The loop
Detect → Attack-test → Defend → Contain → Attest → Deploy → Distribute.
Product line
THIRE Control Plane
ActiveDefense
The seven containment layers (L1–L7). Loopback-only; never exposed.
THIRE Cognitive Defense
ActiveAI
Six engines protecting the internal behavior of building/AI agents: RouteGuard, ChainScope, CrossTrace, DriftShield, ActionGuard, LatentScope.
THIRE Oracle
ActiveVuln
Hash-chained evidence ledger / Audit-of-Record. Optional external anchor; no consumer token.
THIRE Red
ActiveVuln
Governed adversarial validation. Every engagement runs inside a signed scope contract; no standing targets; outputs are evidence, not actions.
THIRE RF/OT
ActiveDefense
Assessment of the RF surface of BAS/access/energy devices — Zigbee, Z-Wave, BLE, WiFi, sub-GHz SDR. Authorized targets only; transmission off by default.
THIRE Sentinel
ActiveDefense
Browser/endpoint edge for facility staff: operator-safe warnings and a benign field-telemetry shim. No token gating.
THIRE Console
ActiveAI
Customer portal — public, read-only, intake-only. Never executes. Accessibility-first; machine-readable.
THIRE Ops Console
ActiveVuln
Fleet telemetry, install/retention stats, distribution reporting.
THIRE Appliance Pipeline
ActiveDefense
One image → edge Pi ↔ Azure/AWS/GCP/VirtualBox. Guarantees edge↔cloud parity.
THIRE Field Kit
ActiveDefense
Portable assessment nodes (Pi 4B). Edge sensor or field assessment node.
Domain threat model
| Surface | Threat | THIRE response |
|---|---|---|
| BMS/BAS (BACnet/Modbus/KNX) | agent writes a setpoint out of the safe band | L2 actuator contract + L6 HITL + Oracle attest |
| Access control (OSDP/Wiegand) | agent unlocks a door on injected instruction | L5 injection control + L6 + risk class |
| Energy / metering | falsified load / demand-response abuse | L1 scope + L7 attestation |
| Cameras (ONVIF/RTSP) | agent exfiltrates video | L3 egress + L4 secret isolation |
| Elevators / lifts | unauthorized command | L6 + physical risk class |
| Tenant services | cross-tenant reach | tenant-data boundary |
| RF field devices | forged radio command | RF boundary + assessment |
Non-goals
- Not a token, not a wallet, not a dApp protector.
- Not a general ASM/DAST scanner — THIRE Red is scoped, governed, evidence-producing.
- Not a building-control system — THIRE governs the agents that touch BAS; it is not BAS.