Deployment architecture

Six reference sheets for technical reviewers: where Secure, Assure, and SOAR (security orchestration, automation, and response) sit beside the tools you already run, and what crosses between them.

Sheet 1 of 6. Use Prev and Next, the sheet picker, or the arrow keys. Abbreviations are spelled out under Terms. The post-quantum sheets are on their own page.

QASO reference architecture · Defense in depth

Defense in Depth: where Secure, Assure, and SOAR sit, what crosses, and how a response is approved

Each layer of existing security keeps its own tools. QASO adds its own evidence beside those layers, and a response proposal that is approved according to its risk class.

Limits on every sheet: Secure records what its collector saw; that is not proof the network is complete. Assure is not yet approved for your source code, for installation at your site, or for production use. SOAR proposes; each response is approved according to its risk class, and your team makes any production change. The sealed setup is validated on a virtual machine only.

Customer-controlled environment — controls, data and owners stay here

Datacenter / campus

Firewall / WAFWeb application firewallPerimeter policy

IDS / NDRIntrusion detection system · Network detection and responseNetwork detection

EDR / MDMEndpoint detection and response · Mobile device managementEndpoint control

Vulnerability managementScanner plus the patch record

AD / PAMActive Directory · Privileged access managementControls on administrator accounts

KMS / PKIKey management service · Public key infrastructureStores keys and issues certificates

DNS securityDomain Name SystemResolution policy

Micro-segmentationLimits traffic between internal systems

SOAR packet mirrorA copy of traffic from a switch mirror port (SPAN) or a network tap (TAP). Packet metadata (source, destination, destination port, and size only) and NetFlow (records of which systems talked to which). Never packet contents.

Branch, remote, and plant sites

SD-WANSoftware-defined wide-area networkSite routing

Branch firewallLocal enforcement

Your OT network tapOperational technologyYours, if you have one; QASO supplies no OT sensor

AllowlistingApplication control

Local EDREndpoint detection and responseEndpoint security that can run offline

Segment isolationYour quarantine tools

Local recoveryHow this site restores service

Physical accessBadge / camera log

Opt-in alert connectorsOpt-in and read-only: SentinelOne posture and threats, and Splunk searches of at most 50 rows. SOAR does not write back.

Cloud / SaaS / delivery

IAMIdentity and access managementCloud identity

CSPM / KSPMCloud security posture management · Kubernetes security posture managementPosture management

VPC flow / WAFVirtual private cloud · Web application firewallTraffic + edge policy

KMS / DLPKey management service · Data loss preventionData protection

Backup / DRDisaster recoveryRecovery state

CASB / SaaS auditCloud access security broker · Software as a serviceSaaS control plane

CI/CDContinuous integration (CI) and continuous delivery (CD)Build + release

SAST / SBOMStatic application security testing · Software bill of materialsCode + supply chain

Cloud context you importProvider export files. No cloud-account API inventory.

Local data boundaryPacket contents are never recorded; metadata stays on the machines you control, and you choose which files to copy out

Response hand-offResponse proposal approved by risk class; your team carries out the change

ANetwork boundaryF

QASO products — installed on your site, each with its own data

Imports and connectorsFiles you import and connectors you configure. Nothing arrives by automatic sync.

SecureObserveRecords what it can see on the networks you authorize, the weaknesses that match, how an attacker could move between systems, and the key exchange each service selects in a test connection (it does not read certificates). Discovery is not proof the network is complete.

InventoryWhat this collector saw

Attack pathsHow an attacker could move

Key exchangeWhat a test connection selected

AssureReview sourceEngineering candidate, evaluated on synthetic repositories. Reviews JavaScript and TypeScript source and its third-party dependencies, cites the exact line, and re-checks each finding. Static evidence does not prove runtime safety. Not yet approved for your source code, for installation at your site, or for production use.

Source findingsExact file and line

DependenciesPackages and advisories

Re-checkEach finding

SOARPropose · approveWatches live packet metadata (source, destination, destination port, and size) and NetFlow (records of which systems talked to which), reads opt-in, read-only SentinelOne posture and threat data and Splunk searches (up to 50 rows per search), and imports Secure and Assure findings. On-site AI models help investigate and draft a response, which is approved according to its risk class.

