Half your network documentation is wrong. This tells you which half.
Point CrossTrust at the folder your drawings, switch configurations and spreadsheets already live in. It reads them, finds the places where your own documents contradict each other, and cites both sides down to the line number and the spreadsheet cell.
It reads and never writes: your files are left exactly as they are. It runs on your own machine, and nothing about your documents leaves it.
One disagreement, both sides cited. And a product that hands the question back rather than guessing at it.
The problem
Nobody knows which document to believe, so everybody goes and looks.
There is a Visio drawing from the last refresh, a spreadsheet somebody has been maintaining since 2019, a folder of switch configs pulled during an audit, and a wiki page three people have edited. Every one of them describes the same network. No two of them agree, and none of them says how old it is.
So the real record becomes the walk to the comms room. Every change request starts with somebody physically confirming what a document already claims to say, because the document has been wrong before and nobody can tell you when it started being wrong.
The documentation is not missing. That is the frustrating part. It is there, it cost real money to produce, and it sits unused because acting on it is a gamble.
See it work
Three documents about one network.
A switch config, a Juniper config and an estate spreadsheet, all describing the same small campus. Watch what falls out of reading them together.
Start here. You will point it at a folder, watch it read three documents, and find the one thing they disagree about. It takes about a minute.
CrossTrust
documentation you can check
Sample
Three documents in, one honest question out.
It found the contradiction, cited both sides, refused to guess, and told you which command closes it. It also found three passwords and an audio system that will fail in week two.
Sample data: the three documents CrossTrust ships in samples/Network Records. Every finding on these screens came out of the real engine reading them.
The refusal
It had a satisfying answer available, and it turned it down.
Every tool in this category resolves a conflict by ranking the sources and declaring a winner. The switch config beats the spreadsheet, so the answer is 512, and the report reads beautifully. CrossTrust could have printed that. Here is why it did not, and why that is the reason to trust the answers it does print.
What it handed back for AV-CTRL-01
- Question
- Which VLAN is this on?
- Says 512
IDF-A-SW-03.txt, line 13 (via the port description at line 11). The switch’s own settings, dated 2025-03-04 from the configuration-change header.- Says 340
estate-inventory.csv, row 4, column vlan. A record somebody typed, dated 2023-04-11 from the last_audited column.- Verdict
- CrossTrust does not choose here. It reads two sources of equal weight disagreeing, so it does not choose between them.
- Settle it
- Find the switch port this device is plugged into and read its configuration. The switch is the only thing here that knows what the device is actually on, rather than what somebody recorded.
Nobody wrote that. The engine did. Note what the last line is: a job for one person, at one switch, that ends with the question closed for good.
Answer it once and it stays answered. Your correction survives the next run, and the run after that. If a document later says something new underneath your answer, CrossTrust brings the question back rather than leaving your decision standing on evidence that has moved.
How it works
It separates what was said from who said it.
That is the whole engineering idea, and everything above falls out of it. A fact and a source are stored apart, so ten documents saying the same thing is one fact confirmed ten times, and two documents disagreeing is two sources on one question with neither overwriting the other.
- It reads what you already have Visio drawings, switch configurations, spreadsheets in both Excel formats, CSVs and PDFs with a text layer. Configurations are recognised by what is inside them rather than by the file extension, across 11 configuration languages. It installs nothing on your network and asks nothing of your devices.
- Every fact keeps the exact place it came from A line in a config, a row and column in a spreadsheet, a shape on a Visio page, a character range in a PDF. That is why you can check any finding in about a minute, which is the only reason anyone will ever act on one.
- It shows you the file list before it opens anything You get the list of what it can read, what it will skip and why, and then it waits. A file it cannot handle is named on that screen rather than dropped quietly, so the gaps in the answer are visible before the answer exists.
- It finds the passwords in your documentation 13 credential rules run before anything is parsed. It tells you the file and the line, records that a credential is there, and never stores the credential itself. A file it cannot read safely is held back and named individually, rather than being reported as clean.
- It audits the switch settings while it is in there 71 settings checks, 33 of them from the 252 requirements published for Cisco IOS and NX-OS switches, mapped to 252 NIST SP 800-53 control entries. Findings are counted by problem rather than by switch: telnet being on across six hundred switches is one thing to fix, not six hundred rows to read.
- The second run is the one that pays It tells you what changed since last time, and what you already answered stays answered. That is the only screen in the product that reports progress, and progress is the thing nobody has ever been able to show for documentation work.
The AV argument
It knows a Q-SYS core from a camera, and it knows what the switch owes each of them.
This is the part a general documentation tool cannot do, and the part an AV integrator will recognise in about four seconds.
An audio system on a network with no multicast querier will pass every ping you throw at it. The link stays up, the device answers, the monitoring is green, and the audio drops out somewhere between thirty seconds and five minutes after it starts working. It is the single most common cause of an AV system that passes commissioning and fails in week two, and it is invisible to every tool that checks whether a thing is reachable.
CrossTrust recognised the Q-SYS core and the Biamp Tesira in the demo from the port descriptions an engineer typed years ago, matched them to the equipment families that carry a clock in multicast, and checked what the switch underneath them was doing about it. It found no querier, no snooping, and no priority for the audio. It matches 52 equipment names and markers, from Q-SYS and Biamp to the plain word codec, sorts them into 6 equipment families, and checks the 4 things the network owes each family.
That is an argument you can take to a room full of people who each believe the problem belongs to somebody else, and it is worth about two site visits every time it lands.
The honesty rule
Its own coverage table names the things it cannot do yet.
The screen that lists what CrossTrust does with each make of switch is generated from the running build rather than written by hand, so a check that gets deleted stops being advertised the same day. Cisco IOS comes out at 27 settings of 27. Aruba CX comes out at 20 of 27, and the seven it cannot check are listed by name in the last column.
A support matrix with a tick in every box is a matrix nobody is checking. This one is uneven, it says so on the About screen where a prospect will find it, and every number on that screen is counted rather than claimed.
The limits
It reads documents. It does not read your network.
CrossTrust never touches a device. Everything it knows about your estate came out of a file you already had, which is what lets it run with no credentials and no access to anything. When it says a switch is set a certain way, it means a configuration file in your folder says so, and it dates that file on the screen so you can weigh it yourself. If you want the network read directly, that is CrossScan and CrossConnect, and they are separate products.
There is no model in here and no assistant. Every format it reads is structured, which is why two runs over one folder give the same answer. It cannot read Word documents, scanned images or the old Visio format, and it names those files on screen instead of pretending the folder held nothing else. A PDF with no text layer needs to be scanned properly before it is worth anything to anyone, and CrossTrust says that rather than guessing at it.
Exactly one thing in the product reaches the internet: a button that checks whether the published requirements it checks against have been revised. It sends nothing about your machine or your documents, and it only ever runs when you press it.
You already paid for this documentation. Find out what it is worth.
Point it at the folder. It takes about thirty minutes to go from downloading it to reading a list of the places your own records contradict each other.