SecInv: You Cannot Protect What You Cannot See

You cannot protect what you cannot see

Read back the roll-call of October 2026 and a quiet pattern emerges. A backdoored command-line tool. A poisoned package pulled onto thousands of machines. A certificate key compromised at the root. Almost none of it began with a dramatic break-in. It began on an endpoint — a laptop, a server, a workstation — running something nobody was watching closely enough.

That is the uncomfortable gap in most organisations. They know their mission, their people and their data. They do not always know, at any given moment, exactly which machines are on their network, what software those machines are running, whether they are patched, or whether one of them is quietly doing something it should not. And you cannot protect what you cannot see.

SecInv — the Security and Management Console we built inside the NIHIS health-information programme — exists to close that gap. It is an agent-based endpoint management and security tool: not a dashboard of guesses, but a live, verifiable picture of a real fleet of devices, and the controls to act on it.

How it actually works

Every managed device runs a small agent. On first contact it enrolls using a client certificate, and from then on every conversation between the device and the console happens over mutual TLS — both sides prove who they are, every time. There is no shared password to leak, no anonymous device quietly checking in.

Once enrolled, the agent periodically reports what the machine actually is: hostname and platform, operating system name, version and build, CPU and cores, memory, disk capacity and free space, network addresses, manufacturer, model and serial — and the full list of installed software, by name, version and publisher. That inventory is the foundation everything else stands on, because the first question in any incident is always the same: which machines are affected, and what are they running? With SecInv, that is a query, not a week of frantic phone calls.

On top of the inventory sits security posture — the compliance checks that tell you whether a device is in the state it is supposed to be in. And when something needs to change, the console does not send a polite request. It issues a signed command — inventory refresh, reboot, run a script, open a remote session, view the screen — cryptographically signed so the agent can verify it came from the console and nothing else. A compromised network cannot forge an order to a machine.

Built for how real organisations are shaped

Few institutions are a single flat fleet. A health-information exchange is dozens of facilities, each with its own devices, its own staff, its own responsibilities. SecInv is multi-tenant by design: every device, user and policy belongs to an entity, and the console scopes what each person can see to the entity they are responsible for. Access is role-based — a viewer sees; an administrator acts — so the power to reboot a machine or push a script is never handed out by accident.

The console itself is deliberately plain: Dashboard, Devices, Agents, Entities, Policies, Users. No theatre. Just the few things a security team actually needs to answer at 2 a.m. — what do we have, what state is it in, and what can we do about it right now.

Why this belongs in a story about October

The breaches of last month were not, mostly, failures of firewalls. They were failures of visibility and control — of not knowing what was running, not verifying what was trusted, not being able to move fast when it mattered. Every principle in the companion piece to this article — know your inventory, verify your supply chain, adopt zero trust, build to recover — lands on the same hard surface: the endpoint.

SecInv is one answer to that, and it is the kind of answer I believe in — not bolted on after a breach, but secure by design: identity proven with certificates, commands signed, access scoped, inventory continuous. It will not make an organisation invincible. Nothing will. But it replaces the dangerous comfort of "we think we're fine" with something far more useful on the day it matters: we know.

That is the whole point. In a month that reminded the world how little it sometimes sees of its own systems, the quiet advantage goes to those who can answer, honestly and instantly, a single question — what is actually running on our machines?