MACE unifies threat signals from every tool into one explainable score — then auto-drafts the regulatory evidence your incident just triggered. FedRAMP, GDPR, NIS2, DORA, NESA. Minutes, not hours.
$ mace agent install && mace scan --fleet ✓ 1,247 assets resolved across CrowdStrike · Tenable · Splunk · Axonius ✓ Identity graph built — 11 asset classes, hardware-ID confidence scoring ▲ CDCS 9.6 / 10 — CRITICAL srv-fin-012 (internet-facing, banking) V CVE-2026-31337 · EPSS 0.94 · KEV listed N C2 beacon + 2 lateral hops I impossible travel · privilege escalation KC exfiltration stage ×1.5 → UREA evidence automaton triggered ✓ GDPR Art. 33 draft — 72h deadline · ready in 4m 12s ✓ DORA ICT report — 4h deadline · ready in 4m 12s ✓ SHA-256 chain of custody sealed · hash 7f3a…e9c1
Your tools each see one slice. MACE sees the incident — and the legal obligations attached to it.
Probabilistic asset identity across 11 classes from every connected tool. Hardware-ID-boosted matching, time-decaying confidence, shadow-IT and impossible-travel detection — so every signal lands on the right asset.
One explainable 0–10 score across vulnerabilities, endpoint, identity, network, compliance posture, threat intel, and device posture. EPSS + CISA KEV, MITRE ATT&CK kill-chain multipliers, weights that learn from your analysts.
When the score crosses your threshold, MACE drafts the notifications and seals the evidence: pre-filled regulatory forms, jurisdiction reference numbers, tamper-evident SHA-256 chain of custody.
A single endpoint agent for Windows, macOS, Linux, Android, and iOS: inventory, STIG/CIS checks, CVE matching, behavioral EDR rules, DLP patterns, SBOM, honeytokens — in one scan pass, signed by the device's hardware root of trust.
Ask anything in plain English: "explain this alert," "draft the NIS2 early warning," "simulate a breach path to the payment database." Works with cloud LLMs or fully air-gapped with a deterministic fallback.
Everything in the platform today — no roadmap items mixed in. Six capability families, one deployment.
No rip-and-replace. MACE sits on top of the stack you already run.
Native connectors for CrowdStrike, Tenable, Splunk, Axonius, MISP, plus the MACE agent and a generic API. Asset identities unify automatically — no mapping spreadsheets.
Every event is scored across seven domains before it becomes an alert. Every score decomposes into its inputs — your auditors and analysts see exactly why.
Breach confirmed? The right frameworks are identified, notification drafts are pre-filled from incident data, and the chain of custody is cryptographically sealed.
An interactive preview of the MACE console with simulated data. Click around — verify an evidence chain yourself.
| Asset | OS | CDCS | Top signal | Last scan |
|---|---|---|---|---|
| srv-fin-012 | Ubuntu 22.04 | 9.6 CRITICAL | C2 beacon + exfiltration | 2 min ago |
| dc-primary-01 | Win Server 2022 | 8.8 CRITICAL | Golden-ticket indicator | 4 min ago |
| lt-ceo-mbp | macOS 15.5 | 7.4 HIGH | Impossible travel (NYC→Dubai) | 1 min ago |
| k8s-node-07 | Debian 12 | 5.3 MEDIUM | KEV-listed CVE, patch available | 6 min ago |
| printer-3f-02 | Embedded | 5.1 MEDIUM | Shadow IT — ACS 0.24 | 38 min ago |
| ws-eng-114 | Win 11 Pro | 2.1 LOW | STIG 96% · fully patched | 3 min ago |
14 frameworks across three jurisdictions at launch — with an extensible library designed for more.
Benchmarked against the stack MACE consolidates — most customers fund it from two budgets: SOC and GRC.
MACE exists because Vivek watched security teams do the same thing at every organization: five consoles open, an incident clock running, and an analyst hand-copying facts between an EDR, a scanner, a SIEM, and a Word template for the regulator. The tools were fine. The seams between them were the vulnerability.
So he built the seam. Vivek designed and personally implemented every layer of MACE — the UTAG asset-identity graph, the seven-domain CDCS correlation formula, the UREA regulatory evidence automaton, the cross-platform endpoint agent, and the Macey assistant — along with the SaaS platform around them and the 30-claim patent application that protects them. His background spans cybersecurity engineering, distributed systems, and regulatory compliance automation across US, EU, and GCC frameworks.
The founding conviction is simple: correlation should be explainable, and compliance should be a by-product of good security — not a second job. Every score MACE produces decomposes into its inputs. Every evidence record can be cryptographically verified by the people it's handed to. That standard of provability is also how the company operates — the test suite, the patent draft, and the data room are shown to every serious partner.
No — and we won't pretend it does. MACE consolidates core functions for the mid-market and sits on top of enterprise stacks as the correlation and compliance layer. Your EDR, scanner, and SIEM keep doing what they're good at; MACE makes them make sense together.
CDCS is a published, deterministic formula — seven weighted domain sub-scores with kill-chain, blast-radius, and sector multipliers. Every alert ships with its full decomposition. Auditors, regulators, and analysts see exactly why the number is the number. The adaptive part (weights learning from your analysts' feedback) is bounded and inspectable.
They're pre-filled, deadline-tracked drafts with sealed evidence chains — built for your counsel or DPO to review and submit. MACE removes the 4-hour scramble of assembling facts, not the human judgment of filing.
Honest answer for an early-stage platform: 156/156 automated tests including evidence-chain tamper tests, hardware-attested agent reporting, and a third-party penetration test plus SOC 2 Type II underway. We'll show you the data room rather than a badge wall.
Yes. The full pipeline — including the Macey assistant with its deterministic fallback — runs without internet access. Threat-intel feeds sync via removable media on your schedule.
SaaS: connectors live in under a day. Self-hosted: Terraform + Helm onto your Kubernetes, typically a week including hardening. The endpoint agent is a single binary per platform.
Design partners get founder-level attention, locked-in pricing for 3 years, and a roadmap seat. We get your hardest problems. Fair trade.
Opens your mail app addressed to vivek.sindhu@unifiedsectech.com — a founder answers, not a sequence.