--- title: CyQuantiFi Capture Appliance — Dollarised Risk On-Site description: Transform live network traffic into quantifiable cyber risk insights with the CyQuantiFi Capture Appliance, delivering compliance reports and risk assessment seamlessly on-site. --- [Skip to content](https://www.cyquantifi.com/cyquantifi-capture-appliance-dollarised-risk-on-site#main-content) [![cyquantifi-horizontal-light](https://www.cyquantifi.com/hubfs/cyquantifi-horizontal-light.svg)Homepage](https://www.cyquantifi.com?hsLang=en) - [Home](https://www.cyquantifi.com?hsLang=en) - [Insights](https://www.cyquantifi.com/blog?hsLang=en) - [Product](https://www.cyquantifi.com/product?hsLang=en) - [Cyber Risk Quantification](https://www.cyquantifi.com/transform-cyber-risk-into-financial-insights-actionable-threat-modeling-cyquantifi?hsLang=en) - [Packet Capture Appliance](https://www.cyquantifi.com/cyquantifi-capture-appliance-dollarised-risk-on-site) - Services - [Supply Chain Risk Assessment](https://www.cyquantifi.com/third-party-supply-chain-cyber-risk-quantification?hsLang=en) - [IRAP and E8](https://www.cyquantifi.com/irap-assessments-essential-eight-uplift?hsLang=en) - [SOCI CIRMP](https://www.cyquantifi.com/cyber-risk-quantification-for-soci-cirmp-compliance?hsLang=en) - CyQuantiFi vs - [Avertro](https://www.cyquantifi.com/cyquantifi-vs-avertro?hsLang=en) - [Safe Security](https://www.cyquantifi.com/cyquantifi-vs-safe-security?hsLang=en) - [CYE](https://www.cyquantifi.com/cyquantifi-vs-cye?hsLang=en) - [6clicks](https://www.cyquantifi.com/cyquantifi-vs-6clicks?hsLang=en) - [Cybercube](https://www.cyquantifi.com/cyquantifi-vs-cybercube?hsLang=en) - [About](https://www.cyquantifi.com/about?hsLang=en) - [Contact Us](https://www.cyquantifi.com/contact-us?hsLang=en) - [Careers](https://www.cyquantifi.com/careers?hsLang=en) [Book a Demo](https://www.cyquantifi.com/demo?hsLang=en) - [Home](https://www.cyquantifi.com?hsLang=en) - [Insights](https://www.cyquantifi.com/blog?hsLang=en) - [Product](https://www.cyquantifi.com/product?hsLang=en) - [Cyber Risk Quantification](https://www.cyquantifi.com/transform-cyber-risk-into-financial-insights-actionable-threat-modeling-cyquantifi?hsLang=en) - [Packet Capture Appliance](https://www.cyquantifi.com/cyquantifi-capture-appliance-dollarised-risk-on-site) - Services - [Supply Chain Risk Assessment](https://www.cyquantifi.com/third-party-supply-chain-cyber-risk-quantification?hsLang=en) - [IRAP and E8](https://www.cyquantifi.com/irap-assessments-essential-eight-uplift?hsLang=en) - [SOCI CIRMP](https://www.cyquantifi.com/cyber-risk-quantification-for-soci-cirmp-compliance?hsLang=en) - CyQuantiFi vs - [Avertro](https://www.cyquantifi.com/cyquantifi-vs-avertro?hsLang=en) - [Safe Security](https://www.cyquantifi.com/cyquantifi-vs-safe-security?hsLang=en) - [CYE](https://www.cyquantifi.com/cyquantifi-vs-cye?hsLang=en) - [6clicks](https://www.cyquantifi.com/cyquantifi-vs-6clicks?hsLang=en) - [Cybercube](https://www.cyquantifi.com/cyquantifi-vs-cybercube?hsLang=en) - [About](https://www.cyquantifi.com/about?hsLang=en) - [Contact Us](https://www.cyquantifi.com/contact-us?hsLang=en) - [Careers](https://www.cyquantifi.com/careers?hsLang=en) [Book a Demo](https://www.cyquantifi.com/demo?hsLang=en) NEW CAPABILITY · DESIGN PARTNERS OPEN # The CyQuantiFi Capture Appliance A passive on-site sensor that turns live network traffic into an FAIR-based dollar figure — and an SMB1001, Essential Eight, or SOCI-ready report the board, the underwriter, or the regulator will actually accept. [Request a demo →](https://cyquantifi.com/demo?hsLang=en) [Become a design partner →](https://cyquantifi.com/contact?hsLang=en) ## The gap the industry left open The dedicated cyber risk quantification vendors (Safe, Kovrr, Axio, RiskLens) are pure cloud SaaS at USD 75–300K per year. None of them put a sensor on your network. The on-site vendors that *do* ship an appliance — Nozomi, Claroty, Dragos — are OT visibility platforms, not risk quantifiers. They tell you what's on the wire; they don't tell you what it's worth if it breaks. The Capture Appliance sits in the gap. A passive tap on a mirror port; asset and third-party discovery from real traffic; automatic FAIR-based Monte Carlo modelling with prediction-market inputs for the assets your scanners can't touch; and a signed compliance report at the end — SMB1001 for the underwriter, Essential Eight for the board, SOCI hazard mapping for the regulator. > *Live network truth in. Dollars and audit-ready evidence out. No cloud egress required.