Threatmatic · EdgeGuard · SynGuard · NetQoS

Active Defense

Most defenses pick one place to stand. This one picks three — two on the way traffic comes in, one on the way it goes out — and none of them wait for a person to notice anything first.

3
enforcement points
<200ms
to block, worst case
0
analysts in the loop

01

Two doors on the way in

EdgeGuard and SynGuard are the same idea, enforced at two different distances from the target. Both watch inbound connections at the OS level, in real time, and both act before a flood ever turns into an incident — no waiting for a human to look at a dashboard.

EdgeGuardat the network edge
A volumetric flood aimed at your origin gets intercepted and scrubbed at Threatmatic's own gateway fleet — before it ever reaches your bandwidth at all. This is the first door.
SynGuardat the endpoint
If a flood reaches a device anyway — no gateway in front of it, or the flood originates inside your own network — SynGuard tracks inbound connection rates per source and blocks in under 200ms, right at the device. The second door, for whatever gets past the first.

02

One valve on the way out

NetQoS runs the same way, in the other direction: on the sending device itself, before traffic ever reaches a firewall. It caps how much any single app can send, per destination and protocol — so one misbehaving or compromised process can't consume the whole line, and everything else on that device keeps working normally while it happens.

NetQoSat the source
Per-flow, per-app rate limiting on the device that's actually sending — shaping the problem where it starts, not downstream where it's already everyone's problem.

03

What's real today, honestly

Two different kinds of "done" here, and worth being precise about which is which:

Verified against real traffic

NetQoS and SynGuard's connection-rate limiting have both been tested against real attack and load traffic on real hardware, not simulated — the enforcement logic itself works.

Rollout pending

Getting a rate-limit change from the console to every device in a fleet the moment it's set still needs the last-mile wiring finished — the enforcement is proven, the fleet-wide push isn't live yet.

Three points doesn't mean three dashboards to watch. It means whatever gets past one door meets another, automatically, before anyone has to notice.

Current rollout status for the pending piece lives on Landing Soon. The regional footprint EdgeGuard runs on is its own story — The Constellation.

← Back to The Wire