the network — only structured evidence records are uploaded.
- The cloud cannot initiate a scan, modify scope, or contact customer devices directly.
One-time token onboarding
The Collectors workspace generates a one-time enrollment token. The collector binary authenticates using the token on first contact, establishes a persistent identity, and appears in the workspace. No shared secrets remain after enrollment.
Bounded uploads
Every collector run requires a signed policy specifying the authorized scope (CIDR or allowlist), expiry time, nonce, and tenant. The cloud verifies the policy signature, rejects expired or replayed nonces, and checks that uploaded evidence matches the authorized scope.
Evidence integrity
Collector reports include a checksum and schema version. The cloud validates schema conformance, checksum integrity, and evidence size bounds before writing to the run store. Malformed or oversized payloads are rejected with a specific audit event.
Binary trust
Collector binaries are distributed with checksums and build provenance metadata. The Collectors workspace shows the enrolled version and flags version drift. SBOM and SLSA provenance targets are on the assurance roadmap.
What the cloud receives from a collector run
- Structured evidence records: device class, vendor, protocol, firmware, address, and confidence — no raw packet captures.
- Identity path metadata: which discovery phases contributed to each identity claim.
- Run metadata: start time, end time, scope hash, phase timing, event count.
- Policy reference: the policy ID and scope the collector was authorized to use.
AI analysis that is evidence-bound by design.
The AI/MCP workspace ships predefined analysis templates for common security workflows: plain-English change summaries, unknown device triage prompts, confidence-gap analysis, and protocol anomaly investigation. Every template is pre-populated with the current run's evidence count, confidence average, and asset summary.
Context-aware on every screen
- Every workspace has an Ask AI button that sends the current panel state to your AI assistant.
- Context includes: run ID, asset count, evidence count, confidence average, active filters, and panel-specific data.
- Works with Claude, ChatGPT, and any AI assistant that accepts system-primed prompts.
Read-only discovery tools
Breakwater publishes a Model Context Protocol server exposing discovery evidence as read-only tools for connected AI assistants. The MCP server is evidence-bound: it returns structured summaries, topology explanations, and review queue items — not credentials, scan parameters, or device-write actions.
Common security workflows
Ready-made templates include: summarizing what changed in plain English, identifying unknown devices by protocol signature, explaining evidence behind a confidence score, finding devices spanning multiple network segments, and generating a management-ready posture summary.
AI sees what you see
The AI workspace shows exactly what context is passed to the AI: confidence average, evidence record count, run identifier, and freshness. Analysts always know what data the AI is reasoning about before sending a prompt.
Adversarial evidence handling
Device names, hostnames, and protocol banners from the network may contain adversarial content. Breakwater's MCP tools return evidence as structured data, not free-form strings, and the MCP policy enforces read-only access so injected instructions cannot trigger write actions.
MCP tools available to connected AI assistants
- get_run_summary — latest run metadata, asset count, confidence average, evidence count, and phase timing.
- get_assets — asset list with class, address, vendor, confidence, and review state for the latest run.
- get_evidence — evidence records for a specific asset, including source, method, and raw observation.
- get_review_queue — current unresolved items ranked by impact, with evidence summaries.
- get_topology — subnet groupings with device count and confidence distribution per cluster.
Trust boundaries are product behavior, not footnotes.
- The hosted cloud service does not scan private networks, customer LANs, or any IP range not authorized through a local collector policy.
- Real discovery requires an explicit scope allowlist, a time-bounded signed policy, and a local collector operating inside the authorized network.
- MCP remains read-only: evidence summaries, topology explanation, and review queue items only — no scan execution, device writes, or remediation actions.
- Later-phase capabilities — path analysis, exploitation, remediation, autonomous offensive testing, and lateral movement simulation — are outside the scope of this discovery release.
- Simulator-backed demo data is clearly labeled on every screen. Operators cannot mistake simulator fixtures for real network observations.
Authorized cloud actions
- Receive signed evidence uploads from enrolled collectors.
- Serve the discovery workspace to authenticated operators.
- Publish read-only MCP tools to connected AI assistants.
- Issue signed collector policies within authorized scope.
Hard boundaries
- Initiate scans, probes, or active contact with customer devices.
- Accept unsigned, expired, replayed, or out-of-scope collector uploads.
- Expose discovery evidence to unauthenticated requests or cross-tenant queries.
- Execute MCP write tools, device-write actions, or remediation steps.
Authorized collector actions
- Perform authorized active and passive discovery within the signed policy scope.
- Collect and structure evidence into typed records with schema validation.
- Upload signed evidence to the cloud after the run completes.
Hard collector limits
- Exceed the scope defined in the signed policy.
- Upload without a valid, unexpired, non-replayed policy token.
- Execute remediation, exploitation, or lateral movement actions.