A ThinkCyber product · Network defense appliance

X-ray vision for the people in charge.

Specto+ shows you which machines are really on your network, which of them an attacker could reach, and what to fix first. It runs on your own network, on your own hardware: one virtual machine that you import and connect. It is not a cloud service.

Download Specto+ free Specto+ in FullPDF · 20 pages

Specto+ 1.7.6 Network Visibility: every device the appliance has found, coloured by state. — Specto+ 1.7.6, Network Visibility. Every device the appliance has found, by state: needs review, healthy, not scanned, open ports.

You already own security tools. You still can’t answer one question.

Devices arrive without a ticket.

Services stay open after a project ends.

A report says “no findings”, and it gets read as “secure”.

“Are we actually safe?”

Which machines are really on the networkNot the list in the asset register. The devices that answer.

Which of them an attacker can actually reachFrom inside, and from the internet, as a stranger sees you.

What to do firstOne ranked list of fixes, so Monday morning starts with the change that removes the most risk.

What it does

Six parts. One appliance.

Internal Visibility is free. The other five come with the trial and the Professional edition.

PART 01 OF 06

Internal VisibilityFree

Every device the appliance can reach, what it runs, and which known weaknesses apply to it, including whether each device was checked in full.

Finds devices by ARP every 90 seconds on the subnet it is attached to
Quick scan of about 110 common ports every 15 minutes; a full TCP scan of each device every 30 days
Matched against the NIST National Vulnerability Database and the CISA Known Exploited Vulnerabilities catalog
A “Fix first” list ranks one row per fix, with known-exploited issues on top
Every device record exports to PDF or CSV

LEAVES THE APPLIANCE · Nothing about the devices. Vulnerability data is only downloaded.

Specto+ 1.7.6, Fix first. The fix that clears an actively exploited issue comes first; matches made only from a fingerprint are held apart as “needs review”.

PART 02 OF 06

Attack SurfaceProfessional

What of yours is reachable from the internet, as an attacker sees it.

Only the domains and public addresses you declare and authorise
Ports and services across the full TCP range, matched under the same evidence rules as the inside
SPF and DMARC: whether others can send mail in your name
Certificates, subdomains, open cloud storage, exposed files, leaked-secret candidates
An exposed file counts only when the server’s reply proves it; a bare “200 OK” never does

LEAVES THE APPLIANCE · The declared domains and their hosts, to the lookup services and as scan targets.

PART 03 OF 06

Phantom BaitProfessional

A decoy machine inside the network that nobody has a reason to touch — so any contact is a warning worth investigating.

Cloned from a real machine you choose: its open ports and replies
Its own address and hardware address, so it looks like a separate machine
An interactive fake shell records every command typed into it
Each contact keeps a slice of the network traffic as evidence

Monday morning · illustrativeOne entry in the decoy alert list: a laptop in accounts made contact with the decoy file server on Saturday at 02:14. The record shows which laptop, when, and exactly what it sent. Nobody in accounts works on Saturdays.

LEAVES THE APPLIANCE · Nothing. With several sites, decoy contacts go to your own main appliance.

PART 04 OF 06

SOC DrillsProfessional

Hands-on incident exercises for the security team, built from a real attack we captured on our own decoy servers.

Roles: SOC Tier 1, 2, 3 and Incident Response
The incident comes with its original logs and packet captures
Players join from their phones with a code; answers are scored automatically
Unlimited drills on a Professional licence

LEAVES THE APPLIANCE · Roles, experience in months, language and an anonymous identifier. No network data.

PART 05 OF 06

Executive ReadinessProfessional

A tabletop crisis exercise for managers, built from what this customer’s own box found.

The scenario starts from your own devices, weaknesses and exposure
The CISO reveals the crisis turn by turn; each role records its decisions
Closes with a scored after-action report: strengths, gaps, recommendations, as PDF
Uses your own AI model

LEAVES THE APPLIANCE · A summary of the security posture and the participants’ answers, to the AI provider you chose only.

Specto+ 1.7.6, Executive Readiness: an exercise room in progress and the setup for a new tabletop exercise.

PART 06 OF 06

Endpoint ControlProfessional

Finding the problem is half of it. Endpoint Control is how you act on the machine itself, from the same screen, with an account you provide and nothing installed on it.

Windows over WinRM, Linux over SSH, with an account you provide. No agent, and nothing left behind
Reads what is really there: programs, services, disk encryption, firewall and antivirus, local admins, shares, startup items, scheduled tasks, browser add-ons, USB history and who is logged on
What your account cannot read is shown as “could not read”, never as clean
Acts from a fixed list: stop or restart a service, find a file by name or hash, remove software or a browser add-on, isolate a machine. There is no free-form command
One action at a time: it is proposed, an admin approves it, and it expires in 30 minutes if nobody does

ISOLATING A MACHINEEverything in and out is blocked except the appliance, and connections that are already open are closed. Only Specto+ can still reach that machine. It never ends by itself — a person presses Release. Domain controllers cannot be isolated, and the appliance can never isolate itself. If the appliance is switched off while machines are isolated, they stay isolated until someone releases them at the machine.

