NatMesh is an offline-first, multi-vendor network configuration auditor for defense, finance, and DevSecOps teams. Drop a config in. Get back a CVSS-scored, compliance-mapped, auditor-ready finding report — without a single packet hitting your network.
No agents. No SNMP polling. No credentials. Drop the exported config and the engine identifies vendor, walks every rule pack, and writes a finding with CVE, CVSS, STIG, and remediation in seconds.
Every finding lands with four independent scores. CVSS for severity, STIG CAT for DOD posture, Cisco SIR for vendor alignment, and a 0–100 composite weighted by device role — because the same misconfig on a border firewall is not the same risk as on an access switch.
Per-finding base, temporal, and environmental scores. Standard, defensible, and machine-parseable for SIEM ingestion.
Maps every finding to Category I/II/III against the relevant DISA STIG. Drops directly into your RMF package.
Cisco Security Impact Rating for Cisco platforms — speaks the vendor's own language so PSIRT advisories line up cleanly.
Our 0–100. Same misconfig scores higher on a border firewall than an access switch, because exposure context is the whole point.
Per-control pass/fail with evidence generated automatically. Hand the PDF to a QSA, an Authorizing Official, or a CMMC C3PAO and they read it the way they already think about your network.
Every finding maps to a STIG Vul-ID with severity and CCI references. RMF-ready evidence package out of the box.
Dedicated 10-rule pack written against the v4.0 final standard. QSA-grade prose evidence with control numbers.
14 dedicated CMMC rules tied to the assessment objectives every DIB contractor will see during a C3PAO walkthrough.
Control families tagged on every rule. Direct evidence into FedRAMP, FISMA, and StateRAMP assessment packages.
Center for Internet Security control numbers attached to every rule for cross-walk with audit programs.
Detects every Cisco password type (0, 5, 7, 8, 9) and grades against the 800-63B memorized-secret guidance.
A port scanner reads what's open. NatMesh reads what's written — and what's been written for the last twelve months. Segmentation posture, drift over time, and a tamper-evident chain of every scan you ever ran.
Every firewall, ACL, and zone policy is scored on a Zero Trust scale — implicit any-any, over-permissive egress, missing micro-segmentation all surface as ranked findings.
Local DuckDB keeps every scan. Compare any two runs and NatMesh shows you which findings were fixed, which regressed, and what's new since the golden baseline.
Every scan event is hash-chained to the previous. verify_audit_integrity() walks the chain and flags any break — even one altered byte.
Most online config auditors haven't meaningfully advanced in years. Here is the same feature list, side by side. Black bars are where the typical online solution has nothing to say.
On every modern capability — Zero Trust scoring, role-weighted risk, offline CVE correlation, SARIF/CI-CD output, drift detection, and a tamper-evident audit trail — the typical online solution has nothing to put in the column. We just shipped the next decade of the category.
The buyer doesn't change the engine. The engine changes the buyer's mandate. Defense contractors, payment-card teams, MSSPs, and DevSecOps all ship the same binary.
natmesh-cli is a single static binary. Add a step to your GitHub Actions or Azure DevOps pipeline. The same SARIF that flows into GitHub Security tab also lands in Defender, Sentinel, and any modern SIEM.
# Audit every config on push to main name: network-config-audit on: [push, pull_request] jobs: audit: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Run NatMesh run: | natmesh-cli scan \ --config ./configs/*.cfg \ --format sarif \ --exit-on critical,high \ --out natmesh.sarif - uses: github/codeql-action/upload-sarif@v3 with: sarif_file: natmesh.sarif
{ "ruleId": "natmesh.snmp-001", "level": "error", "message": { "text": "Default SNMP community 'public'" }, "locations": [{ "physicalLocation": { "artifactLocation": { "uri": "edge-fw-01.cfg" }, "region": { "startLine": 42 } } }], "properties": { "cvss": 9.8, "stig": "CAT-I", "cwe": "CWE-798", "natmesh-role-score": 87, "compliance": ["PCI-DSS 2.1", "STIG-V-220547"] } } # Pipeline summary ✓ scan complete: 1247 lines · 12 findings · 3 critical ✗ exit code 2: build blocked by critical findings
Pay once. The license file natmesh.lic binds to a machine ID and works forever on that workstation. No phone-home. No subscription meter. No SaaS dependency to lose when your contract changes.
One workstation. One operator. Everything an in-house security engineer needs to audit their fleet.
For MSSPs and consultancies. Five analyst seats, white-label reports, scheduled batch scans.
For defense primes, federal SI, and large financial. Unlimited seats. Custom rule packs. On-site enablement.
If something isn't here, ask. Engineers answer Engineering.
No. Zero telemetry. No license server. No update beacon. natmesh.lic is verified locally against the machine ID. The binary runs on air-gapped Class C networks without modification.
A curated KB of 22 high-impact real-world CVEs ships in the binary (CVE-2024-3400, CVE-2024-21762, CVE-2023-27997, CVE-2022-42475, CVE-2018-0101, and others). An offline NVD JSON cache lives at ~/.natmesh/nvd_cache/. The live NVD API is opt-in only.
Yes. Rules are pure YAML — prerequisite_patterns, required_patterns, negative_patterns, plus the narrative fields that flow directly into the report (checked_text, matters_text, impact_rating). No Python required to extend the engine.
Four parallel scores per finding: CVSS v3.1, DISA STIG CAT, Cisco SIR, and a NatMesh 0–100 composite weighted by the device's role in the traffic path. The same SNMP "public" community on a border firewall and an access switch produce very different role-weighted numbers.
Every scan event is hash-chained to the prior event. verify_audit_integrity() walks the chain end-to-end. A single altered byte anywhere in the history breaks the chain and is flagged.
natmesh-cli exits 0 on clean, 1 on info/low findings, and 2 on any critical or high finding. Drop it in CI with --exit-on critical,high and your pipeline will block the merge automatically.
Yes. The license file binds to a machine ID and is perpetual on that workstation. Annual maintenance is optional — and only buys you new rule packs and CVE updates. The engine you bought continues to run regardless.
Fifteen-day evaluation license. Drops onto one machine. No demos to sit through, no SDR to dodge — the binary just runs.