Device DNA™. The language of electricity.
Instead of asking a device who it is, CybrIQ measures how it behaves electrically. Every device has a unique, low-level Device DNA. A physical fingerprint that cannot be spoofed with software tricks. That fingerprint is the foundation of everything RoomIQ and SpacesIQ produce.
Five markers, observed at Layer 1, combined into one signature.
Device DNA does not depend on what the device says about itself. It depends on what the wire actually sees when the device is connected. Five observable behaviors are combined into a single signature, which is rebuilt every time a port is validated.
-
01
Link negotiation pattern.
How the device negotiates speed, duplex, and auto-negotiation with the switch. A managed Crestron codec negotiates differently than a 5-port unmanaged switch, even if both report the same MAC.
-
02
MAC OUI and identity descriptors.
The vendor block and the descriptors the device presents on connection. Useful as one input, never trusted as the only input. Spoofable in software, which is why it is one of five inputs and not the only one.
-
03
Traffic-timing characteristics.
Inter-packet timing under load, idle behavior, response latency to standard probes. The timing fingerprint of a codec under a live call is meaningfully different from a switch passing through the same traffic.
-
04
Response shape to standard probes.
CybrIQ issues a small set of standard, non-intrusive probes and observes the response shape. The shape of the response, even before its content, is part of the signature. Two devices that report identical descriptors usually respond differently when probed in this way.
-
05
Packet-cadence fingerprint under load.
When the device is actively passing traffic, its packet cadence is shaped by hardware: NIC chipset, buffering depth, queueing strategy. Two devices with otherwise-similar profiles diverge here, which is what catches sophisticated impostors.
Higher layers ask the device. Layer 1 watches the device.
Network access control sees the corporate VLAN at Layer 2 and above. EDR sees endpoints with an agent on them. Asset management sees what was registered the last time someone updated the spreadsheet. None of these see the actual electrical behavior of the device when it draws a link.
Device DNA observes the wire. The wire does not lie. A device that has been physically modified, replaced, or substituted produces a different fingerprint regardless of what it tells the operating system.
Non-invasive by design.
The platform reads from the network without changing how it behaves. No agent on the endpoint. No rewiring. No changes to switch configuration that would risk an outage.
Behind the room's network drop.
RoomIQ ships as a small appliance that lives behind the conference-room drop. It observes Layer 1 traffic, derives Device DNA per port, and feeds the platform. Setup is measured in hours, per room.
Across the building's switch fabric.
SpacesIQ extends the same Device DNA approach across a building's existing switch fabric. The platform scales from a single floor to multi-campus deployments on the same instance.
On-premise by default.
Device DNA fingerprints stay on-premise unless the customer chooses cloud-hosted. Encryption at rest, role-based access control, per-export audit logs are standard. A SOC 2 Type II aligned program runs against the platform itself, with formal attestation on the roadmap.
The technical core is patented.
The Device DNA™ approach is the subject of CybrIQ's foundational patent. The patent covers the method of deriving a device signature from observable Layer 1 behavior and using it for continuous validation. Detailed patent and IP information is available under NDA on the demo call.
See Device DNA™ on your environment, not in a slide.
The 30-minute working session runs the platform live against one of your rooms or one floor of one of your buildings. You see the signatures, the validation events, and the audit-evidence pack on your own gear.