TECHNOLOGY

Software built to run
inside the boundary.

The Praesidium Suite is six products on one architecture, built so the same system can run hosted and unclassified, on your own infrastructure at a CUI boundary, or fully air-gapped inside accredited space. We also engineer custom tools for environments commercial software cannot reach, and we operate public systems you can try today.

See the Praesidium Suite Discuss your project
I.THE PRAESIDIUM SUITE

Six products, one architecture, three deployment profiles.

In the air-gapped profile there is no software-as-a-service in the runtime path. The analysis tools work from metadata and public standards, not controlled content, and pass-or-fail verdicts are deterministic code with an immutable audit record rather than model output.

II.CUSTOM ENGINEERING

Tell us what you need. We build it for you.

Off-the-shelf software assumes the internet. Inside an accredited or air-gapped facility, that assumption breaks, so we build to your environment instead of asking you to bend to ours.

  1. Scope it with us. We start with the mission and the constraints, not a product demo. You tell us what the tool has to do and where it has to live. We tell you what it takes.
  2. Built to your environment. On-prem, fully air-gapped, or cloud-connected where authorized. We build for the boundary you actually operate in, including environments with no outbound network at all.
  3. Proven low-side, transferred high-side. For air-gapped work we build a high-fidelity twin of your enclave and prove the baseline on the unclassified side at full speed. Once it is known-good, it transfers across the boundary, and protected content never crosses.
  4. Delivered with the evidence. Software for accredited spaces is only finished when the paperwork is. We prepare the authorization evidence alongside the build. The Authorizing Official makes the determination.
  5. Supported program-long. Updates, fixes and changes happen on your schedule and inside your boundary, for the life of the program.

Useful to have ready

III.SYSTEMS WE OPERATE

Operated by Salian Defense.

Each started as a problem we hit doing the core work and solved properly instead of working around. You can use one without buying anything else from us.

Facility accreditation is determined by the applicable Accrediting Official or Cognizant Security Authority, and system authorization by the Authorizing Official for a specific environment. Salian prepares the evidence each review requires.

IV.BOUNDARIES

What these products do not do.

Knowing where a tool stops is part of using it in a constrained environment. Each product page says what it does; these are the lines it does not cross.

V.COMMON QUESTIONS

Software and AI, answered.

