Vendor and Product Reality
Armis, founded in 2015, ships the Armis Centrix platform across asset management and security, vulnerability management, OT/IoT security, and medical-device security modules. The platform integrates broadly with existing infrastructure such as network access control (for example Cisco ISE and Aruba ClearPass), firewalls, EDR, ITSM, and SIEM, and consumes telemetry from those sources rather than installing endpoint agents on the monitored devices. Discovery is agentless and largely passive: span ports, network taps, flow data, wireless controllers, switch tables, and integration-pulled inventories feed the device graph, which is then matched against the Armis Asset Intelligence knowledge base to identify make, model, firmware version, and risk profile. Armis is deployed across large healthcare systems, federal agencies, manufacturing, and critical-infrastructure operators.
The risk model is behaviorally and signature driven. Armis assigns a risk score based on device type, observed behavior, known CVEs against the inferred firmware, peer-comparison anomaly, and policy compliance. When risk crosses a threshold, the platform triggers a NAC quarantine, opens a ServiceNow ticket, or feeds a SIEM detection. The product's strength is breadth, it sees the unmanaged device the EDR does not, and its operational value is in compressing mean-time-to-discover for devices that fall outside the IT inventory.
The architectural axis this article addresses is device-signed attestation, and it follows directly from the agentless design rather than from any defect. Because Armis observes devices externally through network telemetry rather than running on the device, its identity signal is a fingerprint inferred from behavior, not a cryptographic statement signed by the device about what it is and what it is running. That is the correct tradeoff for its problem, which is seeing unmanaged and unagentable assets the enterprise never enrolled. But a device fingerprint, however strong, is a heuristic classification. A medical infusion pump that matches a known model's traffic pattern is identified as that model whether or not its firmware has been replaced, its configuration tampered with, or its supply chain compromised before deployment. It is not, in the architectural sense, a credentialed observation rooted in the device.
The Architectural Gap
The gap is observation-class. Armis emits health observations, risk scores, anomaly flags, vulnerability matches, that are not credentialed at source by the device itself. A device on the network is observed externally; the observations cannot be cryptographically tied to a hardware root-of-trust on the device, a tamper-evident seal on its firmware, or a verified bill of materials for what is running. This is acceptable in an environment where the threat model is "unknown device on the network." It is not acceptable in an environment where the threat model includes supply-chain compromise (firmware altered before delivery), insider tampering (technician swaps a chip), counterfeit replacement (maintenance vendor substitutes a non-OEM module), and high-confidence revocation (a CVE disclosed today must propagate to disable matching devices in minutes, not weeks).
Healthcare, OT, and federal critical infrastructure are converging on these threat models under FDA premarket cybersecurity guidance, IEC 62443, NIS2, EO 14028 SBOM requirements, and the CMMC framework. Those regimes increasingly call for properties that sit below the layer a passive discovery platform operates at: attested device identity rooted in hardware; SBOM attestation that the running firmware matches the disclosed bill of materials; tamper-evident seal monitoring that detects physical and logical compromise; PUF-based challenge-response such that a counterfeit device cannot impersonate the genuine one; zero-trust device management in which every operation requires a fresh credential rather than a trusted perimeter; and revocation that propagates cryptographically across the fleet. These originate at the device, not in a monitoring platform observing it from the network.
The structural property Armis lacks is health observation as credentialed device-self-attestation feeding a governance chain. It cannot be added by integrating one more passive feed; it requires a substrate that originates at the device.
What the AQ Primitive Provides
The health-monitoring primitive specifies that every fleet-health observation be a credentialed self-attestation rooted in hardware, weighted into the governance chain, and recursively closed through revocation propagation. First, every device participates with a hardware root-of-trust, a TPM, a secure element, or a PUF (physical unclonable function), that signs attestation messages under a credential issued by the device manufacturer or a delegated authority. Tamper-evident seal state, including secure-boot measurements, runtime integrity beacons, and physical-tamper indicators, is published as a signed observation rather than inferred from network behavior.
Second, every device publishes an SBOM attestation: the bill of materials of the firmware actually running, signed by the device, traceable to a manufacturer-signed reference SBOM, so that a divergence between running and reference is detectable and structurally provable rather than heuristically inferred. Third, identity is verified through PUF challenge-response: the device responds to a fresh challenge with a signature that only the genuine hardware can produce, defeating counterfeit and clone devices that pass passive fingerprinting. Fourth, device management is zero-trust: every operation, configuration push, firmware update, credential rotation, command, requires a fresh signed authorization evaluated against the device's current attested state, with no implicit trust derived from network position or prior session.
