2026-09-296 min read
Deny by default is something you check, not assume
What NIST SC-7(5) and AC-4 actually ask of a rule base, the six ways deny-by-default quietly erodes, and how to check it with objects and NAT resolved.
9
vendor families
read over their own APIs and SSH
<400ms
to answer most queries
from the local copy, not the device
5 min
from docker run to an inventory
one container, one VM
0
calls home
no telemetry, works air-gapped
What it does
The questions you ask every week, answered in one place.
We built it after one too many incidents spent flipping between vendor consoles to answer a single question.
Discovery
Where is that MAC address?
Every endpoint from every switch, router and controller, in one table you can search.
Analysis
Will this flow get through?
Trace a flow hop by hop and see which rule stops it.
Monitoring
What changed since yesterday?
Real configuration diffs, without the noise from counters and timestamps.
Performance
Answers in under a second
Searches run on a local copy, not on your devices.
Reliability
APIC clusters handled for you
If one controller stops answering, SAMURAI moves to the next.
Compatibility
Knows what it’s talking to
IOS, NX-OS, IOS-XR, PAN-OS, FMC and ASA are detected automatically.
AI that can tell routine from risky.
It checks every configuration change against what it knows about your network, so routine changes stay quiet and risky ones get flagged.
- Plain facts you can read and correct
- A severity and a reason for every change
- Runs on a local model or in the cloud
Network engineering
Close the other five consoles
- Search any endpoint
- Trace a flow to the rule that stops it
- Compare two snapshots
IT leadership
Know what you actually run
- Nine vendor families, one inventory
- A change history auditors can read
- Runs on your own server
Security operations
Spot unapproved changes first
- Real configuration diffs
- Alerts in Slack, Teams, Telegram or email
- LDAP and SSO sign-in
Integrations
Alerts go where your team already looks
Email (SMTP)
Slack
Telegram
Discord
Microsoft Teams
Syslog (SIEM)
Webhook
TheHive
Jira
Ollama (local)
OpenAI / compatible
Claude (Anthropic)
Amazon Bedrock
Compared with AlgoSec
Your incumbent is fine. It just stops at the firewall.
Policy suites like AlgoSec are better at rule recertification and approval workflows, and we’ll tell you so. SAMURAI covers what sits around your firewalls: switches, ACI fabrics, ISE and vCenter, in the same view as the rules.
Side by side
What you getSAMURAIAlgoSecSolarWinds
Switches, fabrics and firewalls in one inventory✓✕✕
Configuration diffs without an agent✓✕
Runs fully air-gapped✓✕
Effective access and rule hygiene✓✓
Installs as one Docker container✓✕✕
Deploy
From docker run to a full inventory in five minutes
Pull the image, start one container, add your device credentials. Nothing gets installed on your devices, and nothing phones home.
- Runs inside your network, and your configs stay there
- One container on one VM
- Works air-gapped, with no telemetry
- Free test license, no signup
Field notes
Notes from the build
What we learned building SAMURAI: vendor API quirks, what NIST 800-53 actually asks of network teams, and why diffing configs is harder than it looks.