TrustGuardā¢ Continuous SCM, CSPM & Drift Remediation Actuator
TrustGuard continuously hashes and enforces golden security baselines across Azure cloud tenants, Plesk hosting fleets, Linux servers, and network firewalls. Eliminate silent configuration degradation with immutable pre-flight backup snapshots, a guaranteed 30-second automatic rollback, and closed-loop TrustBrain CISO human-in-the-loop approval gating.
A closer look
TrustGuardā¢ (:8091) is the continuous drift detector, pre-flight backup engine, and remediation actuator of the nTrust Sovereign Security Suite. It probes cloud, identity, and host configurations around the clock and discovers posture across all connected nTrust appliances via the standardized bi-directional /api/v1/agent/config contract.
Before executing any remediation, TrustGuard takes an immutable pre-flight configuration backup snapshot, requests CISO/SecOps Human-in-the-Loop (HITL) approval from TrustBrainā¢ for high-blast actions, and runs a 30-second post-execution health verification with automatic rollback if service reachability degrades.
š Live Portal & Sovereign Fleet Manager
TrustGuard is deployed and live at trustguard.ntrust.ai. Explore the interactive posture drift simulator, inspect pre-computed remediation playbooks, manage multi-tenant fleet isolation, and run the one-line installer for macOS, Windows WSL2, and Linux.
Visit trustguard.ntrust.ai →šØ Real-Time Threat Sentinel Radar
TrustGuard integrates directly with nTrust Threat Sentinel to ingest authoritative national feeds from Canada CCCS (cyber.gc.ca) and US CISA KEV. When critical zero-days (such as CCCS Alert AL26-026 PHP2Shell) are published, TrustGuard sweeps your estate, computes blast radius with TrustBrain, and stages 1-click remediation playbooks.
Learn About Threat Sentinel →What you get
SCM, CSPM & ISPM Drift Detection
Continuous golden-baseline hashing across Azure, AWS, GCP, Plesk, Entra ID, Keycloak, and Linux workloads.
Pre-Flight Snapshots & 30s Rollback
Captures an immutable pre-flight backup snapshot before every change and automatically restores state within 30 seconds if health probes fail.
Closed-Loop TrustBrain HITL Gate
High-blast infrastructure remediations are gated by TrustBrain CISO/SecOps approval tokens before actuation.
Universal /api/v1/agent/config Mesh
Discovers, audits, and heals configuration drift across all running nTrust appliances with license-bound tenant isolation.
Sovereign HostOps & Outbound Relay
Manage air-gapped and NAT-isolated nodes via Zero-Inbound Managed Egress Relay and Ephemeral Breakglass SSH.
Cryptographic Evidence Streaming
Streams SHA-256 signed drift and remediation receipts directly into TrustAuditā¢ for NIST CM-2/CM-6 and ISO 27001 A.8.9 proof.
Who itās for
- Security teams replacing point-in-time audits with continuous golden-baseline enforcement.
- DevSecOps & SRE teams requiring deterministic 30-second rollback guarantees.
- MSSPs and multi-tenant enterprises enforcing strict license-bound tenant mesh isolation.
- Organizations operating sovereign or air-gapped infrastructure.
Production Deployment & Technical Specifications
- Sovereign Deployment: 60-second 1-line installer for Docker & rootless Podman on port
:8091(macOS, Linux, Windows WSL2). - Universal Telemetry Contract: Bi-directional posture discovery & drift remediation via
/api/v1/agent/config. - Fail-Safe Actuation: Immutable pre-flight snapshots, 30-second automatic rollback verification, and TrustBrain CISO HITL gating.
- Air-Gapped & Fleet Ready: License-bound multi-tenant Fleet Manager and Zero-Inbound Managed Egress Relay for NAT/isolated networks.
Simple, transparent plans
Every plan includes continuous security checks, compliance monitoring and zero-trust controls. Prices shown are per month, billed annually.
- 5,000 security checks per month
- Core SCM/CSPM drift scanning
- Compliance monitoring
- Zero-trust controls
- 25,000 security checks per month
- Everything in Starter
- Policy-as-code & 30s auto-rollback
- On-premise deployment option
- Dedicated support channel
- Unlimited checks + API access
- Everything in Growth
- Multi-tenant Fleet Manager
- Zero-Inbound Outbound Relay
- Custom integrations & SLA
Questions about TrustGuard or sovereign fleet deployment? Contact our team and we’ll respond within one business day.
Deploy TrustGuardā¢ in 60 seconds.
Explore the interactive drift simulator at trustguard.ntrust.ai or deploy a sovereign node on Docker or Podman today.