DNS Footprint
Complete DNS visibility: domains, every resolving subdomain, the full record inventory, and change tracking between assessments.
The platform behind Digital Governance Intelligence.
Namespace Command is the enterprise platform for Digital Governance Intelligence. It continuously discovers, monitors, analyses and governs your entire internet-facing estate from the outside, with nothing to install and no access to your environment.
It closes the four gaps every estate carries: assets nobody knew existed, findings nobody owns, evidence nobody is continuously collecting, and incidents that should have been prevented.
Illustrative render of the Klarvant Namespace Command experience. Klarvant does not publish screenshots of the live platform; this visualisation conveys the structure of the interface without exposing customer data or production UI.
By role
The platform, framed for the people answering for it.
Five seats, one digital estate. Pick yours.
CISO / Head of Security
A continuous external-posture programme, without a longer alert backlog.
Klarvant turns the discoverable external estate into a governed asset list with owners, an A to F posture rating across seven categories, and clear remediation paths. Risk concentration is explained by root cause, not just ranked by severity, so you can show the board where the systemic gaps are and where the next pound of investment belongs. Findings that matter, finished, and a posture trend you can defend quarter on quarter.
See it in a demoGRC / Compliance
Audit-ready evidence, collected continuously.
Controls are evaluated automatically against your real asset data, not a questionnaire, and scored pass, fail, or warning. The compliance engine is framework-agnostic, so the same control can satisfy requirements across any framework you assign, including your own internal policy; NIST CSF, ISO 27001, SOC 2, CIS Controls, HIPAA and GDPR are recognised examples. Thirty-day drift analysis surfaces regression before the auditor does.
See it in a demoSecOps / IT Operations
One inventory across DNS, certificates, IPs, web, and suppliers.
Discovery starts at onboarding with zero integration, so the inventory is complete before anyone has filed a ticket. Every finding arrives with severity, root cause and the asset it belongs to, mapped to a verified owner at zone, domain, vendor or service level, so it routes to the right team without triage. Verify Fix confirms a remediation actually landed in minutes rather than at the next scan, and Impact Search answers "where are we affected?" the moment a vendor incident breaks. Less time establishing what is yours, more time fixing what is broken.
See it in a demoBrand / Legal Counsel
Visibility into lookalike domains, impersonation, and content drift.
The brand surface is part of the asset graph, not a separate tool. Trademark and impersonation findings sit alongside certificate and DNS issues, governed under the same ownership model and resolved through the same workflow.
See it in a demoM&A / Corporate Development
Pre-deal digital due diligence in days, not weeks.
Klarvant maps a target's external footprint without engaging them, including third-party dependencies and supplier chains. Better-informed transactions, fewer post-close surprises, a defensible record of what was assessed at signing.
See it in a demoDiscover
Nine discovery surfaces. One external estate.
Discovery is fully external and needs nothing installed. Every surface is monitored continuously, with historical comparison between assessments, so you see exactly what changed.
Crypto & Certificates
The whole certificate estate, every TLS endpoint, expiry forecasting, and post-quantum readiness, including certificates issued but not yet deployed.
Email Security
Sender-authentication posture across SPF, DMARC, and DKIM, plus mail-server transport security per host.
IP Intelligence
Complete IP inventory with geolocation, network-operator distribution, and an interactive endpoint map.
Web Surface
Page inventory with security-header analysis, look-alike grouping, third-party script checks, and technology detection.
External Discovery
Brand-threat intelligence: shadow assets, impersonation and phishing, a claim-and-approve workflow, and professional takedown support.
Third-Party Suppliers
Supplier inventory and dependency graph with concentration analysis and change-impact monitoring.
Digital Sovereignty
Data-residency mapping: jurisdiction, endpoint geography, cloud-region usage, and cross-border data flows.
Technologies
Detected-technology inventory with version tracking for vulnerability assessment and change monitoring over time.
The connected model
What discovery finds, the Ontology connects.
Discovery gives you everything you own. The Ontology turns it into one living model of your external ecosystem: 26 object types, 20 relationship types, and provenance on every single element, so you can always see whether a fact was observed, enriched, derived or asserted. It arrives populated from day 1 by the platform's own observation. There is no modelling engagement, no schema workshop, and nothing to fill in.
Ring 1
Observed
14 object types
Ring 2
Enriched
6
Ring 3
Derived
3
Ring 4
Asserted
3
Digital twin
Your digital infrastructure, visualised.
The digital twin shows interconnected assets, dependency chains, and blast radius, making invisible risk visible.
