Multi-vendor by design
No hard-coded parser per vendor. The model interprets the CLI, the baseline schema absorbs it. A new vendor or firmware version is taught once through a training GUI, with no code redeploy.
Product · Network compliance auditor
Every device, every control,
checked before the change window closes
The Walrus network compliance auditor is an automated tool that reads network device configurations from any vendor, normalises them into one vendor-neutral security baseline, and checks every applicable hardening control from CIS Benchmarks, NIST SP 800-53, DISA STIGs and ISO 27001. Each pass or fail cites the exact configuration line it came from and ships with the remediation command for that device.
Point it at a running-config, a config repository or the devices themselves. Get back one hardening report per device, in minutes, with nothing skipped and nothing leaving your network.
core-sw-01 · Cisco IOS 15.9118 pass · 14 fail
| CIS 1.2.4 Telnet enabled on VTY linesline vty 0 4 · transport input telnet ssh | Fail · High |
| STIG V-215807 SNMP community is "public"snmp-server community public RO | Fail · High |
| NIST AU-12 Logging to a remote hostlogging host 10.20.0.5 | Pass |
| ISO A.8.20 NTP authenticatedntp authenticate · ntp trusted-key 1 | Pass |
Remediation · Cisco IOS
line vty 0 4
transport input ssh
no snmp-server community public- vendors via Netmiko and NAPALM collection
- 40+
- frameworks: CIS, NIST 800-53, DISA STIG, ISO 27001
- 4
- of applicable controls returned every run
- 100%
- external calls. Open-weight model, on-prem
- 0
The problem.
Misconfiguration, not zero-days,
is what actually gets breached
99% of firewall breaches are misconfigurations
Gartner's number, and every network team already knows it. The devices are patched. The Telnet line, the public SNMP community and the permissive ACL are what an attacker walks through.
Half a day per device, by hand
A manual hardening audit means an analyst reading a CLI against a spreadsheet of controls. Under time pressure, controls get skipped, and the skipped ones are never the easy ones.
Vendor suites that only speak one dialect
Cisco's tool audits Cisco. The moment a fleet mixes Juniper, Arista, Palo Alto or a white-box switch, there is no single source of truth for what compliant even means.
How it works.
One config in,
one hardening report out
- 01 / Ingest
Any vendor configuration
Upload a config, pull it live over Netmiko or NAPALM, point at a Git config repository, or push through the REST API. Cisco IOS, Juniper Junos, Arista EOS, PAN-OS, FortiOS, cloud security groups.
cisco.cfg · juniper.conf · arista.cfg · pan.xml - 02 / Normalise
Into one security baseline model
An on-prem, open-weight model reads the proprietary syntax and proposes structured fields. Management access, logging, authentication, SNMP, NTP, ACLs, routing protocol security: one neutral schema for every device class.
mgmt.telnet_enabled: true → flagged - 03 / Check
Against the control knowledge base
A deterministic rules engine evaluates every control whose device class matches. The model never issues a verdict. A checklist gate refuses to close the audit until each applicable control has a pass or fail.
CIS-CISCO-IOS-1.2.4 · STIG · AC-17 · A.8.20 - 04 / Report
Pass, fail, evidence, fix
A per-device PDF with severity-ranked failures, the configuration line each verdict came from, and the exact remediation CLI for that vendor and model. Fleet summary on top for the CISO.
line vty 0 4 / transport input ssh
Capabilities.
Built to miss nothing,
and to prove it
Four frameworks, one control knowledge base
Each control carries its CIS, NIST 800-53, DISA STIG and ISO 27001 mappings, a severity, the reason it matters and the remediation for every supported vendor. Audit once, report against any framework.
Verdicts the AI cannot hallucinate
The model only parses. Pass or fail is decided by deterministic rules over the knowledge base, and every verdict is linked to the source configuration line in an append-only evidence log.
Structurally unable to skip a control
The checklist gate from the Walrus Harness engine will not let an audit close until every applicable control has a result. Coverage is 100% of the applicable set, on every run, not a sample.
Fleet scale with a live ledger
An orchestrator queues one task per device. A fleet of workers pulls work, coordinates through a shared ledger and re-queues cross-referenced objects such as nested ACLs. One device or ten thousand, same engine.
