SEE IT WORK

Watch PathWise walk the path.

Four real-shaped investigations, simple to hard. Same engine every time: it reads each layer with live checks, then hands back an answer with cited evidence and a confidence level. It has no path to make a change, so it reports the problem but never fixes it.

Example company is Acme Anvil Co. Hosts are illustrative.

SHOWCASE 01single layer · external cause

The SaaS app that was never your fault

One vendor app stops loading for the whole team. PathWise proves the break is in the vendor's DNS, not your network, before the helpdesk touches a single laptop.

Ticket

"Our whole team lost the expense tool this morning. expenses.acmevendor.example just won't load. We didn't change anything. Is it our network?"

Investigation: expenses.acmevendor.example will not load for the whole team. PathWise entered at the resolution layer, because one host fails and the rest of the internet works. The local resolver and the public resolvers 1.1.1.1 and 8.8.8.8 all return a CNAME to edge-19.acmevendor-cdn.example with no address record. A control domain resolves normally, so the user's resolver is healthy. The vendor's authoritative nameservers return the same dangling CNAME, which rules out caching. Failing layer: resolution, at the provider. Finding: the vendor's authoritative DNS points the name at a host with no address, so the break is in their zone, not yours. Proposed solution for a person to perform: open a ticket with the vendor and cite the broken CNAME target. No local fix applies. Confidence: high.

Failing layer: Resolution (at the provider)Confidence: High
SHOWCASE 02multiple layers · one shared cause

Three red lights, one switch

DNS, ping, and the firewall all look broken at once. PathWise checks the layer they depend on first and shows all three reds trace back to a dropped VPN tunnel.

Ticket

"I can't reach the internal time-tracking app. timesheet.corp.acmeanvil.example times out. It worked fine yesterday from this same laptop."

Investigation: timesheet.corp.acmeanvil.example times out, and it worked yesterday from the same laptop. PathWise checked the session and trust layer first, because an internal host that worked yesterday points at the tunnel. The VPN adapter is up but has no address and no route to the corporate subnets. The internal split-horizon zone corp.acmeanvil.example answers only over the tunnel, so the name does not resolve. The firewall permits tunnel-pool sources only, so it denies the laptop's public-sourced connection. Failing layer: session and trust. Finding: the VPN tunnel is down, and that single break causes both the DNS timeout and the firewall denial. They are effects, not separate problems. Proposed solution for a person to perform: reconnect the corporate VPN, then re-test. Confidence: high.

Failing layer: Session and trustConfidence: High
SHOWCASE 03network is perfect · block is higher up

Blocked for one person, on one app

Every network check passes, so other tools call it clean. PathWise keeps climbing into the firewall's own policy decision, and finds a permit rule that never matched because the user was never identified.

Ticket

"I can open email and the wiki fine. But payroll says access denied every time. Everyone else on my team can get in. Why just me, and just this app?"

Investigation: the payroll app denies one user, and email and the wiki work, and teammates get in. PathWise reasoned that one user plus one app points to a per-identity policy, not the network. Name resolution, TCP on port 443, and routing to the payroll server all pass. The Check Point module read the gateway's own decision: the connection was dropped on rule 99, the cleanup rule, which means it matched no explicit permit. The intended permit, rule 23, Finance to Payroll, does exist and does allow tcp/443, but it requires the Finance-Group access role. Identity Awareness reports no identity mapped to the source address, so the identity-based permit could never match and the traffic fell through to the cleanup rule. Teammates are identified, so the same rule matches for them. Failing layer: rights. Finding: the rule is correct and the user is not identified, so this is an Identity Awareness gap, not a missing rule. Proposed solution for a person to perform: get the user identified to the gateway, then the existing permit rule matches. Confidence: high.

Failing layer: Rights (identity)Confidence: High
SHOWCASE 04intermittent · size-dependent · every quick check lies

Everything is green and the app still breaks

Small traffic works, large transfers die. PathWise reads green as a clue, not a verdict, runs sized probes, and lands on an MTU black hole on the new tunnel.

Ticket

"The new branch office can browse fine and small things work. But the document system hangs and any large upload dies halfway. It started right after the SD-WAN cutover last weekend."

Investigation: a new branch office can browse and do small transfers, but large uploads hang, and it started after the SD-WAN cutover. PathWise read the size-dependent failure plus the recent change as a routing and path-MTU question. DNS, the firewall, a 56-byte ping, the TLS handshake, and a small HTTP GET all pass. A do-not-fragment ping sweep shows frames up to about 1400 bytes return and larger frames get no reply, with no ICMP fragmentation-needed message. Traceroute shows a new hop, the SD-WAN concentrator from the cutover. TCP negotiates an MSS of 1460, and full-size segments retransmit and stall. Failing layer: routing, at the new tunnel's MTU. Finding: the tunnel's path MTU is near 1400 bytes after encapsulation, but the endpoints still use MSS 1460. Path-MTU discovery is broken: the ICMP fragmentation-needed message is filtered, so large segments drop silently. Small packets fit, so every quick check reads green. Proposed solution for a person to perform: clamp the TCP MSS or lower the tunnel MTU, or permit ICMP type 3 code 4 so path-MTU discovery works, then re-test a large upload. Confidence: high on the diagnosis.

Failing layer: Routing (tunnel MTU)Confidence: High on diagnosis

Find the broken layer, with the proof.

Get PathWiseFrom $399 a year.Read the docs ›
Who is it for?

Anyone with the right permissions stands it up. After that, anyone working an access ticket, help desk, IT ops, or developers, gets the same evidence-backed answer.

What exactly do I get?

The engine skeleton as a Docker image, all nine modules, the command-line tool, and the browser interface. You supply your own model backend.

Does it change anything in my network?

No. It diagnoses and advises. It runs checks, including its own live network probes, and proposes a fix you perform. It makes no changes.

It is built with AI. Why should I trust it?

PathWise is built by an engineer with more than 30 years in systems infrastructure, 18 of them securing networks in regulated banking, holding the CISSP and CCSP. It solves a problem its builder has lived for two decades. You still do not have to take it on faith. PathWise cannot change your systems. The read-only boundary lives in the code, not in a request to the model, so the worst case is a wrong answer you catch, never a wrong action. Every answer shows the probes it ran and the evidence behind each claim, so you check the conclusion instead of trusting it. It ships with more than 1,600 automated tests, and an outside security review of the live app in July 2026 found no critical or high issues. And it is free to trial on your own box until the beta license expires in one year. Point it at a problem you already understand and watch what it does before you pay.

What model does it run on?

You bring your own. It runs against the Anthropic API by default, or any OpenAI-compatible backend, including a local model through Ollama or vLLM. A managed in-tenant placement is planned. The model is a quality dial you set.

Is my data sent anywhere?

Your model does the reasoning, so in the Anthropic mode your investigation data goes to your AI provider over your own key. Run a local model to keep the reasoning inside your boundary. A managed in-tenant cloud placement is planned. Probes send only the host or IP being checked.

What is a module?

A small folder of plain files describing one vendor or one layer. The standard is free and open, and you can write your own.

How is it licensed?

An annual subscription license. Solo covers one engineer. Team is licensed to one organization and covers four user accounts, with more sold in 3-packs. Modify it for internal use, no resale, as-is, copyright retained.