Trust needs more than a successful connection.

Identity, permission, and oversight.

Agent identity

Agents prove possession of identity keys when authenticating managed requests. Identity is not based on a hostname alone.

Device approval

An approval workflow lets an operator review newly enrolled devices before enabling managed operations.

Operator access

Server-side capability checks and device-group scopes govern access. Custom roles support different responsibilities within a team.

Sign-in controls

Configurable two-step sign-in supports email and authenticator verification, with recovery and remembered-browser controls. Effective protection depends on the configured policy.

Remote sessions

Authorized session workflows combine endpoint identity checks with encrypted communication between the viewer and agent.

Revocation

An operator can block an agent identity to deny subsequent authenticated activity. Revocation records are separate from the device listing.

Operational records

Audit views bring together recorded administrative activity, sign-in events, and session history. These support investigation without claiming a complete or tamper-proof record of every action.

Each layer has a job to do.

Encrypted session content does not remove the need to trust the management application, the operator’s browser, or the endpoint. Permissions, configuration, software delivery, and account protection all contribute to the system’s security.

Controls described here are implemented capabilities, not a guarantee for every deployment. Evaluating them includes checking configuration and exercising denied-access, disconnection, update, and recovery behavior in a defined test environment.

Read How CyberSector works for the public system overview. Detailed implementation and deployment information remain private.

Make the important behavior verifiable.

Technical reviewers and potential evaluators are welcome to discuss a scoped assessment. The goal is useful evidence about access boundaries, compatibility, and failure handling before expanding deployment.

Contact CyberSector to agree on a test environment and scope before conducting active testing. TestFlight beta access is arranged directly by email; agree on the scope separately before conducting security testing.

Report a concern directly.

Send suspected vulnerabilities or software-impersonation concerns to contact@cybersector.us. Include the affected component or page, observed behavior, and safe reproduction details when available. Please omit credentials, private keys, and unrelated personal data.

The reporting contact is also published in security.txt. For information about website data handling, see the privacy policy.