The AI inventory
It sees the install, not the reach.
A list of every assistant on every laptop is a longer list. It does not say which one sits two hops from the historian.
Welcome to The Reachability Era
Inventory told you what you own. It never told you what an attacker can reach — and agents are about to make that gap fatal.
Your people adopted coding agents, assistants and MCP servers faster than anyone could review them, and every one of them runs as an identity with access. Setu finds them in the telemetry you already hold, puts them on the same map as every other identity, and shows which ones have a path to what matters.
An agent acts at machine speed on a credential someone issued for a person. Stop counting agents. Cut the paths they can take.
AI agents are identities
Three systems each see a piece of your agents. None of them can tell you whether the coding assistant on a developer’s laptop can get to a batch record.
The AI inventory
A list of every assistant on every laptop is a longer list. It does not say which one sits two hops from the historian.
The prompt filter
Filtering what a person types does nothing about the service account the agent quietly runs as.
The access review
The agent borrows a person’s session or a service key, so the review signs off on access without knowing an agent is using it.
Find
AI services show up in firewall and proxy telemetry, so Setu finds them without a new sensor. On developer laptops, an optional Setu agent also reads agent and MCP configurations, including the ones allowed to run commands without asking.
firewall · proxy · identity optional: agent + MCP configs
Join
An agent runs as someone: a service account, an API key, a borrowed session. Setu puts it on that identity’s node and asks the question it asks of every identity. What can this reach?
agent → identity → hosts → crown jewels
Cut
Where an agent has a path to a crown jewel, the fix is usually the identity it runs as or the hop it crosses. That leaves as a named campaign with an owner, like every other path.
scope the identity or cut the hop
Setu does not sit in the prompt path and does not block an agent inline. It tells you which agents can reach a crown jewel and what to cut. Enforcement stays with the proxy, EDR and identity provider you already run.
Walk a path end to endThe problem
Three systems each claim to know your estate. None of them agree, and none of them can tell you whether an attacker can actually get from a contractor’s laptop to a batch record.
The CMDB
It was accurate the week it was populated. It has been drifting ever since, and it never described a relationship — only a row.
The SIEM
Fifty thousand events tell you things happened. They do not tell you which two of them chain into a path to a crown jewel.
The scanner
A critical CVE on an isolated host is noise. A medium on your only jump host is the whole breach. The column cannot tell the difference.
That is the whole compression. Not a smaller queue — a different unit of work, one a team can actually finish and a board can actually read.
Validated paths
A severity column tells you a CVE is bad. It cannot tell you that four service accounts and one unmanaged jump host stand between a phished contractor and a GxP batch record. The graph can.
Cut the choke point and every path through it dies at once. That is one ticket instead of two hundred.
231
identities with a validated path to one crown-jewel account, at a manufacturer we work with. Their asset register named none of them.
How it works
Three beats. One graph.
Agentless reads across the SIEM, the lake, OT protocols and your identity provider. Nothing installed on a validated system, no change window, no sensor tax.
siem · lake · ot-passive · idp sensors: 0
Every identity, host, service account and trust lands in one derived graph — deduplicated, reconciled, and honest about what it could not confirm.
confidence-scored conflicts surfaced, not hidden
PageRank over that graph ranks nodes by blast radius, validated paths get named campaigns, and closed campaigns re-enter the graph as signed fact. Setu reads and reasons — write-back runs through a staged approval gate.
paths → choke points → campaigns proof re-enters graph
Named campaigns
Not a counter that resets every morning. A dispatch you can close, and a signed proof when it is closed.
Q3 · 12 open · 4 board-visible
Q3-PHARMA-JUMPHOST-ISOLATE
One RDP hop carries three paths into the OT cell.
Q3-PHARMA-DLP-RECON
Read access to GxP records from four unowned accounts.
Q3-OT-HISTORIAN-TRUST
Legacy trust lets plant IT reach corporate identity.
Q3-IDENT-SVCACCT-ROTATE
Nine accounts with no owner and no expiry.
Q3-VENDOR-VPN-SCOPE
Contractor tunnel terminates inside the process network.
Q3-PLC-CELL3-SEGMENT
Flat path from engineering VLAN to PLC cell 3.
Q3-MES-ADMIN-TIER
Domain admins log in interactively to the MES.
Q3-AI-AGENT-SVC-SCOPE
A coding agent runs as a service account that reaches the MES.
Q3-BACKUP-CRED-REUSE
One backup account reaches every crown jewel it protects.
Q3-LIMS-EXPORT-PATH
Lab results leave through an unmonitored share.
Q3-OT-JUMP-MFA
The only MFA exemption left is the one that matters.
Q3-SCADA-VENDOR-RDP
Standing remote access for a decommissioned contract.
Sovereign by construction
Setu is designed and engineered in India for Indian regulated industry. Nothing about your estate crosses a border to be understood, because nothing about your estate leaves the building.
LOCALISATION
No cross-border transfer to assess, because there is no transfer.
DPDP ACT 2023
Setu reads what you already lawfully hold. It creates no fresh data estate.
CERT-IN
Reachability context for an incident report, not a week of manual tracing.
GxP / CDSCO
No agent lands on a validated system, so no change control opens.
DEPLOYMENT
Your datacentre or a sovereign Indian cloud region. Your choice, either way.
CTEM, mapped to artifacts
The framework is not the product. The artifacts are.
Stage 1 — Scope
You name what matters — batch records, the historian, the GxP boundary. Setu resolves those names to nodes in the graph instead of asking you to maintain a tag taxonomy.
