What flow records cannot tell you
A previous description overstated what a metadata-only assessment could establish. Message types, sending facilities and application headers require evidence beyond flow records. The distinction matters when defining an assessment scope.
The argument underneath it is sound. HL7 v2 is carried over MLLP, a framing protocol with no native encryption — it was specified when the network was assumed trusted, which is why organisations wrap it in stunnel or mutual TLS when they want transport security. DICOM's classic DIMSE services carry the same assumptions, and DICOM over TLS is defined but unevenly deployed. Where those protocols are in the clear, a packet capture tells you what a flow actually is rather than merely that it exists.
The problem is that none of that applies to an assessment built on firewall logs and NetFlow.
Flow records contain addresses, ports, direction, byte and packet counts, and timestamps. They do not contain HL7 message headers. They do not contain a sending facility. They do not tell you that host 10.20.4.17 is an infusion pump rather than a badge reader — you can observe that something at that address talks to something else on port 2575, and port 2575 is a convention, not a proof.
For a metadata-based assessment, the customer identifies the address ranges and asset context. The analysis reports recorded communication across those boundaries; it does not independently identify devices.
This matters beyond honesty in marketing copy. If you buy an assessment expecting protocol-level findings and receive address-level findings, the report is a disappointment regardless of how good the analysis was — and you will reasonably conclude the whole category is overstated.
There is a second limit worth stating just as plainly. Observing traffic between two segments proves a path is open. Observing none proves nothing at all. The path may exist and be unused this week. Your collection point may sit on one leg of an asymmetric route. A trunk may be missing from the mirror. A rule that matched nothing in seven days may fire at quarter-end or during a failover you have not had this month.
That asymmetry means the only findings worth writing are the positive ones. 'Your matrix says these zones do not communicate, and here are 4,812 flows between them' is hard to argue with. 'We saw nothing, so you are fine' is not a finding, and any report that presents it as one is selling reassurance rather than evidence.
Payload inspection is outside the scope of this assessment and is not a promised Guardra capability. Any future consideration would require a defined use case, appropriate authorization and reviewed data-handling terms.