Layer 5 · Identity & Access

CyDusk

Zero-knowledge VDI. The user never sees the credential. Phishing becomes architecturally impossible.

CyDusk

CyDusk is a passwordless VDI broker. When a user clicks 'connect to db-prod-01', the credential is fetched server-side, injected into the RDP/SSH/VNC tunnel by the broker, and never crosses the user's network. Stolen laptops, browser extensions, keyloggers, and clipboard scrapers cannot obtain the credential. Ever.

Gallery

See Cydusk in action.

Use Cases

Where CyDusk wins.

1

Contractor & third-party access

Give 200 contractors access to internal apps without ever giving them passwords. Revoke in <60 seconds via per-session CAE. Onboarding goes from days to hours.

2

DBA / sysadmin privileged sessions

Replace CyberArk. DBA clicks 'connect', sees the session, never sees the password. Full session recording with forensic watermarking. SoD enforcement BLOCKS at request-time, not log-time.

3

Remote clinician / trader desktops

Browser-only access to clinical apps and trading terminals. No local install. No VPN. No PHI/PII on endpoint. HIPAA + RBI + SEBI compliant by architecture.

4

Cross-border GCC engineering teams

India engineering team accesses parent-company systems. Credentials stay in the parent's vault. India endpoints see only pixels. Data residency satisfied.

5

Citrix replacement (cost pressure)

Citrix per-CCU pricing + NetScaler + Director adds up fast — list 2-4× our price. CyDusk delivers VDI + PAM + session recording + MFA in one bundle.

6

M&A integration / temporary access

Time-bound TTL entitlements for external auditors, M&A teams, integration consultants. Auto-revoke at the end-date.

Key Capabilities

What's inside.

🔐

Server-side credential injection

Patent filings in progress. Verifiable property: stolen endpoints cannot exfiltrate the credential. Ever.

🔑

FIDO2 + PIV / CAC

Passwordless authentication built in. No paid add-on. Smart cards work via PKCS#11 redirection through CyLens.

🎥

Forensic-watermarked recording

Per-tenant DCT watermark. Every recording cryptographically attributable to the user session.

🌐

Browser-only access

RDP, SSH, VNC, SPICE, Kubernetes all rendered in browser via Guacamole. No client install, no VPN, no training.

SoD block at approval-time

When requester = approver, the request is BLOCKED with a reason — not silently logged like Citrix/Horizon.

⏱️

Time-bound access (TTL)

Entitlements expire automatically. Cleanup is reflexive, not policy-dependent.

vs competition: Replaces Citrix DaaS (2-4× more expensive), VMware Horizon (Broadcom-owned), CyberArk PAM (3-5× more for PAM-only).
Full battle card →

Ready to see CyDusk in action?

30-day proof of concept on two idle servers. We bring the SE. You bring the use case.