ForteLock / Continuous Active-Protect
ForteStrike finds the lock; ForteLock throws it. An assessment is a snapshot — true the moment it runs, and stale the moment a service comes up that nobody approved. ForteLock is the standing guard between assessments: it learns what your scope is supposed to expose, watches for anything that drifts past that line, and reversibly closes it — containment only, never exploitation.
How the guard works
1 · Adopt the baseline
ForteLock takes the approved exposure — the open services a clean baseline says should be reachable — and turns it into an allowlist. Approved services are the ground truth; everything else is drift, and drift is what the guard is watching for.
2 · Sweep on an interval
On a timer — 300 seconds by default — ForteLock runs a full 1–65535 sweep of every host in scope. Not the common ports; the whole range, every cycle, so nothing hides on a high port between assessments.
3 · Diff against the allowlist
Each sweep is compared to the approved allowlist. A port that is new, network-reachable, and not on the list is an exposure that appeared after the baseline — the exact drift an assessment cannot catch because it is not looking.
4 · Contain, reversibly
A new unapproved port is firewall-DROPped at the host — iptables on Linux, netsh on Windows — and only that port. No payload, no exploit, no probe of the service itself. Containment, not attack. Every DROP has an undo.
5 · Never touch the approved
An approved service is never contained, throttled, or disturbed — not once. ForteLock acts on the delta from the baseline and nothing else, so the business keeps running while the drift gets closed.
6 · Ledger and alert
Every containment appends to a ledger and fires an alert: what appeared, on which host, on which port, when, and the undo to reverse it. You learn about drift from the guard, not from an assessor months later.
Containment that ships as evidence
Each containment is control-mapped the moment it is written, so the guard's day-to-day work doubles as assessment evidence. Reversibly closing an unapproved port is boundary protection under SC.L1-3.13.1 and least functionality under CM.L2-3.4.7; the continuous full-range sweep is monitoring under SI.L2-3.14.6; and the mapping carries through to the 800-53 controls behind them — SC-7, SI-4 — and to ATT&CK T1571 for the non-standard-port exposure it catches. The ledger is not a log an assessor has to take on faith; it is a signed record of what drifted and how it was closed.
Where it sits next to ForteStrike
ForteStrike's Phase 4 lockdown is a one-shot: it closes the exposures a single authorized engagement confirmed, then the engagement ends. ForteLock is the other half of that promise — autonomous and continuous, holding the line the assessment drew. ForteStrike proves the door is shut today; ForteLock keeps it shut tomorrow, and every 300 seconds after that. Both are reversible, both air-gappable, and neither phones home: no cloud, no AI, no exploitation — the guard only ever closes what drifted, and only ever in a way you can undo.
Keep the door shut between assessments.
ForteLock is in active build and opening to Early Adopters. Point the guard at your own fleet, watch it adopt your approved baseline, and get a control-mapped ledger every time a new exposure drifts in and gets reversibly closed.