Platform
Ask the graph, not the dashboard
The exposure modules tell you what is reachable. The threat intelligence layer tells you who would use it, how, and whether they are already active against organisations like yours.
What the layer does
Actor tracking
Ransomware and extortion groups active against your sector, with the victims they have published and the tooling attributed to them.
MITRE ATT&CK mapping
Techniques associated with those actors, so exposure findings can be read as reachable attack paths rather than a list of ports.
CISA KEV and CVE context
Known exploited vulnerabilities matched to the technologies fingerprinted on your estate and on your vendors.
Graph queries in plain language
Ask which of your suppliers run a technology targeted by a given actor, and get the path through the graph that produced the answer.
Sector and stack relevance
Intelligence is filtered by what you actually run and who you actually depend on, not published as a generic feed.
Evidence retained
Every relationship in the graph keeps its source and its date, so an answer can be reproduced later for an auditor or a supplier.
How it connects to the rest of the platform
The threat graph is built on the same estate the twelve modules discover. A technology fingerprint becomes a node, a vendor CVE links it to a technique, and a technique links it to the actors observed using it. That is why the answers are specific to your estate rather than generic threat reporting.
Actor and incident signal feeds the Supply Chain and Threats segment of the Company Risk Score at a weight of 0.2. The methodology explains how it is normalised. In self-hosted deployments the graph runs inside your environment.