Attestree
Get early access
FOR ENTERPRISE

Stop supply-chain attacks
at ingest, not at the endpoint.

Tens of thousands of endpoints, multiple business units, Tanium and ServiceNow already in place — and supply chain attacks keep getting closer. With a detonation host attached, Attestree detonates and attests each winget package at ingest, before it ships to a workstation.

Request access Talk to us
5,000+ endpoints Dedicated instance Detonation at ingest Rings + rollback
FLEET · 32,481 ENDPOINTS 14 BUs · 6 regions
  • ingest winget:Microsoft.PowerShell@7.5.3
    detonated · clean sig:c4e1…
  • halt winget:Vendor.Tool · signer changed
    held HALT
  • ring Mozilla.Firefox · pilot ring
    1,204 nodes sig:7a09…
  • cve KEV match · 41 endpoints
    flagged sig:bd71…
  • update choco/7zip · broad ring
    converged managed · not attested
  • export audit-bundle · Q3-2026
    signed sig:e45a…
dedicated instance · rings · signed audit 32,478 verified

On our horizon. Attestree is pre-GA and onboarding design partners. This page describes where we're heading for fleets at this scale — not a shipping product today. If that's you, come build it with us .

WHY THIS MATTERS HERE

Three things enterprise security teams ask us about first.

Detonate at ingest

Sandbox detonation and SBOM extraction happen before any endpoint touches the package. Supply-chain attacks die in the ingest stage, not on a workstation.

SIEM streaming, on the roadmap

Forwarding audit events to Microsoft Sentinel and Splunk is on the roadmap, not built yet. Today the signed audit log exports as a bundle your SOC can verify offline.

A dedicated instance in your subscription

A dedicated Attestree instance in your own Azure subscription, deployed and upgraded by us. An on-prem appliance is on the roadmap, not built.

WHAT YOU GET

The whole product surface, sized for enterprise.

Every Attestree primitive is enterprise-relevant. Pick a starting product, add the rest as your supply-chain control story matures.

/products/winget-enterprise In dev

Winget Enterprise

Attested install gate for winget; Chocolatey managed.

Read product
/products/inventory In dev

Inventory

One inventory across your package managers — winget and Chocolatey managed, Scoop inventoried.

Read product
/products/transforms Pipeline

Transforms

MSI/MST transforms generated from declarative policy.

Read product
PRICING

Commercial — request access.

Pre-GA pricing is design-partner friendly. Tell us about your fleet — we'll come back within two business days.

Dedicated instance Your Azure subscription Rings + rollback Signed audit export
ENDPOINTS

We'll only use this to schedule a 30-minute fit-check.

DESIGN-PARTNER QUOTE · TBD

"Design partner pipeline open. Be first to be quoted."

Your name here · CISO, enterprise design partner
COMPARE SEGMENTS

Same primitive, different posture.

Homelab
Hobbyists & enthusiasts
Free attestations for the winget packages your home fleet pulls.
Small business
5–100 endpoints
Attested install gates without a full SOC.
Mid-market
100–500 endpoints
Attested winget installs and managed Chocolatey, rolled out in rings with rollback.
SaaS engineering Horizon
Engineering-led security
SBOM-by-construction at ingest for npm and pip, next to the winget ingest that ships today.
Enterprise You are here Horizon
5,000+ endpoints
Detonate and attest packages at ingest, before they reach a workstation.
Financial services Horizon
Regulated environments
Signed, auditor-ready evidence for regulated Windows fleets.