Our Technology

Verigio's technology brings security and network optimization to where they are fastest and least intrusive: inside the operating system itself. It is a kernel-mode, man-in-the-middle (MITM) TCP/IP framework that inspects and transforms network traffic from within Windows kernel drivers — transparently to the applications that use the network.

The framework is a complete TCP/IP networking stack, built from the ground up specifically for security and optimization. The two parties of a network conversation keep communicating normally, unaware that security checks and optimizations are taking place between them. It supports the network protocols in common use today and runs programmable operations in the heart of the operating system — within kernel drivers.

Traditional security frameworks analyze traffic in user space, forcing packets to copy back and forth from the kernel. In contrast, Verigio’s framework operates directly inside the operating system. This architectural shift in packet processing location drastically improves transformative capabilities and performance.

Follow a single packet through each design:

Other security frameworks	Verigio framework
Every packet is copied up into a user-mode application and back, crossing the kernel/user-mode boundary twice.	Every packet is processed inside the driver and never leaves the kernel.
Where other frameworks lose time (A) and (C) Kernel-mode to user-mode transition, for every packet [CPU, MEMORY] Memory is allocated and copied to move each packet between kernel mode and user mode. [CPU] The transfer is serialized, voiding the benefit of multiple CPU cores. [CPU] Every switch between kernel mode and user mode carries its own overhead. (B) User-mode traffic processing [CPU] Processing runs on user-mode threads that compete for CPU with every other application. [CPU, MEMORY] Packet memory can be paged out to the page file and must be paged back in. [CPU, MEMORY] Data queues up whenever processing is slower than the traffic arriving from the kernel.	What the Verigio framework does instead (B) Kernel-mode traffic processing Each packet is inspected and optimized inside the network driver, in kernel mode. Because it never crosses into user mode, the transitions (A) and (C) never happen and no packet memory is copied. Processing runs at kernel driver priority in non-paged kernel memory — no competition with user applications and no page-file stalls. Suspicious activity is detected and filtered early, in the kernel, before it reaches applications. It also keeps deployment simple: No changes to existing software and no application-specific libraries or technologies. Installs and upgrades independently of applications, with virtually no compatibility conflicts.

Like other frameworks, Verigio's framework can also run entirely in application space when a deployment calls for it. Its real advantage, though, comes from operating inside kernel drivers — something other frameworks cannot easily match. By removing the common processing bottlenecks at their source, the framework gets the most out of existing hardware and virtual machines.