Enterprise control plane

Per-app egress control
at enterprise scale.

Every device runs the same NetInsightPro agent. What changes by tier is where your admin surface and audit data live — our cloud, your VPC, or fully air-gapped. Pick the trust boundary that fits your security model.

Book a scoping call Preview admin console

From £25,000/yr · 100 seats included · scoped to fleet

All tiers run the same bit-identical client binary.

Compliance & platform supportSCIM 2.0SAML SSOOIDCBYOKOCSF auditWindows Server 2022Ubuntu LTSRHEL / RockymTLSEd25519-signed digestsTLS 1.3

What existing tools miss at scale

The problem

Firewalls block ports — not 10,000 apps across a fleet

SIEM shows network noise; per-app attribution requires expensive DPI

Multi-tenant BYOK and air-gap requirements ruled out by cloud-only vendors

On-prem requirements mean custom build or compromise on visibility

How NetInsightPro closes it

Kernel-level per-app tagging: WFP on Windows, Netfilter on Linux, VpnService on Android

Admin console + policy engine scales to 10,000+ devices without custom infrastructure

BYOK on Hybrid / Private — your KMS, your keys, your data

Private tier: full control plane in your VPC or air-gapped network

Platform features

Eight enterprise capabilities. One agent.

Admin console

Tenant admin UI for bulk key provisioning, SSO configuration, fleet policy push, and per-seat remote revoke — all behind your existing IdP.

Tenant management

Multi-tenant isolation with OU-scoped policy targeting. Off-board a user from your directory; the device licence revokes automatically via SCIM.

Policy engine

Signed egress rules distributed to the fleet. Allow/block per app, per destination CIDR, per port — or set a bytes-out threshold before flagging.

Real-time audit log

Immutable audit log: 90 days on Cloud, 2 years admin audit on Cloud, 7 years on Hybrid, custom retention on Private. Exportable as OCSF JSON.

SIEM forwarder

Push OCSF-formatted events to Splunk, Sentinel, Elastic, Chronicle, or QRadar via webhook (Cloud) or syslog-TLS to your on-prem collector (Hybrid/Private).

BYOK encryption

Customer-managed encryption keys for audit data at rest. Supply your AWS KMS, Azure Key Vault, or GCP KMS ARN — we never hold the key.

Hybrid telemetry

Raw flow records stream to your on-prem collector over mTLS. The cloud sees only Ed25519-signed daily digests. Your SIEM gets raw events; we never do.

SCIM auto-provisioning

Automated seat provisioning and de-provisioning from Okta, Azure AD, Google Workspace, or any SCIM 2.0-compliant identity provider.

Deployment options

Three shapes. One client binary.

Pick the trust boundary that fits your security model. The agent binary is bit-identical across all three tiers — licences come from the server, not the client.

CloudFully managed SaaSAdmin console and licence control plane hosted by NetInsightPro. Same client binary as Pro. Zero infrastructure to run.From £25,000/yr · 100 seats included · scoped to fleet— Hosted admin console— SSO via SAML 2.0 or OIDC— SIEM webhook + bulk provisioning— MDM silent install (Windows / Linux / Android)— 99.9% uptime SLA + dedicated CSM— 90-day raw event retentionHybridRecommendedSaaS admin · private data planeControl plane is ours; raw event data never leaves your VPC. On-prem collector runs as a container inside your infrastructure.Custom quote · Seat volume + collector— Everything in Cloud— On-prem event collector in your VPC— Raw events to your SIEM directly— BYOK — customer-managed encryption keys— Private CIDR allow-list on control plane— 7-year admin audit retentionPrivateAir-gapped · fully sovereignControl plane ships as containers into your VPC or air-gapped network. No third-party cloud dependency at runtime. Client binary is bit-identical.Custom quote · Unlimited seats— Everything in Hybrid— Control plane in your VPC or air-gap— Open-source stack — no cloud dependency— Quarterly security patch releases— Dedicated implementation engineer— Custom SLA, audit retention, and support tier

Buyer journey

From first call to rollout.

01Scoping call30-min technical intro. We map your fleet size, SIEM, IdP, and retention requirement to one of the three deployment shapes.
02Proof of value30-day pilot on up to 50 seats. Full capability set; we co-build one policy + one SIEM integration with your team.
03Quote + contractFixed annual price tied to seat count, retention tier, and SLA level. Standard DPA + MSA — redlines welcome.
04RolloutMDM silent install pushes the agent + licence to every device. SSO + policy engine go live the same day.
05OngoingDedicated CSM. Quarterly business reviews. Compliance pack available on demand.

Sample OCSF event forwarded to your SIEMNetwork Activity · Established (class_uid 4001)

{
  "class_uid": 4001,
  "activity_name": "Established",
  "time": "2026-10-02T09:41:07Z",
  "device": { "hostname": "ACME-WS-0142" },
  "actor": { "process": { "name": "updater.exe" } },
  "dst_endpoint": {
    "hostname": "cdn-dl.example.net",
    "location": { "country": "RU" }
  },
  "traffic": { "bytes_out": 8601230 },
  "unmapped": { "nip.anomaly": "ewma_11.4x" }
}

Illustrative · simulated data

Talk to enterprise sales.

Tell us your rough seat count, SIEM, and IdP. We'll respond within one business day with a deployment shape and a price. No spam. No gate on the first call.

Or email direct: sales@netinsightpro.com