Everything your network’s documentation needs.

And a scanner to keep it true. This is the whole product as it ships today — and, at the end, what it does not do yet.

The agent finds what is there.

A small daemon on any Linux, macOS or Windows machine in the segment. It sweeps the ranges you give it and tells the board what answered, as it answers.

ICMP and ARP sweep: Ping finds what answers; the ARP sweep finds what ignores ping and gives every host on the segment a hardware address and its vendor.
Who each host is: mDNS, NetBIOS, LLMNR, SNMP, SSDP, reverse DNS, TLS certificates and HTTP titles name the host and say what it runs, its model and its open ports — and which protocol said so.
Certificates on the way past: The agent already completes a TLS handshake to read a name; it keeps the certificate’s expiry too, so a NAS two weeks from expiry is on the review before anyone asked.
The router, always: The gateway is filed from the routing table even when it answers nothing, so every board has the node the others hang off — and says when it had to assume it.
Live, host by host: Hosts arrive on the board as they are classified, with progress, time left and what was lost if a connection dropped. A sweep that ran out of time says so.
Driven from the dashboard: Start or stop a sweep, change the range, the schedule and the workers, pause the agent or remove it — without a shell on the machine.
Placed once: New hosts land on a spiral around the router in arrival order. A re-scan moves an address, never a node someone placed; a host matched by its MAC keeps its place when its address changes.
Absence, not deletion: Only hosts inside the range actually swept can be missed, and a stopped sweep marks nothing. A missing host is drawn dashed with its count; nothing is ever deleted.

A diagram that is also a document.

Draw by hand, from a template, from a file or from a sweep — it is the same board, and every view of it is the same record.

Diagram: 182 component types in 16 kits, drawn as icons or cards; zones for sites, networks, VLANs, DMZs and hosts; notes; straight, right-angle or curved links.
Three layers: Physical, logical and security on one board, each its own ink, shown together or alone. Relations say what runs on what, what depends on what, what protects what and what fails over to what.
Lenses: Physical folds what runs on a machine into it; Stack lists each machine layer by layer; Service follows the applications; Security marks what the internet reaches with no control in the way.
Inventory: Every element as a row with its type, address, owner and criticality — filtered, grouped and downloaded as CSV.
Registers: The IP plan with free space and duplicates, the flow matrix, the service catalog and the lifecycle report — read from the board every time, never stored apart from it.
Document: The board written out as a numbered document with its figure, findings and records, ready to export as Markdown.
Templates: Three-tier application, office network, Kubernetes, delivery pipeline, observability, site-to-site VPN, segmented network, server room, migration plan — whole, or as blocks.
Keyboard first: A command palette, search across names, addresses, owners and tags, and shortcuts for every tool. A thousand nodes stay usable.

Infrality's own platform architecture as a board, with zones, applications running on machines and labelled flows. — Figure 1 — Infrality's own architecture, three layers on one board

It tells you what needs a person.

The board reads itself for problems and answers the question every incident starts with.

Blast radius: Pick an element: what runs on it is down, what no cable reaches any more is cut off, what needs either is impacted, what fails over is degraded, what it protected is exposed — listed by owner.
Trace: Follow dependencies upstream and downstream, hop by hop, drawn as a course over the map without recolouring it.
Review: Duplicate addresses, expiring certificates, hosts that stopped answering, critical elements with no owner or no runbook, single points of failure, unguarded crossings between trust zones, unplaced workloads, ranges with no CIDR, records nobody reviewed in 90 days, kit past end of support.
Secrets caught: Text shaped like a private key, a cloud token, a JWT or a password in a URL is flagged wherever it was typed — named by its kind, never repeated.
Fixes, one step each: A finding can carry its fix — move it into the right zone, place it on its machine, clear it — applied as one undoable step. Nothing is reconciled silently.

If it fails:

Figure 2 — Lyon clinic — Services, a second board across three layers Physical Logical Security

What the person on call and the auditor need.

Every element can carry what no scan can find out. All optional, none defaulted; an empty field says it is empty.

