Straight answers
The questions every CISO, assessor and engineer asks — answered the way we answer in the room. No marketing fog.
Does Kameen need internet access?
No. Kameen is air-gapped by design: it runs inside your network, dials only the targets your approved scope names, and makes zero outbound connections of its own. Intelligence (KEV, EPSS, MSRC, distro feeds) arrives as signed offline bundles you import; updates and licenses are signed files too. The platform is built to prove its isolation — the console carries a live outbound counter, and it reads 0.
Is Kameen certified or approved by NCA, SAMA or CIS?
No — and no tool is. Kameen is an independent product: it MAPS findings to framework controls (NCA ECC-2, SAMA CSF, CIS benchmark IDs and others) and produces the EVIDENCE regulators now ask to see — sealed before/after proof, patch metrics, remediation tracking, bilingual reports. We reference frameworks for cross-mapping only; all marks belong to their owners, and nothing we render implies endorsement or certification. If a vendor claims a regulator approved them, ask for the paper.
How do I know a finding is real?
Every candidate is falsified first — negative controls try to disprove it — then re-probed blind in a fresh context. Only what reproduces earns CONFIRMED; mismatched results earn PROBABLE, never more; what cannot be reproduced never ships. And refuted findings are not hidden in a drawer: they simply never reach a report.
Can I check the evidence myself, without trusting Kameen's UI?
Yes — that is the point. Every closed finding carries a signed attestation: sealed before/after proof pairs, an RFC 3161 timestamp, and population completeness backed by a Merkle log. A standalone verifier binary (kameen-verify) checks the whole chain offline — no Kameen installation, no network. If the bytes were altered anywhere, verification fails loudly.
Will Kameen change or touch my systems?
Never. The assessment side is read-only by architecture — an automated build check fails if any code path can write to an assessed host. Remediation is prescribed, not executed: Kameen packages the fix (with rollback declared and dry-run supported), YOUR team applies it in the change window, and the platform re-probes to confirm. The same rule gates everything: emergency stop, evidence reading and backups work even on an expired license — safety is never gated.
What does deployment look like?
An appliance inside your network: Go services, PostgreSQL, and the operator console — sized from a single node for a pilot to a small cluster for estate-wide campaigns. You import a signed license, import the content bundles you're entitled to, scope your first campaign, and go. Updates arrive as signed bundles with a health canary and automatic rollback.
How does licensing work?
Two axes, signed into your license file: capability modules (discovery, network assessment, authenticated checks, identity/directory, segmentation, controlled validation, compliance evidence, continuous retesting — plus offline artifact analysis) and REGIONAL FRAMEWORKS. You toggle the frameworks your country and sector actually answer to — a Jordanian bank gets its NCSC and central-bank frameworks, never another country's. Contact us for pricing; every deployment is sized to your estate.
What languages does it speak?
Arabic and English everywhere it matters: the operator console, every finding and its remediation guidance, compliance matrices control by control, reports, and the signed fix attestations. Arabic is a first-class language, not a translated afterthought — the region's assessors read evidence in Arabic.