Most of the compliance evidence we collect at RealCISO comes from cloud and identity providers — AWS, Azure, GCP, Okta, and the like. That evidence is good, but it only describes what those platforms can see: accounts, managed infrastructure, configured policies. It says nothing about the laptop your controller uses, the on-prem file server nobody’s touched since 2019, or the VM running a legacy app that predates your cloud migration. If it’s not in the cloud provider’s API, it doesn’t exist as far as that evidence is concerned.
That’s the gap Enclave fills, and it’s why we built an integration with it.
What Enclave is
Enclave, built by SideChannel, is a zero-trust microsegmentation and asset intelligence platform. Its agents sit on your devices — servers, laptops, VMs — and report back what’s actually there: installed software, open vulnerabilities, host firewall status. Enclave also enforces network segmentation, controlling which workloads can talk to which.
In other words, Enclave sees the machines themselves. That’s a different vantage point than a cloud API, and it’s the one most compliance programs are missing evidence for.
What RealCISO collects
Connect your Enclave management console to RealCISO and we pull point-in-time snapshots across six areas, and run 14 automated tests against them:
- Asset inventory — agent-reported and network-discovered devices, OS details, firewall state, whether assets have been triaged
- Software inventory — package counts, which ones carry known CVEs, and the critical/high-severity detail
- Vulnerability management — every active critical and high CVE, with CVSS score, EPSS score, affected asset count, and age
- Host firewall coverage — how much of your agent-managed fleet has host-based firewall active
- Microsegmentation — your enclaves (microsegments), their firewall rules, and which nodes belong where
- TLS certificates — certificates Enclave has actually observed being served, with expiry, issuer, and algorithm details
These are raw evidence pulls, not pass/fail judgments. The tests are informational — they flag things like certificates expiring within 30 days or critical CVEs open longer than 30 days, but they never touch your control assessments directly.
How it works, and what it doesn’t do
RealCISO connects with a read-only API key. Every request is a read. We don’t touch firewall rules, enclave membership, or agent configuration — full stop. If you want to verify that yourself, RealCISO connects from a fixed set of egress IPs you can allowlist.
Setup takes two steps: create an API key in your Enclave console (you need Owner or Admin there — Managers can’t create keys), then add it under Settings > Cloud Integrations in RealCISO. You need Admin or Owner in RealCISO to do that part. Asset, microsegmentation, and vulnerability data refresh every 12 hours; software and certificate inventory refresh every 24. You can also trigger a manual sync any time.
One thing worth being direct about: this doesn’t replace a vulnerability scanner. Enclave scans agent-managed assets daily against NVD and platform trackers, and we collect that as evidence — but anything without an Enclave agent isn’t scanned. If part of your estate is unmanaged, you still need another evidence source to cover it.
Why this matters
Cloud and identity integrations tell you about your accounts. Enclave tells you about your machines. For anyone running a real asset management, endpoint hardening, or vulnerability management program — not just checking a box for it — that distinction is the whole point. This integration means the evidence for those controls doesn’t have to be a screenshot someone remembered to take before an audit. It’s there, refreshed automatically, from a system that already owns the ground truth.
If you’re running Enclave and RealCISO today, connecting the two takes about five minutes. If you’re not running Enclave yet and you’ve got a mixed fleet of managed and unmanaged devices, it’s worth a look — SideChannel.