InvestigateOn-site AI models

Response proposalApproval by risk class

Your team actsOwn change process

EApproval stepApproval by risk class: lowest risk is automatic after a policy match and logged; medium needs one named person; high needs two independent people; safety-critical needs a named decision owner and a process engineer. Every human approval expires and is invalidated if the evidence changes.Human approvals record who approved which proposal; the lowest class is approved by policy and logged, with no approval record. Production changes stay with your team. Two demonstration actuators exist, on a lab guest and a rehearsal-copy demo; they are not a general response engine.

Separate product dataNo shared live store. Each product keeps its own data. A file import or a configured connector is required to move a finding.

Records kept for the installationRetention follows your installation’s runbook.

OperationsHealth, backup, and recovery follow your installation’s runbook.

Implementation notes

ASOAR console sign-in: a local username and password, which works on a sealed site with no internet, or Google sign-in limited to allowed email addresses; no identity-provider integration. No privileged-access-management integration.

BInstall collectors beside the controls you already run; those controls keep their configuration, console, and owner.

CSOAR reads packet metadata and NetFlow, never packet contents; sensitive data stays on-site.

DEach product keeps its own data. Findings move between Secure, Assure, and SOAR by file import or a configured connector; there is no shared live store and no automatic sync.

EApproval follows the risk class: automatic with a log for the lowest class, and named people above that. A human approval names the approver, expires, and is invalidated if the evidence changes. Production changes stay with your team.

FSOAR proposes a response, it is approved according to its risk class, and your team carries out the change. SOAR does not re-check your systems after the change; you re-run Secure or Assure, or connect a new observation, to see the new state.

Threat modelingThreats to review for your site (STRIDE: spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege)

Part of the data-flow diagram	Threats to review	Controls	Status
External entitysecurity analyst · named console account · native control	Spoofing, repudiation, elevation of privilege	current build (SOAR console): a local username and password, or Google sign-in limited to allowed addresses. Not in this build: customer identity provider, roles, time-boxed access, session audit	In place in this build
ProcessSecure · Assure · SOAR	Spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege	input checks on imports, local processing (there are no roles and no least-privilege enforcement)	To confirm for your site
Data storeeach product’s own records · local metadata	Tampering, repudiation, information disclosure, denial of service	retention policy, console accounts, backups	To confirm for your site
Data flowmetadata · file imports · approval records	Tampering, information disclosure, denial of service	agreed network channels, data minimization, import checks	To confirm for your site
Authority boundaryyour change process ↔ QASO proposals	Spoofing, tampering, repudiation, information disclosure, elevation of privilege	approval by risk class (automatic and logged for the lowest; one, two, or owner-plus-engineer above that), expiry, rollback plan	To confirm for your site

Threat modeling is installation-specific. Nothing in this table is confirmed until your site profile is reviewed: local processing and update paths, collector placement, data-retention policy, and which SOAR response proposals are allowed.

Target architecture, to confirm for your siteCollectors placed only on networks you authorize; network channels agreed with your network team.Each product keeps its own data; findings move by file import or a configured connector.SOAR approval follows the risk class: automatic with a log for the lowest class, and named people above that; a human approval names the approver, expires, and is invalidated if the evidence changes.Packet contents are never captured and secrets stay local. Your team makes approved changes; SOAR does not re-check your systems after the change; you re-run Secure or Assure, or connect a new observation, to see the new state.Evidence to collect at your site: network channel plan · retention settings · approval and rollback rehearsal.

