The questions you would ask if you were not on a vendor call.

Stratus on a single VPC: under one hour. The platform image deploys behind a Gateway Load Balancer, routing is the only network change.

Shield OnPremise: half a day for rack, cable, IP assignment, and initial policy validation. Most evaluators start in Observe Mode before flipping to enforcement.

Endpoint: under five minutes per host. Bulk deployment via your existing endpoint management tool.

Yes. On Shield Stratus and Shield OnPremise. Observe Mode logs every decision the platform would have made without actually blocking. Review the would-be-blocks, validate against your environment, flip to enforcement when you are ready.

Shield Sentinel is passive-only by design and does not block under any condition. Shield Endpoint enforces at the host without an Observe Mode equivalent.

Minimal. Specifically:

• Stratus: route VPC or VNet traffic through the platform via Gateway Load Balancer or Azure equivalent.
• Shield OnPremise: inline placement at perimeter or core, or SPAN port for Observe Mode.
• Sentinel: SPAN or TAP port. Sentinel does not sit inline.
• Endpoint: agent install. No network changes.

AWS and Azure. AWS deployment uses Gateway Load Balancer; Azure uses the equivalent hub-and-spoke pattern. Stratus is the only Shield platform that supports per-direction inbound and outbound policy.

No. Shield is a complementary control. Shield handles reputation-based blocking; the firewall handles your policy and L7 inspection. They sit inline together with no conflict. Coexistence guides for next-gen firewalls are in the Reports & Assets library.

For inline platforms, deployment topology determines failure behavior. Most evaluators deploy in fail-open or active-passive configurations to avoid network impact during planned restarts.

Specific failure modes are discussed during the technical demo because they vary by topology. Sentinel is passive-only and has no inline failure mode.

By platform:

• Stratus: 1 Gbps and up, cloud-elastic scaling.
• Shield OnPremise: 10 Gbps line rate per appliance.
• Sentinel: up to 100 Gbps mirrored, passive only.
• Endpoint: per-host, agent-based, no network throughput limit.

For higher cumulative throughput, deploy multiple platforms rather than oversubscribing a single appliance.

Sub-ms for the reputation lookup and decision, yes. Specific latency budgets vary by deployment topology and are discussed during the technical demo. Decisions are autonomous, with no round trip to a remote analytics layer or cloud verdict service. The dataset is loaded into the platform and matched at connection establishment.

Shield evaluates connection metadata. Not packet payload. The decision is identity-based: does the source or destination match a reputation entry? Encryption is irrelevant to that decision. Shield works against:

• Encrypted C2 channels
• TLS 1.3 with no SNI
• Custom protocols
• Zero-day payloads, when the destination is a known-bad host

Shield does not decrypt traffic and does not require decryption keys.

The 8.5 billion IP and DNS records are continuously refreshed by INTRUSION's threat intelligence operation. Built since 2001, the dataset has 20+ years of accumulated provenance. Refresh frequency and propagation timing are discussed during the technical demo.

72 hours of full evidence retention on-platform. Each blocked event includes 5-tuple metadata, reputation context, policy attribution, and microsecond timestamps. For longer retention, configure SIEM forwarding via Syslog (Shield OnPremise) or CSV/Excel export from Command Hub.

Reputation entries are destination-specific. A clean destination is not flagged because of pattern similarity to a bad one. The 8.5 billion entries are categorized, time-stamped, and tied to provenance: where the entry came from, what it has been observed doing, when it was last seen.

That structure means false positives are rare relative to behavior-inference systems. When they do occur, allowlist entries take effect within the platform refresh cycle.

Open the event log in Command Hub, click the event, review the forensic record, add the destination to the allowlist. Per-platform or global. The change takes effect within the platform refresh cycle.

For high-volume legitimate destinations, work with the technical team during the POV to validate the allowlist before flipping from Observe Mode to enforcement. This is the most common reason to run the 10-day Standard POV instead of the 7-day Express.

Yes. Each threat category (C2, botnet, scanning, DNS, recon) can be enabled or disabled at the platform level. For finer control, suppression can be scoped to specific source IP ranges. Configuration lives in Command Hub.

No. Shield blocks rather than alerts. There is no alert queue, no alert prioritization, no urgency scoring. Every blocked event is logged with full forensic context, which means the answer to "why" is one click away when someone asks. The volume of blocks does not translate to volume of analyst work.

Shield OnPremise supports Syslog forwarding for SIEM ingestion. Command Hub supports CSV and Excel export for filtered or full event sets. SIEM forwarding is configured per deployment. JSON, CEF, and direct API integrations are not currently offered.

No exposed public API today. Programmatic access is on the roadmap; specific timing is discussed during the technical demo.

Not currently. Local accounts with role-based access (Observer, User, Administrator) per group. Shield Endpoint supports Entra ID, but only for activation, not for Command Hub authentication.

Not currently offered. For downstream automation, forward events via SIEM and orchestrate from there.

No. Shield is a complementary network-layer reputation control. EDR sees the endpoint behaviorally; Shield sees the wire identity-wise. Firewall handles your policy and L7; Shield handles reputation. The categories cover different threat surfaces, and most evaluators run all three.

If your evaluation criteria is full SOC tool replacement, Shield is not the right fit for that requirement.

FedRAMP, GSA Schedule, and SOC 2 are in active certification process. ISO 27001 is not currently in scope. GDPR and HIPAA do not apply because Shield does not process regulated data as part of its operation; it is excluded from these frameworks rather than compliant with them.

For procurement processes that require these certifications, talk to the team about timing for current roadmap items.

No. Sentinel is monitor-only and operates independently. It does not use the threat intelligence dataset and does not integrate with Command Hub. Three platforms enforce. One watches. They do not share a console.

If your evaluation requires unified passive monitoring and inline enforcement in one console, plan around the Stratus, Shield OnPremise, and Endpoint family.