versus{ networks }
Security & Trust

Collective Defense

Federated fleet intelligence — every Versus deployment makes every other one smarter and safer. Anonymized signatures from opted-in sites power coordinated CVE and threat advisories, fleet-proven playbooks, predictive early-warnings, and benchmarking — with a zero-raw-data privacy guarantee.

A failure signature, a bad-config anti-pattern, or an actively-exploited CVE that shows up at one network is a warning every other network could act on — if only they could see it in time. Collective Defense makes that happen: it turns the Versus fleet into a shared immune system, where a lesson learned at one deployment protects all the others.

It's the same idea endpoint security used to change its industry — one sensor sees a threat, every sensor is protected — brought for the first time to multi-vendor network, ADC, and firewall operations. And it's built so that no customer's data ever leaves their network in identifiable form.

Opt-in and private by construction. Contribution is per-tenant, revocable, and audited. Signals are anonymized on your collector before anything is sent — only structural signatures cross the boundary, never raw configs, packets, secrets, or identifiable topology. You can consume fleet intelligence without contributing.

How it works

Versus Collective Defense: many customer deployments each run a collector producing AutoPilot root causes, vulnerability matches, and config signals. On-collector edge anonymization strips IPs, hostnames and secrets so only sanitized signatures cross the privacy boundary into the Versus cloud, where a Fleet Intelligence service mines threat and CVE advisories, fleet-proven playbooks, predictive precursor patterns and benchmarks under k-anonymity and differential privacy, then targets them by inventory match back to each affected deployment as a Desk incident that triggers AutoPilot governed mitigation.

What the fleet gives back

  • Coordinated threat & CVE response. When an exploit or CVE goes active at one site, every site running the affected vendor and version gets an early-warning advisory — matched to your actual inventory, not a broadcast — that opens a Desk incident and can trigger AutoPilot to mitigate under your governance.
  • Fleet-proven playbooks. Remediations that have succeeded across many deployments become vetted, ranked playbooks. When AutoPilot diagnoses a signature that has one, it recommends the fix the fleet has already proven — with real success statistics behind it.
  • Predictive early-warning. Precursor patterns learned across the fleet ("this pool-flap plus memory climb preceded an outage at k sites") warn you before the incident, with the proven playbook attached.
  • Benchmarking & posture. See how your MTTR, patch latency, config hygiene, and reliability compare to the anonymized fleet — and get concrete, "sites like yours fixed it by…" guidance.

Private by construction

Collective Defense is designed so the privacy guarantee is structural, not a promise:

  • Edge anonymization. Signals are sanitized on your collector before transmission — IPs, hostnames, and identifiers are stripped or tokenized with a per-tenant salt. Only structural signatures (vendor, version, symptom class, root-cause class, precursor pattern, remediation outcome) ever leave.
  • k-anonymity + differential privacy. No advisory, pattern, or benchmark is derived from fewer than k distinct deployments, and aggregates carry privacy-preserving noise. A signature unique to you is never shown to anyone else.
  • Federated learning. Predictive models can be trained locally and share only aggregate updates — never your rows.
  • Opt-in, revocable, audited. You choose what to contribute (incidents, threats, config, benchmarks — independently), you can consume without contributing, and a contribution log shows exactly what left.

The central service only ever holds the sanitized signal stream; your raw data stays behind your collector under the same tenant isolation as the rest of the platform.

Why only Versus can do this

Single-network tools see one network. Appliance vendors see only their own boxes. Versus already runs a secure collector fabric across many multi-vendor customer networks, with an AI diagnostics engine producing structured root causes and a workflow engine that can act on them. Collective Defense is what that footprint makes possible — and the moat compounds: the more deployments, the earlier the warning and the more battle-tested the fix.

How it's delivered

Phased, safest-first:

  1. Benchmarking — read-only posture comparison (opt-in signal pipeline + edge anonymization).
  2. Coordinated CVE / threat advisories — inventory-matched early warnings into your Desk.
  3. Fleet-proven playbooks — ranked, vetted remediations surfaced in AutoPilot.
  4. Predictive precursors & config anti-patterns — early-warning before the incident.
  5. Federated model training and governed coordinated auto-mitigation.

Related

← All docsOpen a support case