Artifact
scope.yaml crown_jewels: [MES, historian, PLC-cell-3] regulated: GxP · 21 CFR 11
Scope is an input, not a quarterly project.
Who acts, and how far
Setu does not ship one setting for your whole SOC. Every response action carries its own, and your team moves each one only as far as it trusts it. Start in the first column and move one action at a time.
ADVISORY
It explains. You act.
Every case shows why it surfaced and what cuts against it. For a response action, Setu records exactly what it would run and on which host, and calls nothing.
stage: advisory vendor called: no
APPROVAL BOUNDED
It prepares. You approve.
Setu stages the action and waits. A named person approves each step before it runs, and their name is stamped on the record. Containment starts here, and so does anything the assistant proposes.
stage: approval_bounded approved_by: a named analyst
POLICY BOUNDED
It runs inside your policy.
An admin can grant one specific action, such as isolating a host through your EDR, the right to run without a click. It runs inside that grant and nowhere else, and the admin can pull it back at any time.
stage: policy_bounded granted_by: your admin
This is not an autonomous SOC. Containment never runs unattended until an admin moves that one action past the approval gate, and every step, including who approved it, is written to the audit trail. Setu can seal and sign that trail so your auditor checks it without us.
See it
DEMO 01 · PATH-VIEW · ILLUSTRATIVE
Pick any node and ask the blast-radius question. Setu returns ranked, evidence-backed paths in seconds — with the choke point already marked.
> reach --from contractor-lt-0417 --to crown_jewelsresolving graph …3 validated paths foundP-1187 contractor → svc-batch-sync → jump-host → MESP-1188 contractor → jump-host → historianP-1191 vendor-vpn → jump-host → PLC-cell-3shared hop: jump-host-rdp ← choke point
Where the data lives
Setu reads in place. Your SIEM, your lake, your OT historian, your identity provider — the telemetry stays exactly where your auditors last found it. Compute moves to the data, never the reverse.
The whole system runs air-gapped, inference included. Nothing about your estate needs a round trip to somebody else’s cloud to be understood.
DEPLOYMENT
No outbound dependency. Inference runs on a local model inside your boundary.
DATA
Setu queries your lake. It does not copy it, index it elsewhere, or hold it.
OT
No agents on validated or safety-relevant systems. Nothing to requalify.
AUDIT
Every closed campaign carries a hash your auditor can check without us.
Who buys Setu
FOR REGULATED ENTERPRISES
You have a plant network you cannot touch, a regulator who wants evidence, and a security team smaller than the estate it defends.
FOR MSSPS & SYSTEM INTEGRATORS
Your clients already pay for a SIEM you manage. Setu turns that same telemetry into named campaigns you can bill, close and prove.
A five-minute read that ends in an honest checklist of where Setu is a fit and where it is not.
Regulatory reality
They ask it in different words, on different clocks. Setu answers all of them from the same derived graph, and leaves a signed artifact behind each time.
| Regulation | What it actually asks | Artifact |
|---|---|---|
| CERT-In Directions2022 · ALL SECTORS | Report cyber incidents within six hours and hold logs in India. The hard part is describing what the intruder could have reached before the clock runs out. | incident-reach.json paths: validated jewels_touched: 2 |
| DPDP Act2023 · PERSONAL DATA | Know where personal data sits and who can get to it. An access list is not an answer when four service accounts chain into the store. | identities_reaching_pii ranked by blast radius |
| SEBI CSCRF2024 · REGULATED ENTITIES | Continuous, measurable cyber resilience with periodic evidence. Not a scan report — a trend a board can re-check next quarter. | posture.q3 csf tier: 2 → 4 |
| RBI cyber frameworkBANKS & NBFCS | Demonstrate control over critical systems and third-party access. Vendor tunnels are where reachability quietly breaks the model. | vendor-scope.diff standing_access: 0 |
| GxP / 21 CFR 11CDSCO · US FDA EXPORT | Validated systems must stay validated. Anything installed on them opens a change-control record you do not want. | agents_installed: 0 change_controls: 0 |
Honest boundaries
| ReplacesYou can turn these off. | Sits besideWe read them, we do not fight them. | Does not touchSay so in the first meeting. |
|---|---|---|
| Spreadsheet crown-jewel registers | Your SIEM and data lake | Endpoint detection and response |
| Manual attack-path workshops | Your vulnerability scanner | Log collection and retention |
| Quarterly posture slide assembly | Your identity provider | Patch deployment |
| Standalone reachability tooling | Your ticketing and change process | Network enforcement |
What we can actually show you
Posture
Setu is a new category entrant. We are not going to show you a Gartner badge we do not have. We will show you a derived graph of your own estate in a two-week evaluation, on your hardware, and you can judge it against whatever you run today.
From the field
Industry Analysis
Exposure platforms can connect findings to business context. Their next test is whether an owner can make a defensible decision, trace its evidence and verify the result. Here is where Setu fits.
Perspective
As AI becomes more capable, trustworthy enterprise context becomes more useful. Setu connects identities, assets and activity so teams can investigate with a clearer view of what matters.
Strategy
Frontier labs are hiring forward-deployed engineers by the thousand. We read six years of Palantir shareholder letters and a new essay on why the labs are copying the wrong thing. Seven lessons for a security graph: tether the model, make the map actionable, make deployment compound, prove value in days, treat sovereignty and governance as the product, and get paid for value rather than volume.
Straight answers
Two weeks, your hardware, your telemetry, no sensors installed. You keep the graph either way.