Built for teams that refuse
to compromise on security
A unified agent with full-stack Virtual Wire networking (L3–L7) that replaces your VPN and endpoint monitoring stack — no gateway appliances required.
Virtual Wire — Layer 2 to Layer 7
Traditional VPNs and tunnels operate at a single network layer and funnel traffic through a central gateway. ORBTR's Virtual Wire spans the full stack — from Ethernet framing (L2) through transport (L4) to application-layer policy (L7) — all managed directly by the agent and control plane. No gateway appliances, no concentrators, no bottlenecks.
- ✓ L2 bridging — extend VLANs and broadcast domains across sites roadmap
- ✓ L3 routing — encrypted mesh overlay with per-tenant VRFs
- ✓ L4 transport — per-flow policy with segment-aware forwarding
- ✓ L7 application — DNS policy, identity-aware access, deep inspection roadmap
- ✓ Zero gateway dependency — direct peer-to-peer, no single chokepoint
- ✓ Virtual networks with DHCP, IPAM, and multi-network routing
Encrypted Mesh Overlay
ORBTR creates a peer-to-peer encrypted network between all your devices using the VL1 overlay protocol. UDP hole punching establishes direct connections; relay nodes provide fallback when NAT traversal fails.
- ✓ Noise-encrypted sessions with Ed25519 key binding
- ✓ Automatic hole punching — no port forwarding
- ✓ Relay fallback with short-lived, audited tickets
- ✓ Ledger-as-Directory (LAD) for peer discovery
- ✓ Transport failover: VL1 → QUIC → WebSocket
- ✓ mDNS/NetBIOS proxy for cross-mesh service discovery
Zero-Trust by Design
Every connection, every policy update, and every script execution is cryptographically verified. ORBTR implements a three-tier key hierarchy with dual-validity signing and epoch-based anti-rollback.
- ✓ Platform Root + Tenant Root key hierarchy (Ed25519)
- ✓ Dual-signed Root Descriptors (TR ∧ PR)
- ✓ Epoch-based anti-rollback on all state
- ✓ Agent-side rate limiting detects key compromise
- ✓ Device keys never leave the OS keychain (DPAPI/Keychain/TPM)
- ✓ HSM-backed tenant keys for Enterprise compliance
Fleet-Wide Device Control
Manage every device from a single control plane. Enforce policies, run remote jobs, push updates, and monitor health — whether you have 10 devices or 10,000.
- ✓ Cross-platform agent — macOS, Linux, Windows
- ✓ Hardware, OS, network, software, and security inventory
- ✓ Device tags, groups, and smart group rules
- ✓ Patch management with compliance tracking and schedules
- ✓ Cryptographically verified updates with staged rollouts and auto-rollback
- ✓ Fleet map — geographic device distribution by region
Jobs & ScriptPacks
Run verified scripts, collect logs, push files, and manage packages remotely. Every execution is hash-verified, targets specific groups or tags, and streams output in real time.
- ✓ Script library with TR-signed manifests
- ✓ Target by group, tag expression, or individual device
- ✓ Multiple execution contexts — SYSTEM, USER, ELEVATED
- ✓ Tray consent prompts for sensitive operations
- ✓ Real-time stdout/stderr streaming
- ✓ Retry logic and cancellation support
Threat Detection & Response
Every agent runs a built-in detection stack — monitoring file integrity, scanning for malware patterns, matching CVEs against your software inventory, and collecting security events. No separate EDR or vulnerability scanner required.
- ✓ File Integrity Monitoring (FIM) with fingerprint-based change detection
- ✓ Sigma rule engine for generic threat detection
- ✓ YARA pattern scanning for malware signatures
- ✓ ETW event collection on Windows (process, file, registry)
- ✓ Rootkit detection and kernel integrity checks
- ✓ CVE vulnerability scanning — 5 sources queried concurrently (NVD, OSV, GitHub Advisories, CIRCL, OpenCVE)
- ✓ Per-device CVSS risk scoring with finding dismissal and audit trail
- ✓ Distributed fleet scanning — hash-ring scheduling across 24h windows
Intelligent DNS & DDNS
A built-in policy-driven DNS resolution engine with mesh-assisted fallback. Block threats, route queries per domain, and maintain device addressability with signed DDNS updates.
