Product screenshots

These screenshots show the Analog Informatics Corporation (AIC) console doing the work described on this site. The modules are built into the AIC CMMC Complete™ Level 1, Level 2, and Level 3 kits.

Proof index by industry function

Each row names an industry function and the screenshots that show it working. Jump to a section below to see the images.

Industry function	What the screenshots show	Section
Privileged account and session management (PASM)	Live SSH, RDP, and VNC sessions in the browser, vaulted credentials, recordings with reason-gated playback, and session control	Privileged access and sessions
Secrets management	Credential vault with rotation, and application launch with credentials the user never sees	Privileged access and sessions
Remote privileged access management (RPAM)	Entitlements to SSH, RDP, and VNC targets, and clipboard and file transfer limits	Identities and entitlements
Command control	Dangerous commands blocked in a live SSH session, and the list of blocked commands in the recording	Privileged access and sessions
Default credential detection	Network scan results, the default credential catalog, and its licensed public sources	Discovery and default credentials
Configuration compliance	Baseline configuration checks, Fix-It repair settings, and application control packs	Configuration compliance
Key management	AWS-LC, which holds a FIPS 140-3 certificate, key sets per zone with rotation and re-encryption, and PKCS#11 HSM vendor profiles	Key management and HSMs
Cloud cost and attack surface	Scheduled power off and on-demand start for workstations and session capacity	VM power scheduling
Privilege elevation and delegation management (PEDM)	Windows, Linux, and macOS elevation policy and application control packs	Privilege elevation and delegation
Just-in-time (JIT) privilege and zero standing privileges (ZSP)	One-time elevation codes, time-bound group membership, and just-in-time entitlements	Privilege elevation and delegation
Identity governance and administration (IGA)	Account discovery, role catalog mapped to CMMC and NIST, and identity providers	Identities and entitlements
Machine identity	Discovered service and administrator accounts on Linux and Windows	Identities and entitlements
Conditional access	Country policy, network rules, multifactor authentication, passkeys, and session timeouts	Conditional access and threat defense
Identity threat detection and response (ITDR)	Attack / Threat Report mapped to MITRE ATT&CK, logon audit, threat intelligence, live events, and incident alerts	Conditional access and threat defense
Identity security posture management (ISPM)	Current State Compliance, control coverage, and control drift history	Continuous compliance and evidence
Data classification and mandatory access control	CMMC, US government, NATO, and national markings with enforcement and formal release	Data classification
Continuous compliance and audit	Assessment Binder, frameworks crosswalk, POA&M, risk register, and reports	Continuous compliance and evidence
Workforce training and attestation	Training packs and workforce roster	Workforce training and attestation
Localization	The console in German and Spanish, and language pack settings	Multilingual console

Why MSPs pick the AIC kits

A Managed Service Provider (MSP) gets the tools a customer needs in one console: privileged access, session recording, command restriction, privilege elevation, incident alerts, continuous compliance, the Assessment Binder, workforce training, a document vault, reports, and SIEM forwarding. There is no second product to buy for each job. The same console works in German, Spanish, and other languages.

Screenshots

Privileged access and sessions

Live SSH session to a Linux workstation in the console, showing the machine name, Connected status, recording in progress, and a command line where whoami, uname, and uptime run and mkfs is blocked with the message COMMAND BLOCKED. — A live SSH command line, recorded, with a dangerous command blocked as it is typed.

Live RDP session to a Windows workstation in the console, showing the machine name, Connected status, recording in progress, viewer controls, and the Windows desktop with a session watermark. — A live, recorded RDP desktop session to a Windows workstation, in the browser.

Live VNC session to an Ubuntu Linux desktop in the console, showing the machine name, Connected status, recording in progress, and the remote desktop. — A live, recorded VNC desktop session to a Linux workstation, in the browser.

Command denials panel for a recorded SSH session listing four blocked commands: rm -rf /, mkfs.ext4, shutdown -h now, and dd, each with the rule that refused it, the time, and a Jump to denial link. — Every blocked command is listed with the rule that refused it, and links to that moment in the recording.

Session Recordings list with SSH, RDP, and VNC sessions, each showing start time, target, account, protocol, decision, and duration, with a button to open the recording. — Every brokered SSH, RDP, and VNC session is recorded, encrypted, and listed for review.

Recorded SSH session detail showing asciicast v2 format, AES-256-GCM encryption, the proxy recording plane, the account, the source address, and a required case or review reason field before playback. — Playback of a recorded SSH session requires a case or review reason, and every attempt is audited.

Recorded RDP session detail showing MP4 format, AES-256-GCM encryption, the recording host, the account, and a required reason field before playback. — RDP sessions are recorded as encrypted video, with the same reason-gated, audited playback.

Session Control list showing active, pending, and completed privileged sessions, with Terminate, Approve, and Deny actions and links to recordings. — Session Control lets an operator approve, deny, watch, or terminate privileged sessions.

Command Governance page showing SSH command filtering, the rule set in effect with 61 rules and a default deny, and tabs for blocked commands, test command, and extra rights. — Command restriction allows or denies SSH commands by rule, with a default deny and a test tool.

Credential Vault list of privileged accounts for Windows and Linux workstations, with Test custody, Rotate, and Delete actions. Secret values are not shown. — Privileged credentials are vaulted and rotated. Operators never see the secret.

