Threatmatic · Mohan's Vision
Five things — EdgeGuard, EdgeScale, EdgePi, Cloudiffusion, and QSChannel — that all answer one question: how does traffic get to your stuff safely, no matter where your stuff lives? Coalesced into one page, because they're one idea wearing several hats.
what one request goes through to reach anything Threatmatic protects — and why it never feels like this if you're the real thing
Each one answers a different question. None of them do each other's job.
"Are you even real traffic?"— pure volumetric/connection-layer defense. Rate limiting, SYN cookies, challenge ACK. No payload awareness at all — doesn't care what you're carrying, only whether you're a flood.
"Which door were you looking for?" — hostname publishing, TLS termination, routing. The anycast/geo-routed version — nearest regional gateway for large, multi-region customers — is the real ambition, not yet built.
"What's actually in the bag?" — decrypt, classify, re-encrypt. The same engine as endpoint π, relocated to the edge. Org-wide protection-intent captured today; real per-service enforcement still ahead.
"Does this apply in the cloud too?" — extends the whole mesh into AWS/GCP/Azure VPCs. Every VM, container, and function becomes a node on the same encrypted network as your endpoints.
Every one of the above rides on it. It's not a layer in the stack — it's the fabric the stack is drawn on.
EdgeGuard, EdgeScale, EdgePi, and Cloudiffusion are what happens ata node — QSChannel is why there's a mesh of nodes to happen at, in the first place
Zero trust protects endpoints. Until recently, nobody asked what was protecting the VM sitting in someone's AWS account.
every VM, container, and function becomes a node on the same mesh as your laptop — same rules, same visibility
per the real Constellation architecture — every regional node runs all four at once, not four separate machines
This is a vision page, not a status report — but it shouldn't quietly become one by accident.
| Layer | Today | The vision |
|---|---|---|
| EdgeGuard | Real, running — rate limiting, SYN cookies, challenge ACK on live gateways. | Already matches the vision at this layer. |
| EdgeScale | Hostname intent captured (zone.edgeScaleIngressHostnames). No routing, TLS termination, or DNS provisioned yet. | Anycast, geo-routed to the nearest regional node — the payoff for large, multi-region customers. |
| EdgePi (ingress) | Org-wide protection-intent captured in pi_config. No per-service enforcement yet. | Full classify()-grade inspection bolted onto EdgeScale's TLS termination point. |
| Cloudiffusion | Shipped and marketed — QSChannel genuinely extends into customer VPCs today. | Already real; the anchor the rest of this page is building toward matching. |
| QSChannel | Real, mature, production — the actual mesh everything above rides on. | Multi-region, nearest-entry-point routing — same open item as EdgeScale. |