- ✓ Block, override, forward, rewrite, and sinkhole modes
- ✓ Per-domain upstream routing (UDP/TCP/DoH/DoT)
- ✓ Mesh-assisted resolution when upstreams unreachable
- ✓ URL-based blocklists with auto-refresh
- ✓ DNS zone and record management (A/AAAA/CNAME/SRV)
- ✓ Force SafeSearch and DNS sinkhole for threat mitigation
- ✓ Dynamic DNS with health checks, failover, and email alerting
Policy Engine & Network Firewall
Define security posture at every scope level — from tenant-wide defaults down to individual devices. Policies propagate through the mesh even when the control plane is unreachable.
- ✓ Scope hierarchy: Tenant → Network → Group → Device
- ✓ Signed policy bundles with epoch-based anti-rollback
- ✓ Mesh gossip propagation — works offline
- ✓ Network firewall with address groups, port groups, and schedules
- ✓ FQDN rules with DNS resolver integration
- ✓ Zero-trust policies — identity-aware, posture-based, time-bounded
- ✓ Routing policies — overlay routes, edge endpoint egress, force tunneling
Edge Endpoints
Any enrolled agent can be promoted to serve mesh infrastructure roles — relay, anchor, DNS authority, DHCP bridge, or egress gateway. Run your own infrastructure on your own hardware with no separate appliance.
- ✓ Anchor — serve LAD snapshots for peer discovery
- ✓ Relay — packet forwarding when direct P2P fails
- ✓ DNS Authority — authoritative DNS for your mesh zones
- ✓ DHCP Bridge — bridge non-mesh LAN devices onto the overlay
- ✓ Print Management — discover, approve, and deploy printers via mesh
- ✓ Enterprise: VRF/VLAN egress, QoS, SNMP discovery
Data Sovereignty & Business Continuity
ORBTR is built for organisations that can't afford to depend on a third-party control plane. Export your Tenant Root key, run an emergency controller on your own hardware, and operate fully standalone when needed.
- ✓ Emergency controller — standalone operation when control plane is unreachable
- ✓ Tenant Root key export for cryptographic independence
- ✓ Compliance-segmented PR keys (HIPAA, FedRAMP, PCI, IRAP)
- ✓ Mesh-internal C2 failover via edge endpoint promotion
- ✓ Data residency controls and regional key isolation
- ✓ Offline policy enforcement with signed cache fallback
One platform, every capability
Real-Time Telemetry
System metrics, health status, and security events streamed with backpressure controls and privacy-first field redaction.
Remote Access
WebRTC remote desktop, shell, and tunnel sessions with approval-based consent and optional session transcripts.
Alerts & Notifications
In-app notifications for IPS alerts, agent events, policy updates, and security signals. Email alerting for DDNS health checks.
Staged Rollouts
Percentage-based and ring-based deployment waves with auto-rollback on failure thresholds. Stable, beta, and custom update channels.
Identity & Access
SSO (SAML/OIDC), directory sync (AD/LDAP), RBAC, composed groups, and user-identity-aware policy enforcement.
Audit Logging
Immutable audit trail for every action, authentication event, and policy change. 7-day to unlimited retention with SIEM export.
Vulnerability Scanning
Multi-source CVE detection across NVD, OSV, GitHub Advisories, CIRCL, and OpenCVE — with CVSS risk scoring, deduplication, finding dismissal, and distributed fleet-wide scanning.
CLI & Tray
orbtrctl for automation and diagnostics. System tray app for status, DNS, jobs, mesh overview, and management actions.
Sovereignty
Emergency controller, TR key export, compliance-segmented cryptography, and mesh-internal C2 failover for full data sovereignty.
Features by tier
Every plan includes unlimited users. Higher tiers inherit all features from lower tiers.
Starter · Free
Mesh SD-WAN (L3), zero-trust enrollment, basic policy, DNS stub resolver, device inventory, groups, tags, fleet map, security center, audit logging (7 days), CLI, auto-updates, and in-app notifications. 9 devices free forever.
Pro · $16/device
Everything in Starter plus Virtual Wire (L3–L7), virtual networks with DHCP, network firewall, full policy with mesh propagation, ScriptPacks, remote access, Edge Endpoints, print management, SSO, smart groups, staged rollouts, DDNS monitoring, RBAC, patch management, and 90-day audit retention.
Enterprise · Custom
Everything in Pro plus unlimited Edge Endpoints with VRF/VLAN/QoS, sovereignty controls with emergency controller, distributed telemetry, HSM-backed keys, compliance-segmented cryptography (HIPAA/FedRAMP/PCI/IRAP), session transcripts, deep inspection (eBPF/WFP), and unlimited audit retention with SIEM export.