LONDON, 29 September 2026 — Klarvant, named by the UK Government among the partners expanding the Government Cyber Unit’s Vulnerability Monitoring Service, today announced a significant expansion of Namespace Command, the platform it builds for governing an organisation’s external digital estate.

Since the platform went live in April, Klarvant has added a connected ontology that models an organisation’s external estate as a single system rather than a list of assets, an automation layer that acts on changes rather than only reporting them, continuous CVE intelligence with exploitation context, and machine-to-machine access allowing customers’ own AI systems to query the estate directly. An agent-to-agent implementation is now available in the Google Cloud agent marketplace.

The UK Government published on 2 July 2026 that it is working with partners including Detectify, Hardenize and Klarvant to expand how the Vulnerability Monitoring Service identifies DNS, configuration, email and web content issues. The service covers more than 6,000 public sector organisations, with more than 1,300 signed up for active scanning.

Klarvant’s commercial clients operate in energy, aviation, telecommunications, banking and pharmaceuticals. More than 70 per cent of its enterprise clients are constituents of a leading national stock index. Together with central government, that places Klarvant’s client base inside six of the thirteen sectors the UK designates as critical national infrastructure.

Namespace Command discovers an organisation’s complete external digital footprint across nine surfaces without software installation, API keys or privileged access. It then models the estate as a single connected system, establishes accountable ownership for every asset and finding, orchestrates the workflows that resolve them, and produces continuous audit evidence against NIST CSF, ISO 27001, SOC 2, CIS Controls, HIPAA, GDPR and customer-defined frameworks. Organisations of this size are audited on whether a finding was closed and by whom, which is a harder question than how many assets they can list.

“Working at the scale of a national government changes what you build. You cannot ask thousands of organisations to install software, and governance that depends on a person reading a dashboard does not survive contact with an estate this size. So this year we moved from reporting to orchestration: the platform watches for change, routes it to whoever owns it, and lets our clients’ own AI systems query the estate directly. Finding problems was never the hard part. Governing what you find is,” said Luis Novella, chief executive of Klarvant.

Klarvant is a global, remote-first company with its registered headquarters in London.

Notes to editors

Primary source for the UK Government engagement. The Vulnerability Monitoring Service expansion naming Klarvant was published by the UK Government at security.gov.uk on 2 July 2026 and updated on 14 July 2026. Klarvant has worked with the Government Cyber Unit since the company’s early operations. The 6,000 and 1,300 figures describe the coverage of the Vulnerability Monitoring Service, not Klarvant’s own client count.

On client confidentiality. Klarvant names clients only with their consent. Where a client is named on klarvant.com or in a Klarvant release, that client has agreed to be named. The UK Government engagement is named because the UK Government published it. Klarvant does not otherwise disclose the identity of its clients.

Images. The Klarvant logo pack and leadership headshots are available at klarvant.com/media-kit.

About Klarvant

Klarvant is a digital governance intelligence company that protects the digital identities of high-reputation organisations. Our platform, Namespace Command, delivers orchestrated digital governance: it uncovers an organisation’s complete digital footprint from day one, without installing software or requiring access to internal systems, connects it into one living model of the external ecosystem, and governs what it finds through accountable ownership and workflows you define. Klarvant’s clients are G7 governments and multinational enterprises, most of them constituents of a leading national stock index. Govern your namespace.

The canonical version of this release is published at klarvant.com/news/namespace-command-adds-automation-and-machine-access/.

Media contact

Ricardo Novella, Chief Marketing Officer, Klarvant
hello@klarvant.com
+44 20 8080 9984

Ontology: the model arrives built

A pre-built, continuously refreshed connected model of the organisation’s external digital ecosystem: 26 object types across four provenance rings (Observed, Enriched, Derived, Asserted), 20 relationship types, and explicit provenance on every element. Populated from day 1 by the platform’s own external observation; there is no modelling engagement.

Apps: no-code automation with Slack and Jira built in

A drag-and-drop App Composer with 8 building-block types, 6 trigger types and 12+ ready-made templates. AI can draft an App from a plain-language description. Apps notify and act across five channels: intelligence feed, in-app, email, Slack and Jira, both built in. Every action is recorded in the App actions ledger with timestamp, App, action, target and outcome.

MCP for AI assistants, alongside A2A

Eight read-only MCP tools with an OAuth sign-in flow, so an AI assistant such as Claude can answer questions grounded in the organisation’s live estate. Nine published A2A agent skills on the open Linux Foundation standard cover the same ground for deterministic automation, plus a conversational analyst skill. Both are consumption interfaces only: read-only, per-organisation, off by default. Neither can modify data in the platform. Acting on what the platform finds is the job of Apps, which run inside the platform under the same isolation and record every action in the App actions ledger.

Framework-agnostic compliance reporting

The compliance engine is framework-agnostic. Controls can be evaluated against any framework, including a customer’s own internal policy, rather than a fixed supported list. NIST CSF, ISO 27001, SOC 2, CIS Controls, HIPAA and GDPR remain recognised examples, not a ceiling.