Air-gapped, sovereign, yours
Open-weight model on your hardware. No external API calls, no configs leaving the building. Deployable on an air-gapped server, a private cloud or a single laptop. Fit for NCIIPC-class critical infrastructure.
At a glance.
What it takes in,
what it gives back
| Device classes | Routers, switches, L3 switches, firewalls, wireless controllers, cloud security groups |
|---|---|
| Vendors | Cisco IOS / IOS-XE / NX-OS, Juniper Junos, Arista EOS, Palo Alto PAN-OS, Fortinet FortiOS, HPE Aruba, MikroTik, plus 40+ via Netmiko and NAPALM. New vendors trained via GUI. |
| Frameworks | CIS Benchmarks (per vendor), NIST SP 800-53 Rev. 5, DISA STIGs, ISO/IEC 27001:2022 Annex A |
| Inputs | Config file upload, live pull (Netmiko / NAPALM), Git config repository, REST API |
| Output | Per-device PDF: pass/fail per control, severity, cited config line, remediation CLI. Fleet summary. JSON export. |
| Deployment | Air-gapped server, private cloud or single laptop. Open-weight LLM on a mid-range GPU. No external calls. |
| Integration | REST API, webhook on audit completion, CI check on config repo pull requests |
| Time to first report | Minutes after upload. Fleet audits run in parallel across workers. |
Compared.
The audit you run today,
and the one you could
| Criterion | Manual audit | Vendor-locked suite | Walrus |
|---|---|---|---|
| Vendors covered | Whatever the analyst knows | One vendor's own devices | Any vendor, trained once via GUI |
| Time per device | Half a day | Minutes, for supported devices | Minutes, whole fleet in parallel |
| Control coverage | Skipped under time pressure | Vendor-chosen subset | 100% of applicable controls, gated |
| Evidence per verdict | Analyst's notes | Rarely line-level | Exact config line, append-only log |
| Frameworks | One spreadsheet at a time | Usually CIS only | CIS, NIST 800-53, STIG, ISO 27001 |
| Fix guidance | Look it up | Generic | Vendor-specific remediation CLI |
| Data residency | On-prem | Often cloud-managed | Air-gapped, no external calls |
| Licensing | Analyst hours | Per vendor, per device | One engine, 1 to 10,000 devices |
Any questions?
Questions network teams ask,
before they let anything read a config
What is an automated network compliance auditor?
Software that reads network device configurations and checks them against published hardening standards such as CIS Benchmarks, NIST SP 800-53, DISA STIGs and ISO 27001, then reports which controls pass, which fail and how to fix them. Walrus does this for any vendor from one engine, with every verdict tied to the configuration line it came from.
Which vendors and devices does it support?
Cisco IOS, IOS-XE and NX-OS, Juniper Junos, Arista EOS, Palo Alto PAN-OS, Fortinet FortiOS, HPE Aruba, MikroTik and the 40+ platforms reachable through Netmiko and NAPALM. An unseen vendor or firmware format is taught once through the training GUI without a code change.
Does the AI decide whether a control passes?
No. The model only parses the configuration into structured fields. The pass or fail decision is made by deterministic rules over the control knowledge base, and each verdict cites the exact configuration line. That is what keeps hallucination out of the audit result.
Can it run without internet access?
Yes. The auditor uses an open-weight model on your own hardware and makes no external calls. It deploys on an air-gapped server, a private cloud or a single laptop, which is what critical-infrastructure and NCIIPC-class environments require.
How is this different from a Cisco or Palo Alto compliance tool?
Those audit their own devices against their own subset of controls. Walrus normalises every vendor into one baseline model and audits the whole fleet against all four frameworks, so a mixed Cisco, Juniper and Arista network gets one definition of compliant and one report format.
Does it replace a compliance certification or audit?
No. It makes you audit-ready: complete control coverage, line-level evidence and a report an auditor can verify. Certification stays with your auditor. Walrus makes their job, and yours, take hours instead of weeks.
Book a demo.
Tell us what you ship.
We'll show you how it breaks.
- 01
A 30-minute call. You bring one product, we bring an attacker's read of it.
- 02
A scoped first scan on one target within the week, with real findings, not a slide deck.
- 03
A sample report you can hand to your buyer's security team the same day.