versus{ networks }
Diagnostics

Versus Foresight

A continuously-synced digital twin of your multi-vendor network that lets Versus simulate any change before it runs — blast radius, reachability, policy and SLA risk — and verifies your network still does what it's supposed to, nonstop. The predict-and-prevent counterpart to Diagnostics AutoPilot.

Everything else in Versus tells you what already happened — an incident fired, a path degraded, a change broke something. Versus Foresight tells you what a change will do before you make it, and then keeps checking that the network still does what it's supposed to.

It does that with a network digital twin: a living, multi-vendor model of your estate that Versus builds from what it already collects — topology, configuration, and live device state. Because the twin is wired to the same engine that executes changes, Foresight closes a loop no other tool does: model → simulate → execute safely → verify.

Introducing. The capabilities below describe how Foresight works and how it's built on Versus you already run. Rollout is phased (see How it's delivered), and simulation is always read-only — it never touches a device.

The closed loop

Versus Foresight closed loop: a proposed change is simulated on a fork of the digital twin to produce a verdict — blast radius, reachability delta, policy and SLA risk, rollback cost — and a change gate passes only safe changes to the reversible workflow engine to execute and verify. The twin is grounded in topology (route_trace), a cross-vendor config model, and live 22-vendor probe state. Declared intents are verified continuously against the twin, and a violation opens an incident that triggers AI diagnostics.

Pre-Flight: simulate any change before it runs

Point Foresight at a proposed change — a workflow, a firewall rule, an F5 or ADC edit, a migration plan, a device upgrade — and it forks the twin, applies the change to the copy, and reports the delta:

  • Reachability delta — exactly which flows can and can't reach what after the change.
  • Blast radius — the apps, paths, and tenants affected.
  • Policy & compliance — any rule violated or resolved (shadowed rules, any/any, TLS floors).
  • SLA / capacity risk — paths pushed past latency or headroom limits.
  • Rollback cost — how cleanly it can be undone.

Every simulation is kept: the Foresight page lists your recent simulations (verdict, change kind, devices, who ran it and when), and clicking one reloads its narrative and device set so a plan can be revisited or re-run after the estate changes.

A Change Gate then requires a passing simulation before the change is allowed to execute — and because Versus owns the actuation layer, safe changes flow straight into the reversible workflow engine (with governed back-out), and risky ones are blocked or held for approval.

Grounded in reality, not just config

Foresight's twin has three layers, all from data Versus already gathers:

  • Topology — the L3/delivery path model (the same one the Network Map and diagnostics use).
  • Config — a normalized, cross-vendor model of your device configuration (the engine that also powers migrations).
  • Live state — health, sessions, routes, and pool-member status from native probes across 22 vendor families, reached securely through your collector.

That last layer is the difference: config-only analyzers can tell you a path is permitted; Foresight can tell you the pool member behind it is actually down.

Continuous intent assurance

Declare what your network must do — "subnet A reaches app.x:443 through the DC firewall at under 50 ms," "tenant A never reaches tenant B," "all internet ingress traverses a WAF." Foresight verifies each intent continuously against the twin and live probes. When one drifts — from a change or from the network itself — it raises an incident that triggers AI Diagnostics, anchored on exactly what broke.

Why it's different

Passive "network verification" tools model configs and stop there — single-ecosystem-leaning, blind to live state, and unable to act. Foresight is packet- and probe-grounded, cross-vendor, and closed-loop: the twin doesn't just analyze — it gates the change and verifies the result. Prevention becomes a property of the platform, not a separate product.

How it's delivered

Foresight is phased, each phase useful on its own:

  1. Twin + reachability — assemble the twin, query "can A reach B, and through what?"
  2. Pre-Flight for firewall & routing changes + the Change Gate on workflows and migrations.
  3. Simulation for ADC, upgrades, and migrations with blast-radius and SLA scoring.
  4. Continuous intent assurance and interactive what-if ("fail this device — what breaks?").
  5. SLA & capacity prediction and auto-suggested safe change ordering.

Related

  • Diagnostics AutoPilot — the reactive, incident-time counterpart that Foresight's intent violations feed into.
← All docsOpen a support case