* --- ## What the appliance does on-site 1 #### Passive network capture Plug into a SPAN, mirror, or TAP port. No agents, no active scanning, no risk of disturbing OT. Dual-NIC by default so the management plane never touches the traffic plane. 2 #### Automatic asset & third-party discovery The sensor reconstructs your asset inventory and vendor exposure map from what it actually sees on the wire — not from a spreadsheet last updated in 2023. Third-party services (SaaS, cloud, upstream vendors) are flagged as separate risk graphs. 3 #### Attack graphs & prediction-market inputs Discovered assets become nodes in an attack graph. For unscannable assets (OT, SCADA, air-gapped, legacy) the platform opens prediction markets so your team — or a broader expert pool — can price the paths that no scanner can measure. 4 #### FAIR-based dollar risk, on-box Monte Carlo simulation runs against the graph and produces an Annual Loss Expectancy in dollars, with confidence intervals. The number is defensible to a board, an underwriter, and a regulator using the same industry-standard method. 5 #### Signed compliance report — SMB1001, Essential Eight, SOCI The output isn't a dashboard alone. It's a report the customer can hand to their insurer, their board, or the regulator: SMB1001 Bronze → Diamond readiness, Essential Eight maturity, and SOCI four-hazard mapping — each with dollar-quantified evidence attached. --- ## One appliance, three modes The same platform runs in three coupling modes. The customer's assurance requirements pick the mode — not the other way around. | Mode | What runs on the box | Egress | Best for | | --- | --- | --- | --- | | **Sensor** | Capture & push agent only | HTTPS to central CyQuantiFi | Insurance & SMB assessments | | **Edge** | Full CyQuantiFi + capture | Optional one-way, ALE-only | Critical infrastructure & SOCI | | **Sovereign** | Full CyQuantiFi, air-gapped | **None** | Government, classified, PROTECTED-adjacent | **Why the modes matter.** Raw traffic never leaves the box in Edge or Sovereign mode. If aggregation happens at all, only the dollar output — the ALE and its confidence interval — is shared, and only in one direction. Sovereignty and OT-safety are engineered in, not policy overlays. --- ## Who it's for SEGMENT 01 ### Insurance & SMB channel **Job to be done:** underwriting evidence, loss-control input, and an SMB1001 readiness report the agency can hand to the insured. **Deployment:** the agency carries the box between clients for 24–48 hour captures. Report generated centrally. **Edge over the incumbents:** Coalition, At-Bay, and Cowbell do outside-in. This appliance sees inside-out — the data they can't reach. SEGMENT 02 ### Critical infrastructure (SOCI) **Job to be done:** passive visibility on unscannable OT/ICS, continuous quantified monitoring, and dollar-per-hazard evidence for CIRMP annual reports. **Deployment:** always-on industrial appliance, DIN-rail or 1U, per site. Egress optional and one-way. **Edge over the incumbents:** Nozomi, Claroty and Dragos give you visibility. CyQuantiFi gives you the quantification and compliance layer on top — the layer the board and the regulator actually read. SEGMENT 03 ### Government & sovereign **Job to be done:** sovereignty, classification hygiene, and ISM / Essential Eight / PSPF-aligned reporting inside an assured boundary. **Deployment:** air-gapped, no egress, offline licensing. Assured x86 industrial hardware with secure boot and TPM. **Edge over the incumbents:** the cloud-only CRQ vendors can't meet a PROTECTED boundary. A sovereign appliance is the whole pitch — not a footnote. --- ## Hardware options The Capture Appliance is packaged in three hardware tiers. A customer or channel partner can start on the reference design and step up as their assurance bar rises. | Tier | Platform | Suits | Assurance ceiling | | --- | --- | --- | --- | | **Reference** | Raspberry Pi 4 / CM4 build (documented spec, BYO) | Demos, insurance leave-behinds, SMB assessments | Assessment-grade | | **Industrial** | CM5 industrial (fanless, dual-GbE, extended temp) | SMB continuous monitoring, light critical infrastructure | Commercial-grade | | **Assured** | x86 industrial with secure boot & TPM (OEM partner) | SOCI, defence-adjacent, government | IRAP-scope target | --- ## Three ways to buy it 01 Reference design & BYO Software subscription only. You (or your MSP / broker) build the box to our published spec. Fastest path to a pilot. 