For IT leaders, CIOs and CISOs
The technology behind our products.
We recommend no component we have not closed tickets on ourselves. Here is what we work with, and how.
Nova9: the platform under every Nova product
Nova9 drives business playbooks, supported by language models, controlled by guardrails. Agents act only within the rules, and every action is written to the audit log in your environment.
Nova9 is the evolution of an approach we proved in production in large mandates: automated operations on a single, versioned source of truth.
Building blocks
- LLM Gateway Guardrails, budgets, filters and audit ahead of every model. The foundation of Nova Gate.
- Business Agents ERP, CRM, Microsoft 365 and ticketing, integrated into your operations. Part of Nova Change.
- Endpoint Agents Autonomous agents on endpoints, active even without a connection. Part of Nova Run.
Operating models
EU cloud: Data centers in the EU or in Germany, responsibility with dynexo.
On-premises: In your infrastructure, handed over to your team, clonable.
Air-gapped: No internet access, with a signed update path.
In every one of these models, models run wherever it fits, up to and including the provider, always with zero retention: your inputs are not stored and not used for training.
Your instance fits in a virtual machine. On request you receive the snapshot and can run the platform yourself.
The stack we take responsibility for
Three layers stacked: infrastructure and network, applications, services and processes. Beside them two columns, security and AI, spanning all three layers and connected to them. Below, the note that one responsibility covers the whole stack.
Outside, public models; between them, the LLM Gateway as the only connection; inside, the customer's environment with its own models, data and logs.
Rules as code
One source: Security and business rules live as versioned code. No shadow configurations, no drift.
Cites the rule: Every process references the rule it is checked against.
Stays inside: Agents can act, but never beyond the rule. Switching a vendor costs time, not control.
Traceable to the rule: Every action can be traced back to the rule that triggered it. No scramble for an explanation in front of an auditor.
Example: patch rollout, driven by agents
Anonymized excerpt of an actual run, Q1 2026, mid-market mandate. Logged in the customer's own instance.
- 14:00 Machine Vendor advisories (Microsoft, Red Hat, Cisco) merged, 47 new vulnerabilities identified
- 14:02 Guardrail 12 classified as critical, 81 affected systems identified
- 14:05 Human Operations lead approves a test run for 12 systems
- 14:10 Machine Test group updated, services checked
- 14:25 Guardrail Logs, latency and error rates within range, no regressions
- 14:30 Human Analyst reviews the report and approves the rollout in waves
- 14:32 Machine Wave 1 of 3, 24 systems, no more than 8 at a time
- 15:04 Guardrail Wave 2: one system with elevated load automatically rolled back
- 15:18 Human Root cause investigated on the affected system, update rescheduled separately
- 15:46 Machine Wave 3 of 3, 21 systems updated
- 15:58 Machine Report and log generated, handed to the ticketing system and the CISO
1:58 hours · 69 of 70 systems updated · 1 automatic rollback · 3 human approvals
The stack we work with
| Layer | Description | Vendors |
|---|---|---|
| Firewalls | Configuration, hardening, audit. | Cisco, Check Point, Palo Alto Networks, Fortinet, Cisco Secure Firewall |
| SASE and SSE | Secure access for hybrid workforces, zero trust. | Palo Alto Prisma, Netskope, Cato Networks, Zscaler, Cisco Umbrella, Fortinet |
| SD-WAN | Site interconnection, integrated into the security rules. | Palo Alto Prisma SD-WAN, Cato Networks, Fortinet, Versa Networks, Cisco Viptela |
| Data center and segmentation | A single source of truth for segmentation, fully automated. | Cisco ACI, VMware NSX, Arista CloudVision, HPE Aruba CX |
| Web and mail proxies | Content filtering, SSL inspection, email security. | Zscaler, Cloudflare, Cisco WSA |
| Load balancers | High-availability publishing, TLS offload, WAF. | F5, HAProxy, Citrix NetScaler, Cloudflare |
| Identity | Lifecycle, federation, conditional access. | Microsoft Entra, Okta, Auth0 |
| Privileged access | Just-in-time, session audit, four-eyes principle. | CyberArk, Teleport, BeyondTrust |
| SIEM and detection | Correlation, detection rules, documented processes. | Splunk, IBM QRadar, FortiSIEM |
| OT gateways and segmentation | Secure bridges between IT and OT. | Fortinet, Cisco IE, Claroty, Nozomi Networks, Dragos |
| Assessments | Architecture reviews, penetration tests, red team. | Burp Suite Pro, Metasploit, Nmap, PentestGPT |
A technical conversation, not a sales pitch.
Talk directly with an engineer about your environment.