Ownership: An owner that names a member or a team of the organization, not a string that goes stale when someone leaves.
Runbook: What to check, what to restart, who to call — in Markdown, up to 20,000 characters, encrypted at rest like the description.
Operations: Criticality, environment, status, classification, compliance, RPO and RTO, backup, maintenance window, supplier, support contact, contract and licence.
Lifecycle: Warranty, end of support and end of life, with the soonest first in the lifecycle register and anything past due on the review.
Your own fields: An organization defines its own — text, a choice, several choices, a date, a number, a link — for some layers or all, and its own compliance list.
Sensitive: Mark a description or runbook sensitive: concealed on screen until revealed, and left out of every export.

Several people, one board.

Teams document estates together. Infrality shows who is there, who changed what, and what is still unanswered.

Presence: Who has the board open, their pointer and what they have selected, live.
Merged saves: An edit reaches the others under a second after it is saved, merged element by element. Two people typing in the same field keep the last value saved.
Comments: Threads on the board or on one element, resolved and reopened, with mentions that notify only people who can open the board.
Versions: One per editing session, kept 90 days. Compare any two, restore one as a new version, or name one to keep it for good.
Change log: Which elements each write changed and how — worked out by the server, attributed to a person, a sweep, an import or a restore.

From the files you have, to the tools you use.

Thirty-six formats are read in your browser. Nothing is uploaded, and Infrality never connects to your systems.

Infrastructure as code: Terraform files and state, CloudFormation, Azure ARM, Pulumi, Kubernetes manifests, Docker Compose, Ansible inventories.
Virtualisation and cloud: Proxmox VE, VMware vSphere (govc, RVTools), Hyper-V, libvirt/KVM, and AWS, Azure and Google Cloud inventories.
Network devices: FortiGate, pfSense and OPNsense, MikroTik RouterOS, Cisco IOS and IOS XE, LLDP and CDP neighbours, Linux addresses and routes, nginx, Traefik and HAProxy.
Tools and CMDBs: nmap, NetBox, GLPI, Zabbix, SSH config, CSV.
Diagrams: draw.io, Mermaid, PlantUML and C4, Graphviz DOT.
A plan before a change: The import shows what it will add, update and match — by name, address or MAC — and an import refreshed later only removes what you tick.
Export: PNG and SVG drawn from the scene itself, the Markdown document, CSV inventory and registers, draw.io and Mermaid diagrams that import back, and the board as JSON.

Built for the way companies run IT.

Owners, admins, members and viewers; teams; scanners and their keys; and the controls a security review asks for.

Roles and teams: Owners and admins see everything; members edit; viewers read and add nothing. Teams of the organization receive grants like a person.
Every client apart: One organization per client, switched in one click; one view across all of them with every scanner and the ones that need attention.
Scanners and keys: Keys bound to one agent by default, expiring, revocable; every command to a scanner and every change to what it sweeps in the trail.
Single sign-on: Prove a domain by DNS, connect your identity provider over OIDC or SAML, and require it for your people — with a break-glass path for owners.
Provisioning: SCIM 2.0: people and groups created, updated and removed from your directory; deprovisioning someone on your domain ends their sessions.
Session policy: Require an authenticator app or a security key, cap session length and idle time, allow only your address ranges — for people and for agents.
Audit: Every change of access and every scanner command, exported as CSV or JSON or streamed to a webhook or syslog, kept as long as you choose.
Your data, yours: Export the whole organization as one file. Deleting it is an owner’s decision, with 30 days to change their mind.

What it does not do, said plainly.

The order follows what people ask for. If one of these decides whether Infrality fits your team, tell us — requests that come up again and again ship first.

Agent packages Next apt, yum and brew, with updates delivered the same way.
Alerting Planned Tell someone when a scanner goes quiet or a host disappears.
Several networks per agent Planned One agent sweeping several ranges onto several boards.
Maintenance windows and targeted sweeps Planned Sweep only when allowed, or only what changed.
Live sources Planned Agent-side collectors for hypervisors, clouds and CMDBs, so imports refresh themselves. Today imports are files.
Keystroke-level co-editing Planned Today edits merge when saved; two people typing in one field keep the last value saved.
The dashboard on a phone Planned The editor is built for desktop widths; below about 1100 px its panels close.
Vulnerability enrichment Planned Known CVEs and a risk score per discovered device.
On-premises Planned A self-hosted Infrality for air-gapped and regulated networks.

Start with one network.

Create an account, draw or import a board, and put the agent on one machine when you want the map to keep itself current. Every feature is free during the beta.

Start free Install the agent