The platform
One group. Six specialists.
General-purpose platforms spread thin. ZHASK builds narrow products that each go deep on one layer — bound by a single architecture and trust model.
- Cloud Security Posture Managementkaveo
- Middleware SecurityVectasec
- MCP Gateway SecurityAegis
- Layer 04 · In development
- Layer 05 · In development
- Layer 06 · In development
The thesis
Depth per layer beats breadth per invoice.
The platform-consolidation pitch trades depth for a single pane of glass. Forty checkboxes, each an inch deep, and the layer that actually gets you breached is the one covered least.
We build the other way — one product per layer, each built to be rigorous about that layer.
Three layers are live. Three are in development — unannounced until they ship, because roadmap vaporware is a trust tax we refuse to charge.
The shared trust model
Least privilege
Scans read through roles and credentials you scope. kaveo changes your cloud only through a separate write role you deploy, and only after an admin approves the fix. Aegis forwards only the tool calls your RBAC policy and threat checks allow.
Documented data boundaries
kaveo and Aegis run in your environment with no vendor data plane. With a Collector, Vectasec keeps credentials and raw configuration in your network and sends findings, their evidence and resource metadata to a hosted control plane. Self-hosting is in preview.
Evidence for every claim
Findings cite stored observations. kaveo keeps a SHA-256 hash of what each collection returned, Vectasec quotes the setting its rule read, and Aegis records its decisions in an HMAC-keyed, hash-chained audit log.
Deterministic detection
Rules decide findings. Optional AI explains and prioritizes, must cite stored evidence, and never creates a finding.
The lineup
Every layer, one owner.
+3 layers in development. Named when they ship.
Start with one layer.
Every product shares one trust model: least privilege, stored evidence and no silent writes.