LEAVES THE APPLIANCE · When Cy proposes an action, the question and the list of actions it may choose from go to the AI provider you chose. With a model on your own network, nothing leaves. Your sign-in account and everything the appliance reads never leave.

Across all six · In every edition

Cy, the AI advisor

Answers questions about what the box found, in plain language. It uses your own AI: your own account with a cloud provider, or, on a paid edition, a model running on your own network, so in that setup no question leaves the building. We charge nothing for AI and we run no AI service.

We tell you what we don’t know.

A security tool that overstates what it knows is worse than useless.The founder, ThinkCyber

Confirmed

A weakness is marked Confirmed only when the exact running version is in the affected range. Everything else is Needs review.

Said out loud

When the box could not check something, it says so. It never shows unchecked as clean.

No false comfort

“No findings” never means “secure”.

ConfirmedThe exact version a service announced falls inside the affected range of a published vulnerability.

Needs reviewA match that depends on an approximate or partial version. Never counted as Confirmed.

Scanned, nothing listeningThe last full scan reached the device and found no open TCP port. A result, not a gap.

Partial scanThe quick scan is done; the full port scan has not run yet. Labelled until it has.

Not assessedIn a passive zone or marked industrial. Listed by name; never shown as clean or safe.

In the board meeting · illustrativeSomebody asks whether the organization is exposed to the vulnerability that was in the news. The answer Specto+ supports: “Two machines match, and we have confirmed both; they will be patched by Thursday. Eleven we could not check, and here is why.”

The appliance itself

A box with this much reach has to defend itself.

You are about to put an appliance with administrative reach onto your network. This is how it is protected.

THE RECOVERY KEYThe recovery key is shown once, and we keep only a hash of it, so we cannot recover it. Keep it somewhere safe, away from the appliance, and run at least two administrator accounts.

Authenticator code for every administratorRequired, not optional.

Support access is offIt stays off until you switch it on, and you switch it off again.

Signed updatesThe box refuses an update it cannot verify. Update checks stay off until an admin turns them on, so nothing changes on the box without your say-so.

Every login and every action recordedWho, when, and from where.

Encrypted backupsDownload a backup, encrypted with a passphrase you choose.

Your data

What leaves the network

The question a self-hosted buyer asks in the first five minutes. Here is the full answer. Nothing ever connects in from ThinkCyber. The box only makes connections it starts itself.

Vulnerability information

Fetched from the public NIST and CISA databases. Your device list is not sent.

Default

Licence activation

One call when a licence code is entered. There is no scheduled check-in.

Once

Attack Surface

Scans of your own public addresses, and lookups about your declared domains.

When you switch it on

SOC Drills

The roles, experience and language for a drill. No network data.

When you request one

A question and the findings needed to answer it, to the AI provider you chose.

When you set it up

Updates and support access

An update check; a support tunnel the box opens itself, for the time you choose.

Only when an admin switches them on

Editions

Three editions. No device limit in any of them.

Free

Free, and it does not expire

Devices: No limit
Internal Visibility: Yes
The five paid parts: No
Cy, the AI advisor: Yes, with your own AI account
Several sites on one view: No

Trial

30 days, with one 30-day extension

Devices: No limit
Internal Visibility: Yes
The five paid parts: Yes
Cy, the AI advisor: Yes
Several sites on one view: No

Professional

A yearly licence

Devices: No limit
Internal Visibility: Yes
The five paid parts: Yes
Cy, the AI advisor: Yes, including a model you run yourself
Several sites on one view: Yes

Free lets you see. Professional lets you investigate, act, deceive and exercise.

When a paid licence ends, everything keeps working for 30 days. Then the free parts carry on working and the paid ones stop. Their data stays readable.

Getting it

One image. Your hardware. Your network.

Download it free. Internal Visibility is free and does not expire. For the five paid parts, request a 30-day trial licence.

01Import

One virtual machine image, imported into your own virtualisation software.

02Connect

Connect it to the network you want watched.

03Set up

A short wizard: pick the edition, say whether the network is office or industrial, create the admin login, keep the recovery key.

Download Specto+ (latest release)

OVA image · 4.5 GB

SHA-256: 7e889fc8520ca14613900f7e889e976ffd8f35c94f2edd4e7a9d41fadaef899f
Machine: The appliance is configured with 4 vCPU, 6 GB RAM and an 80 GB disk (thin-provisioned).
Runs on: VMware (tested). Other OVA-compatible hypervisors: untested.

Verify the download against the SHA-256 above. If a browser download stalls, resume it with a download manager or curl -C -.

See your own network the way Specto+ sees it.

Every paid part for 30 days, on your own hardware, inside your own network.