Version 20260223.
adam:ONE®
adam:ONE® is the world’s first Zero Trust Resolver. It lets defenders neutralize advanced threats before they can execute or before they could be detected. The technology makes a default deny-all posture practical for every IP connection at scale, so network and security administrators can apply Zero Trust principles to any device that uses an IP protocol.
adam:ONE is a platform on which several technology elements work together. Its foundation is the adam:ONE® Muscle, a local caching resolver that integrates with a DNS and network firewall to write and destroy firewall rules at a rate of 10,000 per second. The Muscle combines:
- Don’t Talk To Strangers (DTTS)®, a Zero Trust DNS enforcement engine for every IP connection.
- A policy engine for flexible enforcement, including dynamic AI-driven allow-listing of default deny-all policies with AdaptiveAI™ and ReflexAI™.
- Real-time aggregation of the defender’s choice of Protective DNS (PDNS) resolvers.
Resilience is part of the design for mission-critical use, including High Availability (HA) and redundant PDNS resolvers.
A cloud-based “Brain” is the central controller and orchestration engine. Every deny or allow decision is made locally by the Muscle, and adam:ONE honors sovereign data custody: there is no TLS decryption and no centralized data flow to exploit.
Policies are managed through a cloud portal and API that hold all configuration and assignments. The dashboard is multi-tenant and multi-site, so the complete inventory is managed from a single pane of glass. A real-time log is available natively or can be integrated with SIEM, SOAR or SOC tooling, and the API-based controller integrates with many other security tools.
Deployment ranges from a transparent mode that displaces no existing technology to full endpoint layer 2 visibility by displacing internal layer 3 devices. Roaming devices are covered by adam:GO.
Features
- Smart Rollout: deployment with little to no business disruption.
- Agentless: no endpoint agents required.
- Single pane of glass: a multi-tenant, multi-site, multi-network dashboard for every network and site running adam:ONE®.
- Automatic device inventory through layer 2 visibility or AD/LDAP integration.
- Active Directory/LDAP integration: policies based on AD groups and users.
- Unlimited per-device policies, created and assigned.
- Unlimited per-user policies when used with 802.1X authentication.
- Unlimited per-VLAN or per-subnet policies.
- “Holding Tank” quarantine policy to enforce device quarantine when needed, as a smart alternative to Network Access Control (NAC).
- Sovereign data custody: no miscreant-in-the-middle decryption; the enterprise keeps full ownership and custody of its unmodified data in transit.
- East-west traffic control: network segmentation through policies, as a smart alternative to network access control lists.
- Aggregated real-time DNS threat intelligence through DNSharmony®.
- Leak-proof DNS, using DNS as the root of trust, through DTTS®.
- AI-powered dynamic allow-listing through AdaptiveAI™ and ReflexAI™.
- Mobile and multi-homed devices protected through adam:GO™ and adam:OSN™.
- Cellular networks protected through adam:APN™.
Architecture
An on-premises, gateway-hosted client (the Muscle) receives its configuration from a centralized cloud controller (the Brain), which optimizes resilience and local performance at the same time. DNS queries and answers stay in geographic proximity to the endpoint, and every network traffic decision is made locally. The Muscle can be deployed as a physical appliance, a virtual appliance or a container.
DNSharmony®
Domain reputation systems and PDNS threat intelligence sources are readily available, commercially and as free or open source. The best PDNS threat intelligence is an aggregation of every source available in a given environment, which is what DNSharmony® is designed to provide.
- Aggregated PDNS threat intelligence out of the box from open source feeds including Cloudflare, Quad9, CleanBrowsing, AdGuard and more.
- Integration of commercial feeds such as Infoblox and Umbrella.
- Integration of compliance-mandated feeds such as the CISA protective resolver.
- DNS redundancy by default if one or more feeds become unavailable.
- Works alongside other PDNS servers or as the enterprise’s DNS server.
- Resolver of last resort and continuous domain validation: a final check on every outbound DNS connection when used with ReflexAI™ or AdaptiveAI™ dynamic allow-listing, to make sure a domain hasn’t gone bad.