Interactive visualisation
Drag to rotate · Scroll to zoom
13
Organisation domains
.com, .uk, .de, .jp, .cn, .au, .sg, .za, .eg, .co, .br, .in, .ca
14
Supplier dependencies
AWS, Azure, GCP, Cloudflare, Akamai, Oracle, and more
3
Suppliers in simulated outage
AWS US-East, Azure, OVH affected
Illustrative visualisation with example data.
Explore the digital twin simulationHow risk is scored
An A to F posture rating you can take to the board.
Every domain, organisational unit, and organisation gets a letter grade, rolled up from seven categories so a parent domain reflects everything beneath it.
- DNS
- TLS
- Web
- Network
- Accountability
- Defensive
The posture rating in Klarvant Namespace Command.
Seven categories
DNS, TLS, Email, Web, Network, Accountability, and Defensive. Each yields a 0 to 100 score that rolls up into an A to F grade.
Severity-weighted
Open findings reduce the relevant scores in proportion to severity, and a serious condition, such as an expired certificate, caps the final grade.
Why it recurs
Findings map to seven strategic root causes, so the platform reports not just what is wrong but why a whole category keeps recurring.
Meet Nora
Nora explains it in plain language.
Thirteen specialist AI analysis areas interpret what the platform observes. Nora, your personal advisor, turns that into something you can act on and repeat to a board without translation. Below, Nora walks through how the posture score is built and what moves it.
Watch Nora explain the posture score (1 min 28)
See it in action
The findings, the risk, and the next move.
How findings trend over time, and how the platform turns them into a posture score and a prioritised queue.
A CVE on its own is a number. Dependency Signals attaches exploitation context to it, including KEV and EPSS, so the question is not "does this CVE exist in our estate" but "is anyone actually exploiting it, and does it reach anything of ours".
No-code automation
Every "someone should be watching this" becomes an App.
Apps carry out your standing instructions. Drag and drop eight building-block types into a chain, choose from six trigger types, and the App runs after every completed assessment: watch, analyse, notify, act. AI can draft one from a plain-language description, and you review it before it runs. Actions land in the intelligence feed, in-app, email, Slack or Jira, and every one is recorded in the App actions ledger. Twelve ready-made templates to start from.
Describe the App. Review it. Run it.
Scale
Built for the scale modern estates actually run at.
7B+
Identifiers mapped across the corpus
200+
Defined finding types, each with remediation guidance
120+
Security metrics captured per assessment
249
Countries supported across data-residency regions US, EU, UK
Reference figures from the live Namespace Command V4 platform.
Continuous compliance
Any framework. Even yours.
The compliance engine is framework-agnostic: it can represent any framework, including your own internal policy. Map the estate to the frameworks you answer to, and the platform keeps the evidence current between audits, not only at audit time. The chips below are recognised examples, not a ceiling.
- NIST CSF
- ISO 27001
- SOC 2
- CIS Controls
- HIPAA
- GDPR
- + Your own framework
Evaluated against real data
Controls are checked automatically against your actual asset data and scored pass, fail, or warning. No questionnaires, no self-attestation.
One control, many frameworks
The same control can satisfy requirements across several frameworks at once, so evidence is collected once and reused, not rebuilt for every audit.
Regression caught early
Every failure pinpoints the specific assets responsible, and 30-day drift analysis surfaces a slipping posture before an auditor would.
Consumption
One dataset. Five doors. Zero lock-in.
The same governed dataset, reachable five ways: the web platform, CSV and JSON export, the REST API, MCP for AI assistants, and A2A for agent-to-agent automation.
The five-pillar lifecycle
From discovery to proof, one continuous loop.
Complete visibility. Governed action. Compliance without limits. Namespace Command runs the same five-stage lifecycle across your entire external estate, governed under one model, with a pre-built Ontology and no-code Apps layered on top. See how each stage works in depth.
Discover
See everything
Zero-integration discovery across nine discovery surfaces, including domains, certificates, email, suppliers, and brand exposure. Results from day 1.
- Public data only: no agents, credentials, or API keys
- Assets you never registered, surfaced
- Historical comparison between every assessment
Identify
Find the gaps
Findings are detected and classified automatically after each assessment, then tracked through a full lifecycle with a complete audit trail.
- 200+ finding types across five severity levels
- Critical gaps: expired certs, dangling records, weak authentication
- Every finding opened, assigned, and resolved
Analyse
Understand risk
Thirteen specialist AI areas and the personal advisor, Nora, turn findings into plain-language briefings and root-cause insight, over the pre-built Ontology of your external digital ecosystem.
