What we shipped.

Tenant identity comes from runtime config: organization name, branding, DPO and contact details are no longer baked into the build.

First admin is created with a one-time setup token: 32 random bytes, stored only as a SHA-256 hash, single use, expires in 72 hours. No default password ships.

Session secrets are minted per deployment. In production the app refuses to start without them.

Per-tenant SSO over OIDC, with presets for Microsoft Entra ID, Google and generic OIDC. Signature, issuer, audience and expiry are verified; nonce and state are checked.

Fleet patching: one code fix can be rolled across many single-tenant deployments, optionally scoped to the deployments running a given module.

A named teammate per tenant with memory: facts are extracted from conversations and recalled by embedding similarity. Streaming chat cites the findings it talks about.

Drag a finding onto the teammate to fix it, or onto a control to link evidence. Fix actions follow a per-tenant policy: automatic, confirm first, or never.

Audit-correspondence autopilot: paste an auditor email and it finds the ask, drafts a reply with evidence attached, and waits for a person to approve the send. It does not read a mailbox.

Time-travel replay of compliance state up to 30 days back, and an adversary mode that narrates an attack path over the risk graph.

Board-report generator: a snapshot plus five drafted narrative sections, rendered to an 8-page PDF for a person to approve. Calendar view with .ics export.

Findings backlog query measured at 93 to 94 ms on the demo tenant after moving to a SQL prefix prefilter.

One-click audit pack per framework, rendered to PDF. A SOC 2 pack on the demo tenant is about 72 KB and generates in 10 to 19 seconds. Packs can be signed with AWS KMS or a signing command you supply.

Compliance matrix and Statement of Applicability. The demo tenant renders 41 controls by 11 frameworks.

Every finding carries the controls and frameworks it affects.

14,264 detectors indexed at boot: 12,958 nuclei templates and 1,306 prowler checks. Ask which engines can detect a CVE and how many detectors cover it; Log4Shell has 44.

Plan-driven scans. Pick a policy and the planner resolves exact detectors: KEV-only resolves to 479, critical-only to 1,856.

Cross-engine correlation: the same issue found by two engines on one asset becomes one finding with both sources shown.

Risk-narrative graph: assets, findings, controls and framework requirements are edges in one graph, and a path query answers how a finding reaches a requirement.

Scanner core in Go, embedding the nuclei engine behind a gRPC contract, so nuclei scans stream findings instead of forking a subprocess. The other engines still run as before.

Thirteen scan engines dispatch the same way: one isolated container task per engine per scan, results back over an HMAC-signed ingest, severities normalized to five levels, every finding enriched with EPSS and CISA KEV.

Verification run on a demo tenant: 9 engines pass, 0 fail, 4 skipped because they need a service the customer runs (OpenVAS, Wazuh, BloodHound, Falco). 81 findings persisted end to end.

The verification run surfaced 13 bugs, 10 in the platform and 3 in engine adapters. All fixed before the run was signed off.

Up to 10 scan tasks run at once per tenant. Failed jobs retry, then dead-letter. Feed snapshots are cached so an outage does not change scores mid-run.