Fifth, revocation propagates across the fleet as a signed governance event. When a CVE is disclosed, a tamper event is observed, or a credential is compromised, the revocation is signed by the issuing authority and distributed through the lineage substrate so that affected devices, dependent services, and orchestration controllers update on receipt. Every attestation, weighting, decision, and revocation is recorded in lineage with cross-authority signatures, and every downstream effect re-enters the chain as a fresh observation. This is health monitoring as a governance substrate, not as a risk dashboard.
A skilled implementer can build this from commodity parts. The hardware root of trust may be a TPM, a secure element, a secure enclave, or a PUF, and the attestation signature may use classical or post-quantum primitives where long-lived provenance is required. The reference SBOM may be published by the device manufacturer, a delegated integrator, or a regulated authority, and divergence detection may run at the device, at a verifying edge node, or at a fleet aggregator. Health observations may be emitted continuously, on a schedule, on state change, or on challenge, and may be composed across categories, combining device operational health with supply-chain authenticity, mesh-communication health, and governance-chain integrity into a single composite assessment. The credentialed-observation and lineage layers are transport-independent: they can ride the governed mesh protocol, or be carried over existing network fabric and integration APIs where a mesh is not deployed. Fleet aggregation, fault localization, predictive maintenance, end-of-life coordination, and a credentialed health-service-provider ecosystem are disclosed variations of the same primitive. These variations are enumerated so the disclosure is enabling and broad, not tied to one hardware choice or deployment topology.
Composition Pathway
Armis's existing platform composes naturally with the primitive rather than competing with it. The Centrix discovery and integration mesh becomes the distribution and weighting layer for credentialed attestations; the Asset Intelligence knowledge base becomes the reference catalog against which SBOM attestations are validated; the integrations to NAC, SIEM, and ITSM become the enforcement and revocation propagation surface. What is added is the credentialed observation source: devices that publish attestations, SBOMs, PUF responses, and tamper-evident state under their manufacturer credentials.
For brownfield devices that cannot self-attest, the primitive supports a delegated attestation pathway. A paired edge node observes the legacy device and signs a health observation under its own credential class, and the governance chain weights that observation as advisory rather than dispositive, consistent with the specification's treatment of lower-authority contributions as advisory input carrying reduced evidential weight. This preserves coverage of unmanaged legacy assets while creating a structural pathway by which next-generation devices, which can produce device-signed attestations, contribute stronger evidence within the same chain. Revocation propagates through the existing integration fabric: a signed revocation reaches NAC for quarantine, SIEM for detection, ITSM for ticketing, and the governance lineage for audit, all under the same credential.
The composition leaves Armis's commercial position unchanged in its current customer base while extending it into the regulatory cycle that is converging on attestation-grade health observation across healthcare, critical infrastructure, and federal IT.
Commercial Implication
Armis's customers, hospital systems under FDA premarket cybersecurity guidance, federal agencies under EO 14028 and CMMC, and OT operators under IEC 62443 and NIS2, face regulatory cycles that increasingly ask for attestation, SBOM, and revocation properties that originate at the device rather than in an external monitoring layer. That regulatory direction is category-wide, not specific to any one vendor, and applies equally to the broader passive-discovery and OT-visibility category. The distinction this article draws is architectural and not a claim about any competitor's roadmap: a discovery platform and a device-signed attestation substrate address different layers and compose rather than conflict.
Positioned as an architectural axis, the disclosure is straightforward: a device-fleet health deployment that adds tamper-evident seal monitoring, SBOM attestation, PUF challenge-response, zero-trust device management, and cryptographically propagated revocation, recorded as credentialed lineage-preserving observations, practices the Health Monitoring primitive disclosed here. The point of publishing it is to place that architectural property on the record as a dated public disclosure tied to the filing.
Disclosure Scope
The invention described here, the Health Monitoring primitive and its device-self-attestation, SBOM, PUF challenge-response, tamper-evident seal, zero-trust device management, revocation-propagation, fleet-aggregation, and lineage-recording embodiments, is disclosed in U.S. Provisional Application No. 64/049,409. All statements about what this technology does trace to that specification. References to Armis, Armis Centrix, and to other named platforms and vendors, and all descriptions of regulatory regimes (FDA premarket cybersecurity guidance, IEC 62443, NIS2, EO 14028, CMMC), are provided as external market and technical context to situate the disclosure. They describe third-party products and public frameworks as of the publication date, are not claims of the filing, and are not assertions about any competitor's internal architecture, roadmap, or capabilities beyond publicly documented, architecture-level fact. Product and company names are the property of their respective owners and are used for identification and comparison only.