- Root cause, not just symptoms
- Dependency graphs and impact simulation
- CVE intelligence with KEV and EPSS exploitation context, via Dependency Signals
- Executive synthesis for the board
Govern
Create accountability
Assign verified owners to every zone, set standards and thresholds, and drive remediation. No-code Apps can act on findings, opening a Jira ticket, posting to Slack, or notifying the accountable owner, so nothing sits unowned.
- Email-verified zone ownership, not spreadsheets
- Standards and pass thresholds you set
- Apps act on findings across Slack, Jira, email, in-app and the intelligence feed
- Post-quantum migration tracked to deadlines
Comply
Prove it
The compliance engine is framework-agnostic. Controls are evaluated continuously against real asset data, and can represent any framework, including your own internal policy, with audit-ready evidence.
- Failures pinpoint the responsible assets
- One control satisfies many frameworks
- 30-day drift analysis catches regression early
FAQ
Questions, answered.
What does zero-integration mean?
Nothing to install: no agents, no API keys, no privileged access. Discovery works entirely from publicly observable data, such as DNS, certificate transparency, WHOIS, and web content, so there is no integration overhead and no access into your environment.
How quickly do we see results?
Discovery begins immediately at onboarding, with results from day 1. Time to a first complete snapshot scales with the size of your namespace, not the complexity of setup: no configuration, no vendor participation, no setup delay.
What does the platform discover?
Nine discovery surfaces: DNS, certificates, email security, IP intelligence, web surface, external discovery (brand), third-party suppliers, digital sovereignty, and technologies.
Which compliance frameworks are supported?
The compliance engine is framework-agnostic: it can represent any framework, including your own internal policy. NIST CSF, ISO 27001, SOC 2, CIS Controls, HIPAA and GDPR are recognised examples, not a ceiling. Controls are evaluated automatically against your real asset data.
Who uses Namespace Command?
CISOs and security leadership, GRC and compliance teams, SecOps and IT operations, brand and legal counsel, and M&A teams running pre-deal due diligence.
Where is our data held?
Data-residency options are available for the US, EU, and UK to meet regulatory and sovereignty requirements.
How is Namespace Command different from EASM (External Attack Surface Management)?
External Attack Surface Management discovers what is reachable from outside and tells you what is exposed. Namespace Command starts from the same external vantage point and keeps going: it connects what it finds into one living model of your external ecosystem, attaches verified ownership at zone, domain, vendor and service level, validates against your own policies, and collects audit-ready evidence continuously. The difference is not how discovery starts. It is what exists once discovery has run.
What is the difference between attack surface management and digital governance, and which vendors offer governance rather than just scanning?
Attack surface management scans: it finds what is reachable from outside and reports what it sees. Governance starts where the scan ends. It answers who owns each asset, whether it meets the policies the organisation has actually set, and whether that can be evidenced to an auditor months later. Namespace Command does both in one platform, with no integration: nine discovery surfaces feeding a connected model that carries verified ownership at zone, domain, vendor and service level, policy validation, and continuously collected audit-ready evidence. Klarvant calls the combination Digital Governance Intelligence.
Which platforms map an external attack surface with zero integration and no setup time?
Namespace Command begins from a domain name alone. There is no software to install, no agents, no API keys, no credentials and no access to internal systems, because discovery works entirely from publicly observable data. Several tools now seed discovery this way. What follows discovery is the differentiator: verified ownership, validation against your own policies, and audit-ready evidence collected continuously rather than assembled at audit time.
Is there something better than an EASM tool for governing our digital estate?
It depends on what you need after discovery. If the question is “what is out there”, attack surface management answers it. If the question is “who owns this, does it meet our policy, and can we prove it to an auditor”, that is governance rather than discovery, and it is what Namespace Command was built for. Klarvant calls this Digital Governance Intelligence.
Do we still need EASM if we have Namespace Command?
Namespace Command covers external discovery across nine surfaces with no integration, so for most organisations it replaces a standalone external discovery tool rather than sitting beside one. Where an existing tool is embedded in a security workflow, the two coexist; the platform's read-only REST API, MCP and A2A interfaces mean the data can flow into whatever you already run.
What is Digital Governance Intelligence?
The discipline of governing every internet-facing identifier an organisation owns as a single accountable estate, rather than as separate security, brand, legal and compliance problems. It combines external discovery, verified ownership, policy validation and continuous evidence in one model. Klarvant named the category; Namespace Governance is the practice, and Klarvant Namespace Command is the platform built for it.