Secure Program Launch page listing launch configurations for PostgreSQL, SQL Server, SSH, PuTTY, WinSCP, PowerShell, SAP GUI, Oracle SQL*Plus, Remote Desktop, and websites. — Secure Application Launch starts common admin tools with injected credentials the user never sees.

Privilege elevation and delegation

Endpoint Privilege overview with tiles for Privileged User Management, Applications, Application Groups, Workstation Prompt, Unix Privilege, Who May Elevate, Elevation Approvals, Elevation Policy, Air-Gapped Tokens, and Direct Elevation. — Endpoint privilege elevation and delegation covers Windows, Unix, approvals, policy, and air-gapped tokens in one place.

Privileged User Management page with enrolled, enforce, audit, pending, and failed counts, and policy packs for Windows 11, Windows Server, Red Hat Enterprise Linux, Ubuntu, and macOS. — Privileged User Management applies application control packs across Windows, Linux, and macOS, with live counts.

Token Elevation page for minting one-time elevation codes that an endpoint agent redeems, and for remote non-agent local elevation with start delay and duration. — Just-in-time elevation works with an agent, without an agent, and on air-gapped systems through one-time codes.

Elevation Platform policy with channels for one-time token, challenge and response, and signed entitlement workflow, and a group catalog mapping Windows, Linux, and macOS administrator groups. — One elevation policy covers Windows, Linux, and macOS, including offline challenge and response.

Direct Elevation page for time-bound group membership through the local agent or remote WinRM, with a request activation button and a list of assignments showing state, endpoint, principal, group, transport, start, and end. — Time-bound group membership grants privilege for a set time, then removes it.

Identities and entitlements

Discovered Accounts list of operating system accounts on Linux and Windows workstations with platform, privilege level, local groups, and managed status, plus Create job and Apply workstation template actions. — Account discovery finds privileged and standard accounts on every system, managed or not.

Entitlements table binding roles to SSH, RDP, and VNC targets with allow or deny effect, standing or just-in-time access, approval quorum, and enabled state. — Entitlements decide who may reach which target, with standing or just-in-time access and deny-wins rules.

Session I/O policy form that sets clipboard and file transfer ceilings for live RDP, SSH, and VNC sessions by organization, user, role, or group, with both set to Denied. — Clipboard and file transfer can be blocked or limited for each privileged session.

Role catalog of 45 roles such as Super Administrator, Server Administrator, and CMMC System Administrator, each with task family, mapped standards including CMMC and NIST, and product scopes. — 45 built-in roles map permissions to CMMC and NIST controls for least privilege.

Identity provider list with local accounts, OpenID Connect directories, Windows Integrated Kerberos sign-on, and on-premises Active Directory LDAP bind, with status and enable controls. — Sign in with local accounts, OpenID Connect, Windows Integrated, or Active Directory.

Conditional access and threat defense

Attack / Threat Report for the last 7 days showing 8 denied and failed sign-ins, 1 unique source, 1 mapped MITRE ATT&CK technique, and an attack origin map. — The Attack / Threat Report counts blocked and failed attempts and maps them to MITRE ATT&CK.

Threat report detail showing attack origins by country, MITRE ATT&CK coverage with technique T1110 Brute Force under Credential Access, and attack volume by top source address and most-tried usernames. — Failed sign-ins are mapped to MITRE ATT&CK technique T1110 Brute Force, with top sources and most-tried usernames.

Logon audit table of append-only sign-in events with time, username, outcome, source address, and reason, showing successful sign-ins and failed attempts for nonexistent accounts. — Every sign-in attempt is logged append-only, with outcome, source, and reason, and exports to CSV or JSON.

Country access policy with allowed, conditional travel, and blocked country lists, a defense contractor preset, and a world map colored green for allow, orange for conditional step-up, and red for deny. — Conditional access by country: allow, require extra verification, or deny sign-in by source country.

Network access control list of ordered allow and deny rules by IPv4 CIDR range, first match wins, with notes and a test tool. — Ordered network rules allow or deny sign-in by address range before any password check.

Threat intelligence feeds from FireHOL, ET Open, and AbuseIPDB with version and entry counts, a feed entry browser with suppress, edit, and remove actions, and air-gapped feed import. — Threat intelligence feeds block known-bad addresses at sign-in, and load offline on air-gapped systems.

Logon policies for multifactor authentication with time-based one-time codes, local password policy with length, age, history, and complexity, and passkey (WebAuthn) settings. — Sign-in policy covers multifactor authentication, passkeys, password rules, and lockout.

Session Timeout And Logoff settings with absolute lifetime, idle timeout, token rotation on refresh, HttpOnly cookies, and forced logoff on expiry, mapped to NIST SP 800-53 AC-12 and SC-23. — Session timeouts and forced logoff limit the risk of an unattended or stolen session.

The failed sign-ins in the threat report were made for this demonstration against accounts that do not exist. More on Conditional access and threat defense.

Discovery and default credentials

IP Scanner results after a completed scan showing six hosts online with open SSH, RDP, and VNC ports, the scan log, and a Known Default Credentials link. — The built-in scanner finds hosts and open management ports across IPv4 and IPv6 ranges.

Known default credentials Dictionary sources tab listing bundled sources such as DefaultCreds Cheat Sheet, SCADAPASS, and SecLists, with license, bundled status, summary, and Reload and Fetch Latest actions. — Default credential dictionaries come from licensed public sources, with the license shown for each.

Proof index by industry function

Why MSPs pick the AIC kits

Screenshots

See it on your use case