Hello, world. This is the first post on the Caladrim blog, so we wanted to use it to explain what we're building and why.
Every device on your network makes a DNS query before it does almost anything else — before it loads a website, before it phones home to a command-and-control server, before it exfiltrates a byte of your data. DNS is the first thing that happens, and on most networks it's still sent in the clear, unauthenticated, and unfiltered. Attackers know this. They use DNS to eavesdrop on which sites your users visit, to spoof responses and redirect people to malicious sites, to run malware command-and-control channels, and to tunnel stolen data out past firewalls that are watching every other port except this one.
Caladrim exists to close that gap. Rather than betting everything on one control, we built defense in depth: DNS filtering against a constantly updated threat database, DNS over HTTPS so query traffic is encrypted end to end, DNSSEC validation to catch forged responses, and an AI-powered detection layer that catches the things static blocklists miss — DGA-generated malware domains, DNS tunneling, and typosquatting attempts aimed at your own brand. We also built Shadow IT detection, because you can't secure what you can't see, and most security teams have no idea which SaaS apps are actually running on their network until something goes wrong.
None of these layers is sufficient on its own. That's the point. A single filtering list will always be a step behind; a single AI model will always have blind spots. Together, they cover for each other's weaknesses in a way that's hard for an attacker to route around.
This blog is where we'll write about the problems we're solving, the threats we're seeing, and what we're building next. If you want to talk to us directly, we're at support@caladrim.com.