Capability truth
Marketing describes our direction. This registry distinguishes sandbox evaluation, capabilities in development and planned work. Source-code presence does not establish production availability.
Available
No capability currently has a fresh runtime-verification record in this public category. Contact us to review the evidence and agreed customer scope.
Sandbox demo
No capability currently has a fresh runtime-verification record in this public category. Contact us to review the evidence and agreed customer scope.
In development
Historical source description; current runtime behavior has not been verified: Real encrypted TOTP MFA with backup codes, enforced at login. Currently per-user opt-in (org-wide enforcement policy is on the roadmap).
Runtime verification: not recorded · Launch gate: closed
Historical source description; current runtime behavior has not been verified: Server-side RBAC with wildcard permissions, enforced on protected routes.
Runtime verification: not recorded · Launch gate: closed
Historical source description; current runtime behavior has not been verified: Server-enforced read-only mode for early-access roles, with hash-chained audit logging of blocked mutations.
Runtime verification: not recorded · Launch gate: closed
Historical source description; current runtime behavior has not been verified: Generates board-ready reports from real tenant data and persists each run. Empty tenants fall back to clearly-labelled sandbox data.
Runtime verification: not recorded · Launch gate: closed
Sandbox runtime verification is missing or stale. Historical source description (not current runtime evidence): Implemented with a real LLM agent, but running in a service that is not yet in the production deployment. In-product views show clearly-labelled sandbox activity.
Runtime verification: not recorded · Launch gate: closed
Sandbox runtime verification is missing or stale. Historical source description (not current runtime evidence): Detection rules (impossible travel, privilege escalation, and more) run in the pipeline service that is not yet deployed. Figures shown in-product are synthetic.
Runtime verification: not recorded · Launch gate: closed
Sandbox runtime verification is missing or stale. Historical source description (not current runtime evidence): Threat-intel feeds (OTX, Abuse.ch) are real but run in a service not yet deployed; matching is IP-only today.
Runtime verification: not recorded · Launch gate: closed
Sandbox runtime verification is missing or stale. Historical source description (not current runtime evidence): Compliance scoring is a posture-derived model and ISO/SOC 2 mapping is heuristic — it is not a certified audit . Some report attestations are not yet live-verified.
Runtime verification: not recorded · Launch gate: closed
Historical source description; current runtime behavior has not been verified: Uses a real model with read-only tools; not yet wired into the customer production path, and it cannot take actions.
Runtime verification: not recorded · Launch gate: closed
Historical source description; current runtime behavior has not been verified: Triage currently uses deterministic risk scoring (asset criticality, IOC, behavior), not model-based classification.
Runtime verification: not recorded · Launch gate: closed
Historical source description; current runtime behavior has not been verified: Collectors perform real OAuth/SDK authentication and data pulls, but are not yet enabled in the production ingestion pipeline.
Runtime verification: not recorded · Launch gate: closed
Historical source description; current runtime behavior has not been verified: The OCSF pipeline is built end-to-end in services not yet in the production deployment.
Runtime verification: not recorded · Launch gate: closed
Historical source description; current runtime behavior has not been verified: Actions are built against real provider APIs, but are not enabled for autonomous execution in production, and rollback does not yet exist.
Runtime verification: not recorded · Launch gate: closed
Historical source description; current runtime behavior has not been verified: SAML is implemented but not production-verified end-to-end. Use email sign-in with MFA until SSO is enabled. OIDC is not yet available.
Runtime verification: not recorded · Launch gate: closed
Historical source description; current runtime behavior has not been verified: A hash-chained audit log exists for auth, billing, and early-access events; a parallel path and response-action auditing are being consolidated onto the chain.
Runtime verification: not recorded · Launch gate: closed
Historical source description; current runtime behavior has not been verified: Report export currently uses the browser print dialog. Server-side PDF generation is not yet implemented.
Runtime verification: not recorded · Launch gate: closed
Historical source description; current runtime behavior has not been verified: Shared security workflow foundation. Scope: Protected identity scope and common access controls. Requires: Foundation subscription.
Runtime verification: not recorded · Launch gate: closed
Historical source description; current runtime behavior has not been verified: Investigate identity-related risk. Scope: Identity events, context and customer-defined protected scope. Requires: Core platform and approved identity source.
Runtime verification: not recorded · Launch gate: closed
Historical source description; current runtime behavior has not been verified: Connect SaaS security context. Scope: Approved SaaS integrations and investigation inputs. Requires: Core platform and provider authorization.
