Home / Editions
One core, many buildsEditions
Every edition runs on the same core. A capability policy decides what mounts, so a defensive-only install never carries offensive tooling.
One core. A module like Blue or the full range.
RODEO is built as a single platform that ships in editions. Every edition runs on the same core; a capability policy decides which routers a deployment can mount, so a defensive-only install never carries offensive tooling.
RODEO Core Available today
The shared foundation every edition builds on — authentication, database, event bus, the autonomous pipeline, the ML SDK, and the app factory. 34 core API routers.
Blue · SOC edition Available today
Defensive-only security operations: EDR/XDR management, threat hunting with Sigma, threat-intel & IOC enrichment, SIEM optimization, automated alert triage, incident response, compliance drift, and continuous watchers. 69 blue routers and a Rust host sensor — no offensive tooling ships.
Full platform Available today
Adds offensive reach for red and purple teams — vulnerability scanning, exploit generation, reverse-engineering tooling, and ICS/SCADA coverage — all gated behind capability policy and human-in-the-loop approval.
ICS / OT edition Available today
OT-defensive operations for industrial and SCADA environments — protocol-aware monitoring, ICS asset visibility, and safety-pinned response tuned for networks where an automated containment can affect a physical process.
Red · Offensive edition Available today
Offensive-only tooling for red teams — vulnerability scanning, generative exploit drafting, reverse-engineering support, and ICS-offensive coverage, all capability-gated and human-approved.
Purple-team edition Available today
The full purple loop on one platform — offensive findings become detections and approval-gated playbooks on the defensive side, with red and blue sharing a single data model.
Incident Response edition In development
Automated incident response — approval-gated playbooks, alert triage, and case handling driven by a purpose-trained IR model, with a human sign-off before high-impact actions run.
Forensics edition In development
Digital-forensics investigations — evidence collection, timeline reconstruction, and artifact analysis driven by a purpose-trained forensics model.
Reverse-engineering edition In development
Reverse-engineering support — binary and malware analysis assisted by RODEO's code-reasoning model, for understanding what an artifact actually does.
Adversarial-ML edition In development
Red-teaming and hardening for the AI models themselves — adversarial-example and evasion testing, data-poisoning checks, and model-integrity monitoring for the detections RODEO's proprietary models drive.
Mission-critical, regulated, disconnected
The organizations with the highest consequence of a missed intrusion often run the least-automated security — because they can't send their data to a cloud.
Defense industrial base
Contractors carrying a mandatory NIST 800-171 / CMMC obligation and an SPRS score to file, with no night shift and no permission to send CUI to a cloud vendor.
Classified & air-gapped enclaves
Networks that run with no egress by design and by contract, where offline reasoning and explainable actions are non-negotiable.
OT / ICS operators
Industrial environments where an automated containment can stop a physical process — safety-pinned autonomy with ICS-aware handling.
DoD & federal programs
Mission owners working toward target-level zero trust, where Automation & Orchestration is a funded pillar with a deadline.
Regulated enterprise SOCs
Teams scaling security operations without proportional headcount, that need evidence-grade compliance alongside detection and response.
Find the right edition
Tell us about your environment and we will recommend an edition and deployment profile.