There is no inside to be inside of.

Ransomware does not succeed at the moment of intrusion. It succeeds in the hours afterwards, moving sideways from the first machine to the ones that matter. Lantern DSSE makes that movement hard.

Every flow from a managed endpoint — including to the machine sitting next to it on the same local network — is decided against policy, audited, and re-authenticated where the policy says it must be. A compromised laptop does not come with a flat network behind it. The attacker's next move is a request that gets denied and logged, rather than a connection that just works.

It is not a claim that breaches stop. It is a claim about one stage of them: lateral movement, which is the stage where an incident becomes a company-wide event.

The code that decrypts your traffic is open source

A Secure Service Edge is the one place where an organisation's encryption is, by design, undone. Today that point is mostly operated as foreign software-as-a-service: your decryption point lives in someone else's cloud, under someone else's jurisdiction.

The enforcement path here is published under Apache-2.0 — TLS interception, policy evaluation, default-deny, DNS control, mTLS device identity, east-west authorisation. Not a client library, not an integration: the part you would otherwise have to take on trust.

Don't trust us; read the code that touches your bytes. The Experimental release opens on 2026-09-01 at github.com/lantern-networks/dsse-core. How to check the claims on this site.

Yours to operate

Your edge, your keys, your control plane. The endpoints steer to edges you run, in the jurisdiction you chose, and the certificate authorities are generated on your own hardware at install time — not handed to you by a vendor. There is no licence server: a deployment that cannot reach us keeps working, because anything else would make "sovereignty" a word rather than a property.

Where this actually is

This is an experimental release, and it is not production-ready. Interfaces and defaults may still change, and nothing here has been run at length by anyone who did not write it. Run it in a lab, not in front of a fleet you would mind losing. We would rather say that now than have you discover it during an evaluation. What is verified, and what is not.