Fudo Enterprise

Why Fudo Enterprise?

When a privileged account does something damaging, cybersecurity rarely has an authorisation failure to point at — the account was allowed to do it. What is left is the recording: what was typed, in what order, and by whom. That is the artefact this class of product exists to produce.

In a large organization there are always more privileged accounts than the administrator list suggests. Some belong to vendors, some to scripts and services, and the passwords to many of them are known to more people than they should be.

Fudo Enterprise is a solution for managing remote privileged access. It acts as a proxy between users and servers and registers mouse movements, keystrokes and transferred files, with no software to install on target servers. Credentials are kept in the Password Vault with automated rotation. AI behavioral analysis runs on an internal model and sends no data outside the system.

How does it work?

Agentless access gateway

• Proxy mode: the user connects to the Fudo address and the port assigned to a server; the real addressing stays hidden and servers can be set to accept connections from Fudo only
• Bastion mode: one address and port for a group of servers, with the target server specified in the login string
• Connections from native clients or from the built-in browser-based client
• Over 10 protocols, including RDP, SSH and HTTPS
• Credential substitution: Fudo logs in to the target server with credentials from the account or the vault, and the user never sees them

Password Vault

• Encrypted vault for passwords, SSH keys, X.509 certificates, API keys and notes
• Hierarchical collections (up to five levels) with object rights inherited through roles
• Secret checkout and checkin recorded in the log
• Automated secret rotation with Secret Changer
• Checking passwords against compromised password lists (plaintext or SHA-1 hashes)

AI behavioral analysis

• Three models: mouse biometrics (RDP, over 700 features), keyboard biometrics (RDP, over 100 features) and a semantic command model (SSH, over 600 features) — over 1400 features in total
• A quantitative model compares the number of connections and session length with what the system expects
• Threat level and threat probability for ongoing sessions
• Internal model — behavioral analysis data does not leave Fudo Enterprise

Key Features

Session recording and supervision

• Full network traffic of each session recorded with metadata: playback and full-text search
• OCR of recordings from RDP, VNC and rendered HTTP sessions, including Polish
• An administrator can join an ongoing session, share it, pause it or terminate it
• Export of a recording to a video file and timestamping of stored data, which strengthens the evidential value of the record
• Live supervision enforced per safe: the “Live supervision required” option requires a set number of signed-in supervisors to watch the session — the four-eyes principle enforced technically. Anonymous viewers do not count towards that number.

Just-in-time access and approval

• The user sends a request from the portal and a defined number of approvers vote; a single vote against rejects the request
• Time windows for resource availability, in line with the zero standing privileges principle
• Time-boxed access and instant revocation
• The “Require approval” option: connecting to a server requires prior approval
• Request reasons in defined fields (JiT Reason Formats) that a ticketing system can process easily

Secret rotation and account discovery

• Secret Changer changes secrets over SSH, LDAP, Telnet or WinRM; ready templates for Unix, MySQL, Cisco and Windows systems, custom scripts possible
• SSH key rotation: a policy sets the change frequency and the key algorithm (e.g. Ed25519)
• Discovery: scanning of Active Directory accounts (LDAP), servers registered in the domain controller and local accounts on Windows servers (WinRM), manually or on a schedule; discovered accounts can be brought under control or blocked (quarantine)
• Integration with external password repositories: CyberArk Credential Provider, Thycotic Secret Server, LAPS and Azure Key Vault

High availability

• Multimaster cluster with configuration synchronized between nodes
• Redundancy groups: when a node fails, its IP addresses are taken over by the node with the highest priority; different priorities allow static load balancing
• Data of ongoing sessions is replicated to other nodes while the connection is running
• A limitation described in the documentation: sessions recorded by a failed node are terminated and the user reconnects; the cluster does not replace backup

Reverse Proxy

The Reverse Proxy feature has Fudo establish an outbound SSH connection to an external server, such as a container in the DMZ. Users connect to that server, and the traffic comes back through the tunnel to internal resources.

In nFlo’s view this mechanism works well for networks we do not want to route external connections into, for example in OT and energy environments — this is our recommendation, not a vendor claim.

AI in session analysis

• Responses to a behavioral anomaly: email notification, SNMP trap, pausing or terminating the session, blocking the user
• AI Session Summary: on-demand summaries of selected SSH and RDP sessions; requires a model from an external provider (e.g. OpenAI, Anthropic) or your own model served through Ollama — with an external model, session content goes to the provider
• AI Live Session Monitoring (beta feature): AI agents analyze the transcript of an ongoing SSH session, and a policy can notify the administrator, pause or terminate the session, or block the user; the feature is disabled by default

Sudo command control

The Sudo Command Control Policy lets Fudo authorize sudo commands executed in SSH sessions on Linux systems: only commands matching defined regular expressions are allowed, and every attempt is logged. The feature requires the Fudo sudo plugin to be installed on target systems — the exception to agentless operation.