Terms on this sheet: AD: Active Directory · AI: Artificial intelligence · API: Application programming interface · CASB: Cloud access security broker · CI/CD: Continuous integration (CI) and continuous delivery (CD) · CSPM: Cloud security posture management · DLP: Data loss prevention · DNS: Domain Name System · DR: Disaster recovery · EDR: Endpoint detection and response · IAM: Identity and access management · IDS: Intrusion detection system · KMS: Key management service · KSPM: Kubernetes security posture management · MDM: Mobile device management · NDR: Network detection and response · NetFlow: Records of which systems talked to which · OT: Operational technology · PAM: Privileged access management · PKI: Public key infrastructure · QASO: Quantum Agentic Security Operations · SAST: Static application security testing · SBOM: Software bill of materials · SD-WAN: Software-defined wide-area network · SOAR: Security orchestration, automation, and response · SPAN: Switched port analyzer · SaaS: Software as a service · TAP: Test access point · VPC: Virtual private cloud · WAF: Web application firewall

Terms used on these sheets

The abbreviations used on the architecture sheets, spelled out. On a sheet, hover over or long-press an underlined abbreviation to see the same words.

ABAC: Attribute-based access control: access decided by attributes such as team, device, or data label
AD: Active Directory: the Microsoft directory of users and computers
AI: Artificial intelligence: in QASO, only SOAR runs AI models, on your own hardware. Secure has no built-in model; it offers a Model Context Protocol (MCP) server that an outside AI assistant can connect to
API: Application programming interface: how one program asks another for data
CASB: Cloud access security broker: policy checks between users and cloud apps
CBOM: Cryptography bill of materials: a list of the cryptography calls in source code, by file and line; it does not prove the running system uses them
CI/CD: Continuous integration (CI) and continuous delivery (CD): the automated build and release pipeline
CSPM: Cloud security posture management: checks cloud settings against policy
DevSecOps: Development, security, and operations: security built into software delivery
DFD: Data-flow diagram: a map of processes, data stores, and the flows between them
DLP: Data loss prevention: controls that stop sensitive data leaving
DNS: Domain Name System: turns names like example.com into network addresses
DR: Disaster recovery: restoring service after a major failure
EDR: Endpoint detection and response: security software on laptops and servers
GRC: Governance, risk, and compliance
HTTP: Hypertext Transfer Protocol: the protocol of the web
IaC: Infrastructure as code: servers and networks defined in configuration files
IAM: Identity and access management: who can sign in and what they can reach
IDS: Intrusion detection system
IdP: Identity provider: the service that signs people in, such as Okta or Microsoft Entra
IT: Information technology
KMS: Key management service: stores and controls encryption keys
KSPM: Kubernetes security posture management
MDM: Mobile device management
MFA: Multi-factor authentication
NDR: Network detection and response
NetFlow: Records of which systems talked to which: when, how much, and on which port, never packet contents
NVD: National Vulnerability Database: the public list of known software flaws
OT: Operational technology: industrial and building control systems
PAM: Privileged access management: controls on administrator accounts
PDF: Portable document format: the print-ready file the PDF button saves
PKI: Public key infrastructure: the system that issues and trusts certificates
PQC: Post-quantum cryptography: new encryption and signature algorithms designed to resist attacks by quantum computers
PR: Pull request: a proposed code change awaiting review
QASO: Quantum Agentic Security Operations: the product family of Secure, Assure, and SOAR
SaaS: Software as a service: applications run by a vendor in the cloud
SAST: Static application security testing: scanning source code for flaws
SBOM: Software bill of materials: a list of the packages inside an application
SD-WAN: Software-defined wide-area network: how branch offices connect
SIEM: Security information and event management: a central log store and search system. SOAR is not one
SOAR: Security orchestration, automation, and response: the QASO product that watches packet metadata (source, destination, destination port, and size) and NetFlow and proposes responses
SPAN: Switched port analyzer: a switch port that mirrors traffic for monitoring
SSH: Secure Shell: encrypted remote login
SSO: Single sign-on
STRIDE: Spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege: a threat checklist
TAP: Test access point: a hardware device that copies network traffic for monitoring
TLS: Transport Layer Security: the encryption behind https
VM: Virtual machine
VPC: Virtual private cloud: a private network inside a cloud account
WAF: Web application firewall
WAN: Wide-area network
ZTNA: Zero-trust network access