Ordr

Models classify devices and write policy inside a platform with other value. ORDR's in-house machine learning profiles devices from passive traffic (trained, the company says, on more than 100 million real devices), baselines their behavior, and writes least-privilege segmentation policies; ORDR IQ adds a language-model assistant and agents. Inventory drawn from 130-plus integrations, CMDB enrichment, security control gap reports, compliance evidence and enforcement through existing firewalls and NAC would still stand without the models.

Policy changes are simulated and approved before enforcement; the agents' limits are not published. The platform shows every device group, allowed flow and policy gap, simulates the impact of enforcement and asks the operator to approve before rules change, and enforcement runs through the customer's own firewalls and NAC. ORDR IQ, launched in November 2025 as a multi-agent orchestrator, is described as automating investigations and decisions, with no published list of what it may do without approval.

The approach is named without versions or evaluation. Device profiling uses in-house machine learning built on behavior from more than 100 million real devices rather than synthetic data, with behavioral baselines and ML-written least-privilege policies; ORDR IQ runs on any enterprise language model with zero data retention, including one the customer brings. No model version, update practice or accuracy figure is published.

A short chain for the device models and a customer-selectable one for the assistant. The profiling models are built and run in ORDR's own data center, and ORDR IQ uses an enterprise language model under zero data retention, which the customer can replace with its own; production runs on AWS us-east-1. The default language model provider is not named and no subprocessor list is published.

Named health system customers without outcome figures. Dayton Children's Hospital describes using ORDR with Cisco ISE to classify devices into segmented VLANs across 25,000 new devices, and case studies are listed for Franciscan Health, Beebe Healthcare, ProHealth, Fairview and Emplify Health. The company cites more than 100 million devices classified and 500-plus customers, and KLAS named it a market leader in 2022. None of it comes with a before and after figure or a stated method.

Categorical commitments on training and retention for the AI features. The privacy policy says the device profiling models are built in house and run in ORDR's own data center without exposing customer data to third-party models or outside training; ORDR IQ runs with zero data retention always on, processes input in real time, deletes it after computation, and never uses it to train models. The SOC 2 page adds secure data destruction at contract end. No retention schedule for collected device traffic is published, and nothing says whether customer traffic trains ORDR's own device models.

A service privacy policy with no business associate position. The privacy policy covers ORDR's hosted products, and the healthcare page carries a "HIPAA Compliant" badge, but no page states business associate status, offers an agreement, or says the platform does not handle PHI. Device traffic on clinical networks can carry PHI.

A recognized attestation is named with its scope, and the report is under NDA. The SOC 2 page says ORDR holds a SOC 2 Type II report from an independent PCAOB-registered firm covering Security, Availability and Confidentiality over a 12-month period, scoped to the SaaS platform on AWS us-east-1, with independent penetration testing; the report is available under NDA. The trust center page reset the connection when read. No ISO 27001 is held.

No device claim, with compliance work named for the security regimes a hospital answers to. The platform is security software without a clearance and needs none. It collects compliance evidence aligned to NIST, CIS, HIPAA and PCI and publishes material on the new HIPAA Security Rule provisions, but nothing addresses FDA device recalls or manufacturer disclosure statements, and no page states ORDR's own regulatory position.

Policy language, with no evaluation of the models. The published generative AI policy governs how ORDR employees use outside AI tools rather than how the product's models are tested, and the privacy policy describes ORDR IQ's data protections. The company publishes no accuracy, false positive or classification result, and nothing reports performance by device type or manufacturer.

Review before enforcement and audit logs exist; nothing stands behind the output. Generated policies are simulated and approved before they change the network, and ORDR IQ keeps audit logs of access, usage and administrative actions. No error rate, warranty, indemnity or remediation commitment is published. A misclassified device can be segmented wrongly, yet the company gives no classification precision by device class and no contract term for an enforced policy that disrupts care.

It does not connect to the clinical record; its integrations with the hospital's security and IT systems of record are named and run in production. The company cites more than 130 integrations, including Cisco ISE, ServiceNow CMDB enrichment, Nuvolo, Qualys, firewalls and VMware NSX, pushing device context to enforcement points and filling gaps in the CMDB. Dayton Children's runs ORDR with Cisco ISE to place devices in segmented VLANs.

SaaS with its region stated, and one option. The SOC 2 page places the production platform on AWS in the United States (us-east-1), with customer data segregated in a multi-tenant environment, and ORDR IQ in an isolated private-cloud environment; sensors collect traffic on site without agents or active scanning. No on-premises option, other region or cross-border processing is described.

No price is published, and the sales route is discoverable. The platform is sold as AI Protect for Security, AI Protect for Segmentation and ORDR IQ, with a free ORDR IQ sandbox and a demo request. No unit of charge or tier is published.

Healthcare settings are named and supported by named sites. ORDR covers IT, IoT, OT, clinical and cloud assets for health systems, including connected medical devices that cannot run agents, and named deployments at Dayton Children's Hospital, Franciscan Health, Beebe Healthcare and others; it also serves manufacturing, finance, government and retail.