Supported Protocols

Protocol	Use
SSH	Terminal, SCP, SFTP, port forwarding, X11 over SSH; proxy, bastion and tunnel modes
RDP	Windows Server 2016 and newer desktops, Remote Applications
HTTP	Web applications, rendered sessions with OCR
VNC	Remote desktop
Telnet, Telnet 5250	Terminal systems
Modbus	Industrial protocol, proxy mode only
Databases	MS SQL, MySQL, PostgreSQL, Oracle (beta)
TCP	Generic unencrypted connections, proxy mode

AI Behavioral Analysis — what it measures

Keyboard (RDP):

• Over 100 typing dynamics features
• Rhythm and keystroke force
• Key sequences

Mouse (RDP):

• Over 700 features of how the pointing device is operated
• Acceleration and micro-jitter
• Device type

Commands and sessions:

• Command preferences in SSH, such as wget over curl, plus over 600 character-group features
• Number of connections and session length against expectations
• Tolerance and reporting thresholds set by the administrator
• Models trained on a schedule from archived sessions, individually for each user

Who is it for?

• Organizations where privileged accounts are used by many teams, vendors and scripts
• Financial institutions and entities in scope of NIS2 that must demonstrate control over privileged access
• OT and industrial environments that need oversight of maintenance access, including over Modbus
• Teams that need session recordings as evidence

Benefits

For security: behavioral analysis of ongoing sessions, automatic pausing or termination of sessions and user blocking, live supervision with a required number of supervisors

For IT: no agents on servers (apart from optional sudo control), a single access point, password and SSH key rotation without manual work

For compliance: full session records, cryptographically signed logs and reports for auditors. The vendor describes Fudo Enterprise as helping to meet PCI DSS, SOX, HIPAA, NIST, GDPR and ISA/IEC 62443 requirements and to prepare for NIS2 and ISO/IEC 27001 audits.

Specifications

Architecture	Agentless proxy/bastion gateway, multimaster cluster
Distribution	19” appliance (2U, 3U or 4U) or virtual machine
System	FreeBSD base system, connection isolation with CAPSICUM
Encryption	Data stored on Fudo encrypted with AES-XTS and 256-bit keys
AI	Three behavioral models (over 1400 features) and a quantitative model, internal model
Vault	Password Vault: passwords, SSH keys, X.509 certificates, API keys
Authentication	Password, public key, RADIUS, LDAP, Active Directory, OATH, SMS, DUO, certificate, OpenID Connect
Integrations	Syslog, SNMP TRAP, SCIM, external password repositories

FAQ

Does Fudo Enterprise require agents on servers? Not for access and recording: Fudo acts as a proxy, and users connect with native clients or through the browser. The exception is the optional sudo command control, which requires the Fudo sudo plugin on Linux systems.

How does the Password Vault work? Secrets sit in an encrypted vault, organized in collections with inherited rights. Every checkout and checkin is logged, Secret Changer rotates passwords and keys, and the system checks passwords against compromised password lists.

Does AI require training? Yes. Models are built from archived sessions on a schedule set by the administrator (days, time, data range) and calibrated individually for each user.

What alerts and responses does AI trigger? Deviations in typing dynamics, mouse movements, commands, or the number and length of sessions. A policy can send an email or an SNMP trap, pause or terminate the session and block the user.

What does high availability look like? A multimaster cluster with redundancy groups: when a node fails, another node takes over its addresses. Sessions recorded by the failed node are terminated, and the cluster does not replace backup.

Can I integrate Fudo with a SIEM? Yes. Fudo forwards event log entries to external Syslog servers and sends SNMP TRAP notifications.

Does the user know the server password? They do not need to. Fudo authenticates the user and logs in to the target server with credentials from the account or the vault without revealing them.

Does Fudo support SSH keys? Yes. The key is a secret in the Password Vault, and a change policy defines how often it is rotated and which algorithm generates it.

How does account discovery work? Scanners search Active Directory over LDAP and local accounts on Windows servers over WinRM, manually or on a schedule. Discovered accounts can be brought under control or blocked.

Does session data leave our infrastructure? Behavioral analysis sends no data outside Fudo. AI Session Summary and AI Live Session Monitoring (beta) pass session content to the connected model — outside your infrastructure only when that model belongs to an external provider.

What about support? nFlo handles deployment, configuration and maintenance of Fudo Enterprise, and escalates issues that need the vendor to the Fudo Security support team.

Why deploy Fudo Enterprise with nFlo?

• Privileged account inventory — before configuring anything, we establish who connects to critical systems and with which accounts, including vendor and script accounts.
• Architecture and policy design — we choose the operating mode (proxy, bastion, Reverse Proxy), safes, approval and supervision rules to fit your processes.
• Deployment and integration — we launch Fudo Enterprise and connect the user directory, the Password Vault and event forwarding to your SIEM.
• Maintenance and reviews — we update the platform, review permissions and AI policies, and handle incidents.

The stages and scope of work are described on the PAM Implementation service page.

You will find more about privileged access management in the identity and PAM knowledge base.

To talk about your environment, use the contact form.