< Nimbus Vestige />
Forensic Reconstruction for Cloud & Identity Incidents
Nimbus Vestige helps incident responders answer the question detection tools can't: how did the intrusion actually happen? Given fragmented control-plane, sign-in, and consent telemetry, it reconstructs the most likely path an attacker took across accounts and services, ranks the alternative paths they could have taken, and reports every step with calibrated, evidence-traceable confidence.
Honesty is the product. Every number is traceable to the specific evidence that earned it — and anything the data cannot support is withheld rather than guessed. The engine is substrate-independent: the same abductive core that reconstructs an Entra ID / M365 intrusion reconstructs an AWS one. And because NV runs entirely self-hosted in your environment, your incident telemetry never leaves your infrastructure.
Source-Available Core • Self-Hosted • Commercial License for Production Use
git clone https://gitlab.com/dobybaxter127/nimbus-vestigeFree to inspect, run, and evaluate — always. Clone the full source, try it against your own data on the live demo, and satisfy yourself it's right. A commercial license is required for any commercial or production use, and includes the auto-updating pattern feeds, calibration tooling, and priority support for real investigations — pay once, keep it for good.
Read every line before you pay. The full source is open for inspection — nothing hidden, nothing to take on faith.
🛡️ Licensing
The Nimbus Vestige core is source-available under the PolyForm Noncommercial License 1.0.0 — the full reconstruction engine, both provider ingests, GUI, and offline eval harness, free to inspect and evaluate. Commercial and production use requires a license.
A commercial license grants production use and includes curated live pattern feeds, calibration against labeled attack corpora, and support from the person who built it.
Because NV is self-hosted, the license adds capability and support on your own infrastructure — never a requirement to send your data anywhere.
💼 Commercial Licensing
Early access. NV is pre-1.0, and I'm onboarding a small number of founding users on real investigations. Founding licenses are one-time and perpetual — pay once, keep it, no renewals — at introductory pricing in exchange for feedback. Each includes 12 months of feed and pattern updates, with optional renewal after that to keep the intel current. Request a license and I'll send current terms and set you up with the live demo.
| Tier | Founding License | Which one am I? |
|---|---|---|
| Responder | from £490 · one-time | I run investigations solo or as a consultant |
| IR Team | from £2,400 · one-time | My security team uses it on live cases |
| Enterprise | Let's talk | We're an MSSP or large org deploying it broadly |