What the pilot validates
- Home, SME, or high-assurance deployment scope
- Alert-only start with controlled response progression
- Governance-ready records and review workflow
ValidationScope, progression, and review outputs
PilotOperator rollout programme
Governed pilot programmefor staged deployment
Run staged pilot phases to validate local baselines, operator workflow, and policy gates before expansion.
Scoped rollout
Operator review
Evidence-led expansion
Pilot framing
What the pilot validates first
Lock the scope, approval model, and expected outputs before rollout starts.
Scope and approvals before rollout
- Defined environment, assets, and operator roles
- Clear policy boundaries, approvals, and escalation routes
- Named review cadence and pilot success outcomes
ReadinessNamed owners and approvals stay explicit
Pilot tracks
Deployment tracks by scope and assurance
The same rollout model fits home, SME, and higher-assurance environments with tighter approvals where needed.
Home pilot
Operator-friendly baseline for mixed devices and encrypted home traffic.
- Learn local norms across unmanaged devices
- Flag drift for review before response actions
- Apply policy-gated controls with clear records
FitHome and mixed-device baseline control
SME pilot
Governed rollout for small teams, branch sites, and mixed estates.
- Use shared policy templates with local scope controls
- Run operator-approved containment and segmentation
- Keep case-ready records for accountability and review
FitSmall estates and branch rollout
High-assurance pilot
Tighter controls for high-risk users and sensitive workflows.
- Named approvals and strict policy boundaries
- Private-by-default local operation and review
- Evidence pack before any scale-up
FitHigher-risk users and approval-heavy workflows
Pilot operation
How teams run and evaluate the pilot
Operate in controlled phases, then use the evidence pack to decide whether to expand, hold, or adjust.
How the pilot is operated
Step 01Define assets, users, owners, and policy boundaries
Step 02Stabilise local baselines in alert-only mode
Step 03Run guided actions with operator approvals
Step 04Review evidence and decide expand or hold
No raw traffic export by default. Core mode avoids payload inspection requirements.
Operating ruleStart alert-only and enforce only by approval.
What operators receive
- Decision records with review notes
- Policy actions with approval context
- Weekly operator summary pack
- Scale, hold, or adjust recommendation
DecisionEvery phase ends with a scale, hold, or adjust call.