Cernexa
All docs

Features

Governance & enforcement posture

Persistent allow/block decisions, your default posture, and automatic protections that follow software across versions and endpoints.

Where policies are rules that match patterns, governance is where you set your overall posture and make explicit decisions about specific software. Decisions follow software across versions and endpoints and are enforced automatically as agents report.

The Governance enforcement posture — default behavior plus automatic protections like critical-CVE auto-quarantine and signed agent auto-update.
The Governance enforcement posture — default behavior plus automatic protections like critical-CVE auto-quarantine and signed agent auto-update.

Enforcement posture

The posture controls what happens when no policy or explicit decision matches an install:

  • Default behavior — Allow (permissive) or Deny (locked-down).
  • Auto-quarantine critical — quarantine software with an actively-exploited (CISA KEV) or critical CVE regardless of posture, even under a permissive policy. It honors explicit allow exceptions and never touches report-only endpoints.
  • Auto-update agents — offer outdated endpoint agents a signed, SHA-256-verified self-update to the latest version. This applies to report-only endpoints too, because updating the agent's own binary is maintenance, not enforcement. macOS and Linux apply immediately; Windows applies on the agent's next start.

Active decisions

The decisions list shows every org-level allow or block you've made — the artifact, the decision, the reason, who made it, and when. You can revoke any decision.

Make a decision from an artifact's detail page: Allow org-wide or Block org-wide, each requiring a reason. Decisions can be scoped org-wide or to a single endpoint, and they're sourced as manual (you), policy (triggered by a rule), or auto (an automatic protection like critical-CVE quarantine). Every change is recorded in the audit log.

How enforcement reaches endpoints

Decisions and quarantines are only delivered to endpoints in active mode. Endpoints in report-only mode observe and report but never receive enforcement commands — so you can adopt a strict posture safely and switch devices to enforcement when you're ready. See Endpoints.

Install status

As governance and policy resolve, each install carries a status: discovered (no decision yet), approved, blocked, or remediated (a remediation command was delivered and executed).

Related