Skip to content

Customer Portal

The customer portal at app.cyberarmor.ai is the tenant-scoped workspace for security teams validating CyberArmor.AI.

Mission Control

Mission Control is the default landing view. It rolls tenant posture into a practical readiness score based on:

  • policies created
  • endpoints or agents enrolled
  • telemetry received
  • audit or incident evidence generated
  • provider posture reviewed

The score is not a contractual security rating. It is a pilot-readiness guide that helps customers see the next best action.

Guided onboarding

Use SDK & Onboarding to move a tenant from blank state to demo-ready:

  1. create or review a policy
  2. enroll an endpoint, SDK, extension, or RASP package
  3. send a test event
  4. verify telemetry
  5. confirm an audit or incident evidence record
  6. export an evidence pack from Reports

Evidence export

The Reports & Evidence Export view can produce:

  • summary evidence packs for executive and demo review
  • full evidence packs for deeper audit or support handoff

Exports are tenant-scoped and generated server-side from the authenticated customer session. Write-only secrets are not included.

AI Traffic Filter set up for a different organization

The Endpoints page has a Filter set up for column, and each endpoint's detail has an AI Traffic Filter set up for line. It answers one question: is the AI Traffic Filter (the endpoint's local proxy) on this device set up for your organization's enrollment of it?

What you see What it means
This organization — "Checked: AI Traffic Filter on this PC is set up for this organization" The agent compared every signed-in user's filter setup with the device's enrollment, and all of them matched.
Other organization — "AI Traffic Filter on this PC is set up for a different organization — AI sites are blocked until someone runs 'Set up / repair AI Traffic Filter' on this PC" At least one signed-in user's filter was set up by an earlier enrollment to another organization. The affected Windows users are named.
Not checked — "Not checked: … — reason" The agent could not run the comparison (the reason is shown), the filter is not set up for the signed-in user, or the agent is a version that does not report it. Not checked is never shown as a match.

Why it happens. A PC that was enrolled to another organization (a pilot, a reseller's demo tenant, a previous owner) keeps each user's filter setup from that enrollment. Since agent 1.0.13-rc.9 the filter notices: it blocks AI sites with a page that names the repair, lets every other website work normally, does not check or report that user's AI traffic for anyone, and the tray shows Degraded. The portal never names the other organization — only that it is a different one.

A variant says the filter "is set up with an old credential for this organization": the device was re-enrolled or its key was rotated after the filter was set up. The repair is the same.

How to fix it (Windows).

  1. Sign in to the affected PC as each affected user named on the device.
  2. Choose Set up / repair AI Traffic Filter from the CyberArmor.AI icon in the notification area (or Start > Set up AI traffic inspection). Setup re-creates the filter from this device's enrollment.
  3. Setup asks for administrator approval inside that user's own session. A standard (non-administrator) Windows user cannot complete it, because Windows refuses an approval from a different account: an IT administrator must give that user local administrator rights while they run the repair, and remove them afterwards.
  4. After the device's next heartbeat the line reads This organization.

On a Mac, choose Set up AI-traffic inspection… from the CyberArmor.AI menu bar icon (or reinstall the package); on Linux, run install_local_proxy_linux.sh again.

The count. Under the Endpoints summary the portal prints how many endpoints have a filter set up for a different organization out of how many reported the check at all, with the number not checked — for example "1 of 12 endpoints that reported the check (15 in the fleet; 3 not checked)".

The email. The first time a device reports this, every active tenant admin is emailed the device, the affected users and the repair steps. It is sent once per occurrence — not on every heartbeat, not after an agent restart, and at most once a day per device — and only to your organization's admins. If more than three devices report it on the same day (UTC), the rest of that day's devices are listed in one summary email sent after the day ends. The device's detail says whether the email went out ("Tenant admins emailed …") or why it did not (for example, no mail server configured). Partners managing your organization see the same Endpoints page through Open portal in the partner console.

Seed a demo tenant:

bash scripts/demo/run_ciso_demo.sh

Then open:

  • Mission Control
  • SDK & Onboarding
  • Incidents
  • Reports & Evidence Export