What is the Praesidium Suite?
The Praesidium Suite is Salian Defense's line of software and partner hardware that share one architecture, built so the same system can run hosted and unclassified, on customer infrastructure at a CUI boundary, or fully air-gapped inside accredited space. Each system is authorized by its Authorizing Official for a specific environment; Salian prepares the evidence that review requires. The six are Vates Cognition (on-premise estimating and analysis; the free estimator is live on the site), Groma (ingests plans, renders 2D and 3D, and grades designs against ICD-705), Legatus (agentic workflows with human-signed approval, air-gapped), Vigil (defines and evaluates the boundary policy an AI system must respect: what to allow, redact, or block), Hawk RAG (the retrieval layer shared by the Hawk products, fusing vector, knowledge-graph and lexical retrieval), and Pythian (inline FPGA-based hardware encryption for operational-technology networks; a partner technology available to Salian under a white-label arrangement).
How does Salian Defense build software for air-gapped environments?
Salian builds a high-fidelity digital twin of the target classified enclave and runs engineering, configuration, validation, and dry runs on the unclassified, networked side at full speed. Once the baseline is proven, it transfers into the air-gapped environment as known-good work. The Praesidium platform is built to run fully offline, with no outbound network traffic, no software-as-a-service in the runtime path, and no telemetry leaving the building.
What software can run inside a SCIF?
Software can be considered for a classified space only if it needs no outbound connection, can be installed and updated inside the boundary rather than pulled from a vendor cloud, and the Authorizing Official authorizes the system it runs on. Most commercial software fails the first condition because it assumes a live internet connection for licensing, updates, or telemetry. Salian engineers the Praesidium Suite to those constraints and also builds bespoke tools to a customer's specific enclave. Each system is authorized by its Authorizing Official for a specific environment; Salian prepares the evidence that review requires.
Does the Praesidium Suite work fully air-gapped?
The Praesidium Suite is built so the same architecture runs in three deployment profiles: hosted and unclassified, CUI-safe on customer infrastructure, or fully air-gapped inside accredited space. In the air-gapped profile there is no software-as-a-service in the runtime path, no outbound network traffic, and no telemetry leaving the building. RFI Hawk and Water Hawk run hosted and unclassified, and Project Hawk is customer-hosted and stays outside the CUI boundary. Legatus is built for the air-gapped profile. Each system is authorized by its Authorizing Official for a specific environment; Salian prepares the evidence that review requires.
How does Salian Defense automate ICD-705 compliance checking?
Groma, a product in the Praesidium Suite, encodes ICD-705 and its implementing technical specification as buildingSMART IDS 1.0 plus nine deterministic geometry and documentation checks, runs them against an as-designed or as-built IFC4 model, and returns a gap report. The pass-or-fail verdict is produced by deterministic code, never by model output: language models read messy inputs and phrase findings, but they never decide compliance. Every result is a draft that a credentialed human reviews and ratifies, and the Accrediting Official's determination remains non-delegable. Groma reasons over business, program, and facility metadata plus public standards, and never touches classified or controlled content.
What is Groma?
Groma is a spec-aware ICD-705 compliance engine in Salian Defense's Praesidium Suite. It reconstructs an IFC4 model from a plain-English description, a structured plan, or a floor-plan image, then checks it against buildingSMART IDS 1.0 plus nine deterministic checks: wall layering, slab-to-slab continuity, duct penetrations, door lock, door acoustic, access-controlled entrance, alarm response class, window treatment, and Fixed Facility Checklist completeness. Every output is a ratifiable draft a credentialed human signs off; Groma never decides, accredits, or certifies, and the Accrediting Official's determination is non-delegable. Each system is authorized by its Authorizing Official for a specific environment; Salian prepares the evidence that review requires.
What is Legatus?
Legatus is a workflow orchestrator in Salian Defense's Praesidium Suite that decomposes an analyst's intent into a multi-step workflow, calls models and tools through a controlled registry, and stops at a human for approval before any sensitive action. A classification label travels with every state transition, and the compiler refuses to build a workflow whose step ceiling sits below a state the workflow can actually reach. Legatus is built to the control set for DoD Impact Levels IL4 through IL6; authorization at a given Impact Level is a determination by the system's Authorizing Official.
What is Vigil?
Vigil is an AI security layer in Salian Defense's Praesidium Suite that defines and evaluates the boundary policy an AI system must respect: what to allow, redact, or block between an application and a language model. It is an embedded, swappable provider rather than a standalone application. It ships deployment-profile resolution, content-free scan contracts, a deterministic detector set covering identifiers, payment numbers, cloud access keys, and private keys, an advisory-or-enforce policy engine with allow, redact, and block precedence, and a redaction transformer. Each system is authorized by its Authorizing Official for a specific environment; Salian prepares the evidence that review requires.
How does Salian Defense prevent CUI from reaching an AI model?
Two mechanisms, at different layers. Vigil defines and evaluates the boundary policy an AI system must respect: what to allow, redact, or block between an application and a model, so controlled content is addressed by policy rather than discovered afterward in a log. Separately, Groma and Vates Cognition reason over business, program and facility metadata plus public standards, so controlled content stays out of their pipelines. Products built to run inside the boundary, such as Legatus, operate under that system's authorization.
What DoD Impact Levels does Salian Defense software support?
Legatus is built to the control set for DoD Impact Levels IL4 through IL6, and authorization at a given Impact Level is a determination by the system's Authorizing Official. That distinction is deliberate: designed-for describes the control set and architecture the software was built against, while accredited-at describes a determination only an Authorizing Official can make for a specific system in a specific environment. Salian delivers accreditation evidence alongside the software so a reviewing authority can make that determination, but does not claim it on the software's behalf.

Describe the mission. We engineer the tool.

Tell us what it has to do and where it has to run. Typical response in one business day.

Discuss your project See the Praesidium Suite