FOR MID-MARKET

Answer the SBOM question
before a customer asks twice.

A hundred to five hundred endpoints, a small IT team, no dedicated security team — and customers, insurers and auditors now ask what runs on your fleet. With a detonation host attached, Attestree detonates each winget package, builds its SBOM and records an attestation before it reaches a machine, so the evidence trail is built at install time: by construction, not by scanner.

Request access Talk to us

100–500 endpoints Entra ID SSO Self-hosted or hosted Signed evidence export

FLEET · 312 ENDPOINTS drift: 2 nodes

sbom Microsoft.VisualStudio.2022

17.9.6 sig:c4e1…
ring Mozilla.Firefox · pilot ring

38 nodes sig:7a09…
update choco/7zip · broad ring

converged managed · not attested
drift fin-lt-042 · Git.Git

2.49.0 drift
cve KEV match · 3 endpoints

flagged sig:0fa9…
export evidence-bundle · Q3-2026

2.1 MB sig:e45a…

rings · drift · signed evidence 309 verified

WHY THIS MATTERS HERE

Three things mid-market IT teams ask us about first.

SBOM-by-construction

With a detonation host attached, every winget package is detonated in a real sandbox and gets a CycloneDX SBOM and an attestation at ingest, before any machine installs it. No post-install scan: the SBOM is built from the exact bytes your fleet runs.

Rings, halts and rollback

New versions go to a canary ring first, then pilot and broad. The opt-in update pipeline stops on its own when a publisher’s signing certificate changes, and a ring rolls back to its previous version in one action. Chocolatey packages deploy through the same rings.

Evidence you can hand over

Export a signed audit bundle — promotions, approvals and decisions — and verify it offline. The fleet CVE index matches CISA KEV against what is actually installed, so "are we exposed?" is a query, not a project.

WHAT YOU GET