Runtime verification: not recorded · Launch gate: closed
Historical source description; current runtime behavior has not been verified: Investigate cloud exposure and activity. Scope: Approved cloud integrations and scoped assets. Requires: Core platform and cloud authorization.
Runtime verification: not recorded · Launch gate: closed
Historical source description; current runtime behavior has not been verified: Organize investigation evidence. Scope: AI-assisted findings, context and proposed next steps. Requires: Verified inputs and customer-owned review.
Runtime verification: not recorded · Launch gate: closed
Historical source description; current runtime behavior has not been verified: Plan sensitive security responses. Scope: Authorization and approval-led response scope. Requires: Customer policy and production-readiness gate.
Runtime verification: not recorded · Launch gate: closed
Historical source description; current runtime behavior has not been verified: Organize readiness and evidence. Scope: Control scope and customer-provided evidence. Requires: Approved framework and evidence sources.
Runtime verification: not recorded · Launch gate: closed
Historical source description; current runtime behavior has not been verified: Plan future AI security coverage. Scope: Assessment of AI-specific scope and safety needs. Requires: Launch-gated module; no instant purchase.
Runtime verification: not recorded · Launch gate: closed
Historical source description; current runtime behavior has not been verified: Explore connected security context. Scope: Relationship and blast-radius evaluation. Requires: Verified graph source, entitlement and tenant readiness.
Runtime verification: not recorded · Launch gate: closed
Historical source description; current runtime behavior has not been verified: No staffed human SOC, independent audit, legal advice or destructive exploitation. Reference workload: 10 active authorization workflows; 20 approved assets per workflow; 5 approvers. Final allowance and production behavior require verification and signed scope.
Runtime verification: not recorded · Launch gate: closed
Historical source description; current runtime behavior has not been verified: No staffed human SOC, independent audit, legal advice or destructive exploitation. Reference workload: 100 identities; 5 integrations; 2M events/month; 300 investigations; 100 hunts; 90-day history. Final allowance and production behavior require verification and signed scope.
Runtime verification: not recorded · Launch gate: closed
Historical source description; current runtime behavior has not been verified: No staffed human SOC, independent audit, legal advice or destructive exploitation. Reference workload: 1 framework; 200 controls; 10 evidence sources; 5,000 checks/month. Final allowance and production behavior require verification and signed scope.
Runtime verification: not recorded · Launch gate: closed
Historical source description; current runtime behavior has not been verified: No staffed human SOC, independent audit, legal advice or destructive exploitation. Reference workload: 30 validation scenarios; 20 gap analyses; 20 rule recommendations; 15 retests. Final allowance and production behavior require verification and signed scope.
Runtime verification: not recorded · Launch gate: closed
Historical source description; current runtime behavior has not been verified: No staffed human SOC, independent audit, legal advice or destructive exploitation. Reference workload: 100 incident analyses/month; 10 customer responders. Final allowance and production behavior require verification and signed scope.
Runtime verification: not recorded · Launch gate: closed
Historical source description; current runtime behavior has not been verified: No staffed human SOC, independent audit, legal advice or destructive exploitation. Reference workload: 40 safe scenarios/month; 50 approved assets; no destructive exploitation. Final allowance and production behavior require verification and signed scope.
Runtime verification: not recorded · Launch gate: closed
Historical source description; current runtime behavior has not been verified: No staffed human SOC, independent audit, legal advice or destructive exploitation. Reference workload: 500 identities; 15 integrations; 10M events/month; 1,500 investigations; 50 validation scenarios; 25 operators; 365-day retention. Final allowance and production behavior require verification and signed scope.
Runtime verification: not recorded · Launch gate: closed
Historical source description; current runtime behavior has not been verified: No staffed human SOC, independent audit, legal advice or destructive exploitation. Reference workload: Custom capacity, concurrency, regional controls, deployment and support. Final allowance and production behavior require verification and signed scope.
Runtime verification: not recorded · Launch gate: closed
Planned
No GitHub audit-log integration exists yet.
Runtime verification: not recorded · Launch gate: closed
Cloudflare is webhook-push-only and Slack is outbound alerting only today; audit-log ingestion for both is planned.
Runtime verification: not recorded · Launch gate: closed
Approval-gated autonomous response with reversible rollback and org-wide MFA enforcement are planned hardening milestones.
Runtime verification: not recorded · Launch gate: closed
Availability is scoped by capability, integration, customer environment and verification evidence. A demonstration does not authorize production execution.