BLACKSHIELD

Public Guide

What Security Buyers Should Expect from BlackShield

BlackShield should earn trust with concrete product controls: authenticated workspace access, rate-limited sensitive actions, triage workflows in `/findings` and `/alerts`, and exportable evidence from `/reports`, `/audit`, and `/compliance`. Audience: Security buyers, procurement leads, legal teams, and risk stakeholders. Typical setup time: 12-18 minutes.

trust

Use this if

BlackShield should earn trust with concrete product controls: authenticated workspace access, rate-limited sensitive actions, triage workflows in `/findings` and `/alerts`, and exportable evidence from `/reports`, `/audit`, and `/compliance`.

Audience
Security buyers, procurement leads, legal teams, and risk stakeholders
Typical time
12-18 minutes

Before You Begin

  • Have a demo or trial workspace available so the buyer can see the actual BlackShield surfaces.
  • Collect the buyer, legal, and security questions the review must answer.
  • Identify the approvers from security, procurement, legal, and privacy.

Guide walkthrough

Step 1

Verify where BlackShield puts administrative control

In BlackShield, the controls buyers usually ask about are visible in product: `/identity`, `/api-keys`, `/audit`, `/compliance`, and `/tenant-rights`.

  • Open `/identity` and confirm tenant admins can configure OIDC, validate provider settings, map groups to roles, rotate SCIM tokens, and review identity audit events.
  • Open `/api-keys` and confirm API keys can be created, listed, and revoked from the tenant workspace.
  • Open `/tenant-rights` and confirm tenant admins can see tenant scope and required confirmation steps before running destructive actions.

What success looks like

Open `/tenant-rights` and confirm tenant admins can see tenant scope and required confirmation steps before running destructive actions.

Step 2

Verify how BlackShield protects sensitive actions and daily operations

The platform should show specific protections, not generic assurances, and it should show where security teams triage risk day to day.

  • BlackShield rate-limits onboarding, login, token refresh, OIDC exchange, identity writes, API key writes, and tenant deletion flows.
  • Administrative APIs require authenticated access and explicit role permissions before they return data or accept changes.
  • Open `/findings` and `/alerts` to confirm the workspace has a concrete place to triage open security issues instead of relying on static reports.
  • Audit queries and audit exports are themselves recorded so evidence access leaves a trail.

What success looks like

Audit queries and audit exports are themselves recorded so evidence access leaves a trail.

Step 3

Verify how BlackShield gives buyers proof

The buyer should be able to walk away with product-backed proof, not just docs copy.

  • Open `/audit` and confirm BlackShield supports filtered event queries plus CSV and JSON export.
  • Open `/compliance` and confirm benchmark heatmaps, control drill-down, and coverage export are available for control evidence.
  • Open `/reports` and confirm you can produce executive-facing exports for procurement and legal reviewers.
  • Open `/tenant-rights` and confirm tenant deletion requires an exact confirmation phrase plus irreversible acknowledgement.

What success looks like

Open `/tenant-rights` and confirm tenant deletion requires an exact confirmation phrase plus irreversible acknowledgement.

What success looks like

  • The buyer can name the exact BlackShield screens that cover identity, audit, compliance, and tenant deletion.
  • Open questions have named contacts, response dates, and a concrete next step.
What Security Buyers Should Expect from BlackShield | BlackShield Docs