One pipeline. Verify everything.
B5 Secure is the Never Trust platform for .NET 10 — a single pipeline that authenticates and authorizes every identity, API call, AI agent, transaction, and dataset before trust is granted. It is the security spine that protected $15B+ in assets protected and secure, with zero losses.
What B5 Secure is
A security framework, not a bolt-on. Every request — browser, mobile, service, job, or agent — runs the full Never Trust pipeline: XSS screening, authentication, IP firewall and MFA, verification and suspension, and activity-data authorization down to the record. No internal-only exemptions, no undocumented switches.
How it runs
B5SecurityKit on .NET 10 (C# 14), hosting ASP.NET Core minimal APIs and GraphQL alongside co-hosted ServiceStack under one security contract. Keys live in a FIPS 140-3 Level 3 Azure Managed HSM; cryptography is agile and post-quantum-ready (ML-KEM / ML-DSA).
Five descending layers — B5 is the deepest
Each request clears every applicable layer, explicitly, before it reaches your business logic.
B1 · XSS screening →
The first gate: nothing scripted gets in.
B2 · Authentication →
Prove the caller, every single request.
B3 · IP firewall & MFA →
Known networks, stepped-up actions.
B4 · Verification & suspension →
Only live, verified identities proceed.
B5 · Activity-data authorization →
This exact action, this exact record.
Co-hosted, one host →
Legacy and new surfaces governed by a single security contract on .NET 10.
The five layers, the fail-closed sequence and the evidence model are set out in full in the Never Trust whitepaper. Read the whitepaper →
Trust, established for every actor and object
Identity verification
Humans and machines are first-class identities authenticated through one model — adaptive MFA, passkeys, and PBKDF2 hashing.
API verification
Every call signed and integrity-checked via RFC 9421 / HMAC, with replay and tamper defense.
AI agent verification
Autonomous agents get scoped, revocable identities and full audit — least privilege, logged, instantly suspendable.
Data & transaction verification
Authorization down to the record and field; suspension on KYC, fraud, or OFAC signals takes effect immediately.
Continuous trust & risk
Continuous Access Evaluation revokes sessions in near-real-time; logging surfaces replay and credential abuse as it happens.
Hardware-rooted cryptography
FIPS 140-3 Level 3 HSM keys, multi-person control, confidential computing, and a post-quantum migration path.
Explore the platform layer by layer.
Dive into the features, the 2026 security extensions, the architecture, and pricing — or talk to us about your stack.
Q4 2026 roadmap extensions → — specified, not yet released. Each capability carries its own status from the Product Truth Registry on its feature page.