DenseSense

1 | The question DenseSense answers

Every CMMC scoping decision starts with a claim about where the controlled work is. That claim is a guess until someone checks the disk. DenseSense checks the disk. Point it at your file roots and it reports where evidence of CUI actually sits -- which shares, which folders, and by what kind of signal -- so the boundary you draw for an assessor comes from findings, not from memory.

It is deliberately narrow about what it claims. DenseSense finds the marking -- the banner, the portion mark, the distribution statement, the export-control language -- because a marking is the one high-confidence signal that exists: the owner already told you the document is controlled. Everything softer than that is graded lower and labeled as such.

2 | Quick start -- your first scan in about ten minutes

DenseSense runs inside ForteFide. In the dashboard it is the Step-2 setup (point it at your shares and the customers who send you government work), a run, and the Step-4 intel modal that shows the result. The same loop is scriptable over the API, which is what the rest of this section shows. Every /api/* call carries the dashboard token as the X-Auth-Token header, so grab it once:

TOKEN=$(sudo cat /var/lib/fortefide/dashboard.token)

1. Confirm it is enabled. A build with DenseSense enabled reports densesense on; a build without it reports it off, and both the dashboard tile and the scan route report it as unavailable rather than a half-run.

curl -s http://127.0.0.1:5000/api/capabilities \
  -H "X-Auth-Token: $TOKEN" | grep densesense

2. Start a scan over the roots that actually hold your work:

curl -s -X POST http://127.0.0.1:5000/api/densesense/scan \
  -H "X-Auth-Token: $TOKEN" -H "Content-Type: application/json" \
  -d '{"roots": ["/srv/engineering", "/home/shared"]}'
# -> 202 {"job_id": 1}

It returns 202 and a job_id. An empty roots is refused with 400 roots_required -- it never scans a scope you did not state.

3. Read the result -- poll the job until it completes:

curl -s http://127.0.0.1:5000/api/densesense/scan/1 \
  -H "X-Auth-Token: $TOKEN"

The result carries each tier's count separately (Section 4), the per-file findings -- path, marking type, tier, and count, never content -- and the heatmap and concentration that show where the controlled work piles up (Section 7).

3 | Early Adopter scope -- what it is and is not

DenseSense is an Early-Adopter capability, in active development. The engine, the V2 operator screens, and the API are real and tested; the honest limits are about what it detects, not whether it exists. Read this table as the boundary of the claim.

In the dashboard, DenseSense is a Step-2 setup: point it at the shares that hold your work and name the customers who send you government work. It is an overlay on the six-step flow, gated on the license -- not a seventh step.

4 | The four tiers -- graded, never pooled

A discovery report that collapses everything into one number is a report the customer mutes. DenseSense grades every finding and reports the tiers separately -- there is deliberately no grand total. Strongest first:

In the operator dashboard these same grades appear as plain-language urgency bands -- deal with first, review soon, note for later -- so a shop owner reads a priority, not a taxonomy; the underlying tier is preserved for the report and the evidence.

5 | What it reads -- and the one gap it names

Markings live in predictable places, and DenseSense reads exactly those places with the Python standard library -- no new dependency ships to find them. Office documents (.docx, .xlsx, .pptx) are ZIP archives of XML, and the banner and portion markings sit in the header and footer parts (word/header1.xml and friends), which a body-text reader misses entirely. DenseSense reads the parts that matter.

6 | Teach it your controlled forms (the DECLARED tier)

Marking-detection is reliable and blind exactly where the exposure lives: a prime sends a purchase order, the contract says it is controlled, and the document carries no banner -- because primes mark inconsistently and the customer is not about to add one. Nothing in the text betrays it. The only source of truth for that document is you: you know because the government told you.

DenseSense lets you teach it -- a document, pasted text, or a pattern -- and grades every resulting match as DECLARED so the provenance stays visible all the way to the report:

7 | What the report says -- container, not content

DenseSense reports at the level you can act on: the container. A finding names the file, the marking type, the tier, and a count -- and rolls up to where the controlled work concentrates, because "this share holds 14 CUI-marked files, here are the paths" is a decision and "3,182 matches" is noise. In the dashboard, that roll-up is the Step-4 intel modal:

8 | The API surface

Everything the dashboard does, the API does too -- gated in one place (_densesense_enabled()); on a build where the capability is not enabled the modules are not even present, and the routes report it as unavailable rather than a half-working feature.

9 | Where it fits in compliance

NIST SP 800-171 is about protecting CUI, and you cannot scope, protect, or attest to what you have not located. DenseSense sits in front of the assessment: it turns "we think the CUI is on the engineering share" into a finding with paths behind it. It is also a direct implementation of the data-inventory idea in CIS Controls v8.1 -- Safeguard 3.2 (data inventory) and 3.7 (data-classification scheme).

A clean scan is itself evidence: "we walked 412 GB across six hosts and found CUI markings in one share, here are the paths" is a stronger position in an assessor interview than a confident claim with nothing behind it.

10 | Early Adopter limitations & what is not built

Stated plainly, so nothing here is a surprise later:

• Markings-focused only. No PII, PHI, or cardholder-data detection. Those regimes need their own validated detectors (pattern + corroboration + checksum), which DenseSense does not ship.
• No OCR. A marking that exists only inside a scanned image is not read. The file is recorded as image-only rather than silently passed as clean.
• Content-CUI is a lead, not a finding. Unmarked CUI is found only when you teach it (the DECLARED tier). DenseSense will not guess a document into CUI on content alone and call it confirmed.
• Early Adopter. The capability is available to early adopters and usable, but it is early: expect the tier taxonomy and the operator surface to keep tightening.