EXTERNAL GROUP
customers
Network clarity, built into the host
See the network.
Define the intent.
Avskil helps you see which servers communicate and control which connections are allowed. A central controller maps observed traffic and manages policy; agents on your servers enforce approved rules through the host firewall.
Linux-first technical preview · actively developed in a dedicated lab
APPLICATION
commerce
3 managed workloads
HTTPS
API
PostgreSQL
web01
172.31.20.11
ⓘ INFO healthy
api01
172.31.20.12
ⓘ INFO enforcing
db01
172.31.20.13
ⓘ INFO enforcing
01Observe before enforcing
02Think in applications
03Review every change
04Recover independently
One environment, two truths
Intent and reality,
side by side.
Microsegmentation limits communication between workloads to the connections they need. Avskil separates what you observe from what you allow: begin with visibility, define policy around applications, then review changes before enabling enforcement.
PIM / 01
Policy intent map
Express who should communicate, using services, applications and managed nodes instead of a wall of low-level rules.
- Draft before applying
- Collapse application scope
- Review exact affected targets
OTM / 02
Observed traffic map
Explore recent communication as a read-only operational view. Filter the noise, inspect services and understand where traffic was seen.
- Flow-focused visibility
- Known and observed endpoints
- Optional blocked-traffic evidence
A deliberate workflow
From evidence
to enforcement.
- 01
Observe
Agents report bounded network metadata and host context to reveal actual communication.
- 02
Model
Group workloads by application, environment, role and site. Turn endpoints into understandable systems.
- 03
Define
Draw the intended connection, select a service and review the exact pending change.
- 04
Enforce
Deliver signed, versioned policy through a narrow path with atomic activation and independent rollback.
Safety is part of the architecture
Fail closed.
Recover locally.
Microsegmentation should never depend on hope. Avskil is being built around narrow privilege boundaries, deterministic policy and an endpoint-local recovery path.
Signed and target-bound
Policy candidates are versioned and bound to the intended managed node.
Atomic host enforcement
Dedicated nftables state is validated before activation without flushing unrelated rules.
Independent rollback
An endpoint watchdog can restore committed policy even when the controller disappears.
Technical preview
Built in the open-minded spirit
of network operations.
Avskil is under active development and lab qualification. The current focus is Linux visibility, understandable policy authoring and safely recoverable host enforcement.
Where Avskil is going
A practical path
to wider adoption.
Avskil is a Linux-first microsegmentation system under active development—not a finished commercial service. Its foundations are being qualified in a controlled lab before the platform expands.
- Now
Core Linux workflow
Application-aware traffic visibility, reviewable policy intent and recoverable host enforcement are working together in the Debian lab.
- Next
Simpler rollout
Finish self-contained controller and managed-node installation, including authenticated downloads and safer operational recovery.
- Then
More Linux environments
Qualify additional enterprise distributions, cloud deployments and ARM-based systems without weakening the safety model.
- Later
Beyond Linux
Extend the same visibility, policy and recovery principles to Windows with a platform-native agent and enforcement path.
Start a conversation
Curious about
Avskil?
Avskil is still taking shape. If the problem feels familiar, you are evaluating microsegmentation, or you would like to follow the technical preview, we would be glad to hear from you.
[email protected]