Orbital Guard · Monarch
Sovereign cybersecurity AI.
Orbital Guard is the platform UD Works brings to market as Monarch. It validates, detects, responds, governs and evidences compliance, continuously and under your control: in the cloud, in your own tenancy, or air-gapped on a single machine. It is in development.
- Sold as
- Monarch, by UD Works
- Deployment
- managed cloud, private cloud, air-gapped
- Model providers
- Anthropic, OpenAI, Azure, Ollama, local
- Audit
- every action attributable
- Status
- In development
A model is not a security programme.
A model that can reason about an exploit still forgets what it learned yesterday, has no authority to act, and cannot prove who did what. Orbital Guard is the whole stack around it: the orchestration that puts it to work, the memory that makes it improve, the governance that keeps it inside the rules, and the identity that makes every action attributable.
It runs where your security posture requires. The capability is the same in every deployment; only the network boundary changes.
Validate, detect, respond, govern, comply.
Validate
Continuous, authorised red and blue teaming. Standard tooling such as nmap, nuclei and hydra runs in scoped sessions, with CVE detection and a full audit trail per session. Each re-test builds on what earlier tests found.Detect
Machine-learning classification of network traffic, mapped to MITRE ATT&CK, with models that run locally. It takes in telemetry from Elastic, Splunk, Sentinel, Wazuh, QRadar, Suricata and Zeek, and correlates alerts into incidents.Respond
From anomaly to device suspension and credential revocation, automatically. Because every actor carries a verifiable identity, a response withdraws exactly the compromised identity's authority, and policy is checked before each action runs.Govern
Every model call, local or remote, passes a governance gateway: PII redaction before and after the model, prompt-injection blocking, policy rules, and token, model and rate limits. Local models get no ungoverned path.Comply
Evidence-based assessment against ISO 27001, SOC 2, PCI DSS, GDPR and NIS2, NIST CSF and OWASP, with gap analysis, remediation guidance and an audit trail from person to model.
Underneath
Five layers. Remove one and it stops being a platform.
Every capability above runs on the same stack. A model with no memory cannot improve, orchestration with no governance cannot be trusted on live systems, and action with no identity cannot be audited.
| Layer | What it does |
|---|---|
| Intelligence | A security foundation model that carries out authorised offensive and defensive work under governance. It is integrated, tuned and operated by UD Works, and runs on your infrastructure. |
| Orchestration | Specialised agents, each mapped to a security role, composed per scenario and run in parallel under shared context, on workstations, in data centres or at the edge. |
| Memory | Findings, asset context and proven procedures persist across engagements, on your infrastructure. A validated attack path or a remediation playbook becomes a skill any agent can reuse. |
| Governance | A runtime guard evaluates policy on every tool call (dangerous commands, protected paths, secrets, network safety), and the gateway governs every model call. Every decision is logged. |
| Identity | Every agent and person acts under a verifiable, least-privilege identity issued inside your environment. The audit chain runs unbroken from the person who set intent to the action taken. |
Intelligence
- What it does
- A security foundation model that carries out authorised offensive and defensive work under governance. It is integrated, tuned and operated by UD Works, and runs on your infrastructure.
Orchestration
- What it does
- Specialised agents, each mapped to a security role, composed per scenario and run in parallel under shared context, on workstations, in data centres or at the edge.
Memory
- What it does
- Findings, asset context and proven procedures persist across engagements, on your infrastructure. A validated attack path or a remediation playbook becomes a skill any agent can reuse.
Governance
- What it does
- A runtime guard evaluates policy on every tool call (dangerous commands, protected paths, secrets, network safety), and the gateway governs every model call. Every decision is logged.
Identity
- What it does
- Every agent and person acts under a verifiable, least-privilege identity issued inside your environment. The audit chain runs unbroken from the person who set intent to the action taken.
Cloud-scale, or sealed behind the wire.
Three deployment modes, one capability. Only the network boundary and who operates it change.
| Mode | Where it runs | Built for |
|---|---|---|
| Managed cloud | Multi-node, elastic infrastructure operated by UD Works, with updates and connectors maintained as part of the service. | Teams that want continuous security operations without running infrastructure. |
| Private cloud | Inside your own cloud tenancy. Telemetry and findings stay there, and model weights are deployed locally. | Organisations with data-residency requirements or existing cloud commitments. |
| Air-gapped | The whole platform on one machine with no outbound connection: sovereign local model, offline threat-intelligence mirror, no GPU needed. | Defence, intelligence and critical-infrastructure environments that cannot connect out. |
Managed cloud
- Where it runs
- Multi-node, elastic infrastructure operated by UD Works, with updates and connectors maintained as part of the service.
- Built for
- Teams that want continuous security operations without running infrastructure.
Private cloud
- Where it runs
- Inside your own cloud tenancy. Telemetry and findings stay there, and model weights are deployed locally.
- Built for
- Organisations with data-residency requirements or existing cloud commitments.
Air-gapped
- Where it runs
- The whole platform on one machine with no outbound connection: sovereign local model, offline threat-intelligence mirror, no GPU needed.
- Built for
- Defence, intelligence and critical-infrastructure environments that cannot connect out.
Questions
Is Orbital Guard the same as Monarch?
Yes. Monarch is the name Orbital Guard is brought to market under by UD Works Pte. Ltd., a separate Singapore company. Briefings are arranged through ud-works.com.
Is it available now?
It is in development. UD Works arranges briefings for teams evaluating it; to talk to the Orbital Ventures team, write to [email protected].
Can it run without an internet connection?
Yes. In the air-gapped mode the whole platform runs on one machine with no outbound connection, using a sovereign local model and an offline threat-intelligence mirror.
Which model providers does it work with?
Anthropic, OpenAI and Azure, and local models served through Ollama. Every call, local or remote, passes the same governance gateway.
See Monarch for yourself.
UD Works runs Monarch briefings for teams evaluating it.