Get early access
FOR MID-MARKET

Answer the SBOM question
before a customer asks twice.

A hundred to five hundred endpoints, a small IT team, no dedicated security team — and customers, insurers and auditors now ask what runs on your fleet. With a detonation host attached, Attestree detonates each winget installer your machines need, builds its SBOM and records an attestation before it reaches one, so the evidence trail is built at install time: by construction, not by scanner.

Request access Talk to us
100–500 endpoints Entra ID SSO Self-hosted or hosted Signed evidence export
FLEET · 312 ENDPOINTS drift: 2 nodes
  • sbom Microsoft.VisualStudio.2022 17.9.6 sig:c4e1…
  • ring Mozilla.Firefox · pilot ring 38 nodes sig:7a09…
  • held choco/7zip installed not attested · not served
  • drift fin-lt-042 · Git.Git 2.49.0 drift
  • cve KEV match · 3 endpoints flagged sig:0fa9…
  • export evidence-bundle · Q3-2026 2.1 MB sig:e45a…
rings · drift · signed evidence 309 verified
WHY THIS MATTERS HERE

Three things mid-market IT teams ask us about first.

SBOM-by-construction

With a detonation host attached, each winget installer your machines need is detonated in a real sandbox and gets a CycloneDX SBOM and an attestation before any machine installs it. No post-install scan: the SBOM is built from the exact bytes your fleet runs.

Rings, halts and rollback

New versions go to a canary ring first, then pilot and broad. The opt-in update pipeline stops on its own when a publisher’s signing certificate changes, and a ring rolls back to its previous version in one action.

Evidence you can hand over

Export a signed audit bundle — promotions, approvals and decisions — and verify it offline. The fleet CVE index matches CISA KEV against what is actually installed, so "are we exposed?" is a query, not a project.

WHAT YOU GET

The products that fit a 300-endpoint fleet.

Inventory and Attestree for winget are the foundation. Transforms is on the roadmap, not shipping yet.

/products/winget-enterprise In dev

Attestree for winget

Attested install gate for winget; Chocolatey inventoried, not deployed until it can be attested.

Read product
/products/inventory In dev

Inventory

One inventory across your package managers — winget, Chocolatey and Scoop, plus plain uninstall entries.

Read product
/products/transforms Pipeline

Transforms

MSI/MST transforms generated from declarative policy.

Read product
PRICING

Commercial — request access.

Pre-GA pricing is design-partner friendly. Tell us about your fleet — we'll come back within two business days.

Entra ID SSO included Hosted in your Azure subscription Rings + rollback Signed evidence export
ENDPOINTS

We'll only use this to schedule a 30-minute fit-check.

DESIGN-PARTNER QUOTE · TBD

"Design partner pipeline open. Be first to be quoted."

Your name here · IT lead, mid-market design partner
COMPARE SEGMENTS

Same primitive, different posture.

Homelab
Hobbyists & enthusiasts
Free attestations for the winget packages your home fleet pulls.
Small business
5–100 endpoints
Attested install gates without a full SOC.
Mid-market You are here
100–500 endpoints
Attested winget installs, rolled out in rings with rollback.
SaaS engineering Horizon
Engineering-led security
SBOM-by-construction at ingest for npm and pip, next to the winget ingest that ships today.
Enterprise Horizon
5,000+ endpoints
Detonate and attest packages at ingest, before they reach a workstation.
Financial services Horizon
Regulated environments
Signed, auditor-ready evidence for regulated Windows fleets.