Don’t Talk To Strangers (DTTS)®
A stranger, in this context, is an IP address that has not been resolved or discovered through a permitted DNS query or any form of DNSless traffic. DTTS® is a patented technology that enforces DNS as the root of trust unless policy permits the traffic through an Enabler.
Enablers are configurable sets of protocols, ports and IP addresses or FQDNs. They let the enterprise shape the DNSless traffic it needs while keeping complete control over outbound connections. DTTS® takes a proactive approach to command-and-control (C2) connections by denying them by default. ADAMnetworks and industry partners are formalizing the approach in an RFC draft for IETF submission in 2025.
- Granular control over IP-to-IP connections and DNSless traffic.
- DTTS® Learning mode: shows what would have been blocked had DTTS® been enabled, for a non-disruptive deployment.
- Verified Enablers for well-known applications such as WhatsApp and Apple services, maintained by ADAMnetworks®.
- Custom Enablers for in-house and third-party applications.
The DTTS® architecture is shown at the top of this page: an outgoing TCP or UDP connection from the internal network reaches the WAN only if the gateway sees it was previously established, or if a valid DNS query preceded it within the answer’s time-to-live. Otherwise the connection is reset (TCP) or blocked (UDP).
AI-driven dynamic allow-listing
adam:ONE® uses AI/ML engines to power dynamic allow-listing. That removes the burden of maintaining a static allow list and lets adam:ONE® commit to the “never trust, always verify” approach to network connections without disrupting business operations. Different allow-listing approaches let a policy match the role of a user or device.
Fixed rule(s) policy
Pre-made lists or observation establish the internet domains and FQDNs an asset needs as an allow-list. Fixed rule(s) policies are typically used for Active Directory controllers, file and application servers, web servers, IoT devices, and printers and scanners.
- Domain traffic is fixed to allowed resources only.
- No circumvention, even if the asset is compromised.
AdaptiveAI™
AdaptiveAI™ learns over 30 to 90 days per site or per network and dynamically adds domains as users request them. In incident response, the learning phase can be skipped to move straight to a full ZTc posture, creating immediate radio silence to C2 and stopping potential data exfiltration.
Each request passes through cloud-based sandbox testing and AI inspection that decides whether it is safe for work. Along the way, every dependency the online service needs is gathered and tested by the same inspection, and only the domains deemed safe are added to the dynamic allow-list. AdaptiveAI™ lets the enterprise tightly define the internet for its users while still letting them request more domains as needed. It is recommended where a user’s role is well defined, such as accounting, or for high-value assets such as the C-suite.
- Strict shaping of the internet: phishing is mitigated because only allowed domains can connect.
- Attacks that redirect traffic midstream are blocked by default, because adam:ONE® vets every destination before the user can connect.
- Dynamically added domains must pass the cloud sandbox and AI testing, and can be held for human inspection before they are allowed.
ReflexAI™
ReflexAI™ is a dynamic allow-listing engine that sorts 82 domain categories and tags into five decision buckets: Always Block, Block, Review, Allow and Always Allow. Beyond custom policies, the decision engine supports customizable conflict resolution when a multi-category domain falls into allowed, blocked or human-review buckets at once. The categories come from ADAMnetworks® and third parties. The bucket assignments are customizable, and the enterprise can build as many ReflexAI™ policies as it needs.
The AI/ML engine resolves conflicts with three decision levels: Permissive, Hold for Human and Protective. ReflexAI™ needs no learning time, because dynamic allow-lists are created in real time within user space with no disruption to the user.
- User-transparent protection: a block happens only when the user tries to reach a domain outside the parameters the enterprise has set.
- Proactive defense against phishing and redirect attacks: as with AdaptiveAI™, every destination is validated before the user can connect.
- Domain categorization lets the enterprise shape the internet for its users and enforce appropriate use policies.
- Uncategorized, generally unknown domains are denied by default, so the connection fails closed.
adam:ONE® summary
Combining any of these policy engines with DTTS® brings a device into a Zero Trust Connectivity (ZTc)™ state. A device in a ZTc™ state has proactive egress control against malicious outbound connections such as C2 beacons and data exfiltration. Its users are protected against phishing: even if a user clicks a malicious link, the device’s default deny-all state refuses the connection unless policy has verified and allowed it.