02 Hardware + subscription Buy or lease the appliance plus an Enterprise subscription — priced against your Value-at-Risk, so cost scales with what the appliance is defending. 03 OEM / white-label A hardware partner ships the box; CyQuantiFi licenses the software and owns the assurance story. Built for critical infrastructure and government scale. **Insurance agencies & MSPs.** The reference design is built for you. Bundle 24-hour captures into your quarterly business review, hand the insured an SMB1001-mapped report, and use the ALE number to argue premiums. Talk to us about the channel programme. --- ## What we're shipping, and in what order We are honest about what is available today, what is in build, and what needs a design partner in the room before it ships. A #### Now — Reference SKU (Sensor mode) The Raspberry Pi build is documented, tested, and ready. Pilot programmes open to insurance agencies, SMB-focused MSPs, and consultancies who want to bundle it into an assessment. B #### Near — Edge SKU (full-local) Full CyQuantiFi packaged on a CM5-industrial or x86 box. Offline licensing, local secrets, optional one-way ALE sync. Target: one or two critical-infrastructure design partners. C #### Later — Sovereign SKU (air-gapped, OEM) Assured x86 industrial through an OEM partner, secure boot & TPM, IRAP assessment in scope. Deeper OT protocol coverage. Target: government and tier-one critical infrastructure. --- ## What we won't pretend to be We're a small Australian company. We're being deliberate about scope so we don't over-promise: **We are not an OT detection platform.** If you need deep Modbus / DNP3 / S7 anomaly detection, that's Dragos / Nozomi / Claroty. We consume passive capture — theirs or ours — and produce the dollar-and-compliance layer above it. **The Pi build is not a PROTECTED-grade appliance.** It's the reference and demo SKU. For government and sensitive-critical-infrastructure work, we ship the assured x86 tier through an OEM partner and are prepared for the IRAP conversation. **We won't run active scans on your OT.** Active-scan paths are hard-disabled on Edge and Sovereign builds. Everything is passive. If a mirror port isn't available, we walk away rather than take the risk. **We will not take your data off-site by default.** Raw traffic never egresses in Edge or Sovereign mode. If anything is aggregated centrally, it is the ALE number, one-way, on your terms. Data ownership is documented in the pilot agreement. --- ## Design partners we're looking for We're picking a small number of design partners to shape the first production release. What you get: the appliance at cost, direct access to the founder, joint authorship of the reference case study, and a locked-in launch-price on the first year of subscription. 2 Insurance agencies Australian cyber-insurance broker or agency who wants an inside-out data source and an SMB1001 report to differentiate on renewal. 2 SOCI-regulated operators Water, energy, ports, transport — anywhere Enhanced CIRMP applies and the annual report needs quantified evidence, not colour-coded assurances. 1 Sovereign / government Federal or state entity with an OFFICIAL or PROTECTED-adjacent boundary who wants a sovereign, on-appliance quantification story. ### See a Capture Appliance report on your own network Book a 30-minute call. If it's a fit, we'll run a 24-hour capture on your dev or lab environment and produce a full ALE + SMB1001 report you can keep — no obligation. [Book a demo →](https://cyquantifi.com/demo?hsLang=en) [Talk to Sam →](https://cyquantifi.com/contact?hsLang=en) [![cyquantifi-horizontal-dark](https://www.cyquantifi.com/hubfs/cyquantifi-horizontal-dark.svg "cyquantifi-horizontal-dark")](https://www.cyquantifi.com?hsLang=en) --- [Privacy Policy](https://www.cyquantifi.com/privacy-policy?hsLang=en) · [Legal](https://www.cyquantifi.com/terms-of-use?hsLang=en)· [Patents Pending](https://www.cyquantifi.com/patents?hsLang=en) · CyQuantiFi Pty Ltd © 2026. All rights reserved. [☎️ 02 5747 4163](tel:+61257474163) ABN: 67 697 329 105