One channel. Everything on it.
Policy updates, tunnel commands, and live telemetry all travel over one persistent, mutually-authenticated connection — not three separate integrations that each need their own uptime, their own retries, their own failure modes.
gRPC over HTTP/2 — multiplexed streams, one TLS handshake, no polling.
Never loses the signal.
A dropped connection isn't a dropped event. Agents reconnect automatically within seconds, and everything generated in between is queued, retried, and delivered — not silently discarded because the network hiccupped.
Automatic reconnect + backoff · durable delivery queue with retry and dead-letter handling.
There's nothing to scan.
Every connection is agent-initiated— nothing listens for inbound traffic, nothing accepts a connection it didn't ask for. An attacker running a port scan against a Threatmatic-protected endpoint finds exactly what they'd find scanning a locked room with no doors.
Outbound-only signaling · WireGuard-based reachability · deny-by-default at every zone.