Assets without context
The host name in an alert means little until someone finds out what runs there, who owns it and whether it faces the internet.
For SOC and incident responseBring application context
Bring application context
into the investigation.
Follow the relationships between findings, artifacts and workloads. Give security operations and response teams a shared foundation for investigation.
From signal to affected application
Security signal
Entity context
Investigation record
Investigation context
01 / Review signal
Understand what initiated the review.
- Signal evidence
- Entity reference
Inspect the available signal evidence and its affected entities.
02 / Follow context
Connect the entity to the application.
- Application relationship
- Responsible team
Use available relationships to scope the investigation with other teams.
03 / Record action
Preserve the investigation's reasoning.
- Investigation record
- Decision context
Retain findings and decision context for the teams coordinating the next action.
Where the minutes go
Why is scoping an incident so slow?
01
02
Blast radius by guesswork
Which identities can reach this workload, and which data stores can it reach? The answer lives in three consoles and a wiki page.
03
No line back to code
When a vulnerable package is the way in, nobody can quickly say which image carries it, where else it runs or which team must fix it.
During a shift and an investigation
How do SOC and IR teams use SecurityVault?
Exposure watch
Start the shift from confirmed exposure paths and active attack paths, which run from exposure edges through identities and roles to data stores. See cloud posture.
Exploited CVEs
See which known-exploited vulnerabilities are present, enriched with EPSS, and which workloads run the images that carry them. See vulnerability management.
Scoping
For an asset under investigation, see identity risk and blast radius: who can assume which roles and what data stores are reachable. See identities and entitlements.
Outside in
New hosts, changed certificates and other changes on your internet-facing surface raise alerts by email, Slack or webhook. See attack surface management.
Hand-off
Turn the affected findings into a remediation campaign with an owner and deadline, and send context to the SIEM, chat and on-call tools you already run.
Your view in SecurityVault
What do the SOC and Incident Response homes show?
Two lenses on the same graph. The SOC Analyst Home asks what is exposed right now; the Incident Response Home asks: what is the scope of this incident across asset, identity and code? Both open with posture for cloud, identity and the external surface.
SOC Analyst Home
Confirmed exposure paths to watch, active attack paths, open critical findings and KEV exposure, each linked through to the evidence.
Incident Response Home
Incident scope requiring action, active remediation campaigns, confirmed attack paths, and the top identity risks and blast radius.
Reachability as a query
Why does a single graph speed up incident scoping?
Workload to commit
A workload runs a digest, the digest came from a build, the build from a commit with an owner. The way in and the fix sit on the same chain.
Identity on the same graph
Cloud identities and entitlements are entities with edges, so reachability is a query, not an interview.
An audit trail you can rely on
Decisions and overrides are written to a hash-chained audit log, so the timeline of who decided what holds up in the post-incident review.
Humans own the verdict
AI never writes a finding's status or disposition. Responders decide, with a reason code.
Platform offerings
What is coming next for SOC and IR teams?
- Detection and response: tested detection rules, ranked alerts, threat hunting and audited playbooks, investigated against the same graph.
- Threat intelligence: IOC feeds matched against your findings and assets.
- Breach and attack simulation: ATT&CK-mapped campaigns that measure whether controls block or detect.
One exposed workload first
How do SOC and IR teams get started?
01
Replay a recent incident
Request a demo with a recent investigation and the questions that took longest to answer.
02
Connect cloud and code
Connect a cloud account, a cluster and the repositories that deploy to them.
03
First scoping report
Pick one internet-facing workload and trace its exposure, identities and code.
FAQ
Investigation and response questions
- Is SecurityVault a SIEM or an EDR?
- No. SecurityVault is the exposure and context layer: what an asset runs, how it is exposed, who can reach it and which code shipped it. It exports to the SIEM you already run. Detection and response is in development. Discuss rollout with our team.
- Which exploit signals does SecurityVault use?
- Dependency and image vulnerabilities are enriched with EPSS exploit probability and CISA's Known Exploited Vulnerabilities list, and the SOC home shows KEV exposure directly. Broader threat intelligence with IOC matching is in development. Discuss rollout with our team.
- Can an analyst triage a finding?
- Yes, when assigned the required triage permission. Choosing the SOC or incident-response home view does not grant access. A disposition requires a reason code and is attributed to the person who made it.
- How do I find which code is behind a compromised workload?
- Follow the graph: the workload runs an image digest, the digest was produced by a build, and the build came from a commit in a repository with a named owner. See container security.
- Will SecurityVault test whether our controls detect attacks?
- That is breach and attack simulation, which is in development. Discuss rollout with our team.
SecurityVault for other roles: CISOs · Security engineers · AppSec · Platform engineers · Developers · GRC and audit. See every role.
Further reading: identity attack paths from assumable roles to data, which images shipped a new CVE and cloud attack paths.
See it on your estate
Trace one exposed workload.
From the ingress to the identities that reach it, the image it runs and the commit behind that image.