A network governed by ZTc™ policies allows only verified good destinations. It does not spend resources trying to detect indicators of compromise, or reactively terminate connections to known malicious destinations, which can only happen after a victim has been identified and the destination submitted to an intelligence source.
adam:GO®
adam:GO® protects mobile and other multi-homed devices on Windows, iOS, iPadOS, macOS, ChromeOS and Android. It can be distributed through a UEM (EMM/MDM) enforced VPN, giving the same level of security as devices behind adam:ONE® on the enterprise network, or as an Operating System Native (OSN) Muscle application.
adam:GO™ VPN
VPN-based adam:GO® can connect back to the on-premises adam:ONE® at the enterprise or to adam:ONE® cloud exit points in different geographic locations.
- UEM (EMM/MDM) agnostic.
- OS agnostic: Windows 10+, Android 9+, iOS/iPadOS 16+, ChromeOS 110+.
- Unified policy creation in the adam:ONE® dashboard.
- Device protection regardless of the network used to reach the internet.
- Circumvention protection: unauthorized DoH, DoT, proxies and other methods are denied by default and replaced by an internal DoH element that can point to any upstream DoH resolver set the administrator chooses.
- DTTS® works on mobile devices exactly as it does on enterprise network devices.
- VPN modes supported through MDM enforcement: lodVPN (locked on demand), odVPN (on demand) and aoVPN (always on).
Supported platforms: iOS and iPadOS, macOS, Windows, Linux, ChromeOS and Android.
adam:GO™ OSN
The Operating System Native (OSN) Muscle is a ZTc stack for mobile devices that brings the perimeter edge onto the device. There are currently two deployment types: Apple iOS and Windows.
adam:GO™ OSN for iOS and iPadOS
The adam:OSN™ app for iOS and iPadOS implements adam:ONE® with DTTS® natively on iOS. It uses iOS SDK providers to filter network traffic system-wide, intercepting every socket and DNS query and applying the rules of the device’s policy, with no need for a VPN or local gateway. It uses the iOS Network Extension framework, within defined sandbox restrictions for the user’s privacy.
- iOS version: iOS 16 or later.
- Supervised mode: the device must be supervised, which is essential for enabling Content Filter Providers and enforcing DTTS logic.
- MDM configuration: used to upload the configuration profile needed for filtering and policy enforcement.
- Initial network requirements: stable connectivity is needed during initial setup.
- After configuration: the app works without stable connectivity, using adam:ONE® with DTTS for internet connections.
adam:APN™
On cellular networks, the provider traditionally assigns network functionality, including which DNS servers to use, with very little flexibility. Apart from MDM payloads that can modify client-side DNS behavior, the options are limited.
Where a cellular provider offers a custom Access Point Name (APN), adam:ONE can deliver adam:APN services to every cellular endpoint using that APN:
Requirements for adam:APN
- The cellular provider must offer a custom APN option; for example, att.com and rogers.com offer such services to SMB and enterprise customers.
- The cellular provider must supply network routing details, including BGP details and provisioning support.
- The cellular customer must have one or more ways to apply the custom APN to endpoints, such as pre-provisioned SIM/eSIM or a Mobile Device Management (MDM) or Enterprise Mobility Management (EMM) platform.
- The cellular provider must provide physical or virtual capacity for size-appropriate hardware that runs VyOS 1.4 or later and is remotely accessible for deployment by ADAMnetworks or a Licensed Technology Partner.
- The cellular provider must allow at least two appliances for High Availability.
- Each appliance, virtual or physical, requires a ZTc SMB or ZTc Enterprise plan.
- The environment must be supported by a Licensed Technology Partner in good standing with ADAMnetworks.
adam:ONE® DNSharmony®
Gateway based
A limited-feature version of adam:ONE® that uses DNSharmony to aggregate multiple PDNS resolvers for enhanced, resilient DNS resolution as a local resolver. See DNSharmony® above.
DNSharmony® for iOS, iPadOS and macOS (in development)
DNSharmony PDNS aggregation as an on-device, stand-alone solution, with an enhanced user experience that shows estimated latency and performance against the protection benefit.
