Threat & Exposure

Exposure & Vulnerabilities

External attack surface, risk-based priority, cloud and workload posture, and AI-correlated root causes

The correlation agent groups alerts and findings from the edge, cloud, code and endpoints into root causes, using shared entities and time. One fix often closes hundreds of alerts.

Root-cause issues

Issue	Root cause	Alerts grouped	Sources	Fix	Owner	Status
RC-41	Stale address group in firewall rule FW-118	412	Edge, WAF, firewall	Remove two hosting ranges from FW-118	Network team	AI-proposed
RC-40	CI service account with cluster-admin	37	Cloud, code	Bind a namespace-scoped role	Platform team	AI-proposed
RC-38	Legacy CMS on old-circulars site	214	WAF, scanners	Retire the site, redirect to the website	Communications	In progress

Grouping

sim(a, b) = J(entities_a, entities_b) × e^(−|t_a − t_b| / τ)
J = |A ∩ B| / |A ∪ B|                        # Jaccard over IPs, hosts, users, repos, rules
τ = 6 hours
link a and b if sim ≥ 0.35; issues are connected components
root cause = entity with highest betweenness in the component