{"type":"Article","url":"https://diginpl.com/magazine/2026-11-secure-by-design/secinv-you-cannot-protect-what-you-cannot-see","issue":{"url":"https://diginpl.com/magazine/2026-11-secure-by-design","number":2,"month":"2026-11-01","cover_person":""},"kind":"Feature","title":"SecInv: You Cannot Protect What You Cannot See","dek":"Inside SecInv — the agent-based security and management console built to give an organisation real-time, verifiable control of every device on its network.","author":"Padam Sundar Kafle","language":"en","published":"2026-10-23T09:08:33Z","modified":"2026-10-23T09:25:22Z","words":750,"reading_minutes":4,"takeaways":["Agent-based endpoint management: each device enrolls with a client certificate and talks to the console only over mutual TLS.","Continuous inventory of hardware, OS, network and installed software — so “which machines are affected?” is a query, not a week of phone calls.","Security posture / compliance checks per device, surfaced live.","Signed commands (inventory refresh, reboot, scripts, remote session, screen view) that an agent can cryptographically verify came from the console.","Multi-tenant by entity with role-based access — viewers see, admins act; each facility sees only its own fleet.","Secure by design: identity proven, commands signed, access scoped, inventory continuous — not bolted on after a breach."],"pull_quote":"It replaces the dangerous comfort of “we think we’re fine” with something far more useful on the day it matters: we know.","text_markdown":"## You cannot protect what you cannot see\n\nRead back the roll-call of October 2026 and a quiet pattern emerges. A backdoored command-line tool. A poisoned package pulled onto thousands of machines. A certificate key compromised at the root. Almost none of it began with a dramatic break-in. It began on an *endpoint* — a laptop, a server, a workstation — running something nobody was watching closely enough.\n\nThat is the uncomfortable gap in most organisations. They know their mission, their people and their data. They do not always know, at any given moment, exactly which machines are on their network, what software those machines are running, whether they are patched, or whether one of them is quietly doing something it should not. And you cannot protect what you cannot see.\n\n**SecInv** — the Security and Management Console we built inside the NIHIS health-information programme — exists to close that gap. It is an agent-based endpoint management and security tool: not a dashboard of guesses, but a live, verifiable picture of a real fleet of devices, and the controls to act on it.\n\n## How it actually works\n\nEvery managed device runs a small **agent**. On first contact it enrolls using a **client certificate**, and from then on every conversation between the device and the console happens over **mutual TLS** — both sides prove who they are, every time. There is no shared password to leak, no anonymous device quietly checking in.\n\nOnce enrolled, the agent periodically reports what the machine actually is: hostname and platform, operating system name, version and build, CPU and cores, memory, disk capacity and free space, network addresses, manufacturer, model and serial — and the full list of installed **software**, by name, version and publisher. That inventory is the foundation everything else stands on, because the first question in any incident is always the same: *which machines are affected, and what are they running?* With SecInv, that is a query, not a week of frantic phone calls.\n\nOn top of the inventory sits **security posture** — the compliance checks that tell you whether a device is in the state it is supposed to be in. And when something needs to change, the console does not send a polite request. It issues a **signed command** — inventory refresh, reboot, run a script, open a remote session, view the screen — cryptographically signed so the agent can verify it came from the console and nothing else. A compromised network cannot forge an order to a machine.\n\n## Built for how real organisations are shaped\n\nFew institutions are a single flat fleet. A health-information exchange is dozens of facilities, each with its own devices, its own staff, its own responsibilities. SecInv is **multi-tenant by design**: every device, user and policy belongs to an **entity**, and the console scopes what each person can see to the entity they are responsible for. Access is **role-based** — a viewer sees; an administrator acts — so the power to reboot a machine or push a script is never handed out by accident.\n\nThe console itself is deliberately plain: **Dashboard, Devices, Agents, Entities, Policies, Users.** No theatre. Just the few things a security team actually needs to answer at 2 a.m. — *what do we have, what state is it in, and what can we do about it right now.*\n\n## Why this belongs in a story about October\n\nThe breaches of last month were not, mostly, failures of firewalls. They were failures of *visibility and control* — of not knowing what was running, not verifying what was trusted, not being able to move fast when it mattered. Every principle in the companion piece to this article — know your inventory, verify your supply chain, adopt zero trust, build to recover — lands on the same hard surface: the endpoint.\n\nSecInv is one answer to that, and it is the kind of answer I believe in — not bolted on after a breach, but **secure by design**: identity proven with certificates, commands signed, access scoped, inventory continuous. It will not make an organisation invincible. Nothing will. But it replaces the dangerous comfort of *\"we think we're fine\"* with something far more useful on the day it matters: **we know.**\n\nThat is the whole point. In a month that reminded the world how little it sometimes sees of its own systems, the quiet advantage goes to those who can answer, honestly and instantly, a single question — *what is actually running on our machines?*\n","faq":[],"sources":[],"photo":null,"citation":"Padam Sundar Kafle. “SecInv: You Cannot Protect What You Cannot See.” DigiNepal Magazine, no. 2, November 2026. https://diginpl.com/magazine/2026-11-secure-by-design/secinv-you-cannot-protect-what-you-cannot-see"}