Workflows + New
Impossible travel → step-up and contain
Published v3.2 · 1,204 runs
Geo-policy breach on the Client Portal
Published v2.4 · 3,410 runs
Ransomware containment
Published v4.0 · 14 runs
HSM key misuse → suspend and rotate
Published v1.6 · 22 runs
Whistleblower Portal L7 surge (privacy mode)
Published v2.1 · 9 runs
Payment-message anomaly (Lazarus technique)
In review v0.9 · not run
KEV vulnerability → AI fix → verify
Published v1.3 · 61 runs
Data exfiltration → revoke and preserve
Draft v0.4 · not run
Add a step
Adds after the selected node and links it
Trigger
AI
Logic
Action
Human
Published v3.2 − 100% +
Lifecycle ✓ Design ✓ Validate ✓ Simulate ✓ Approve ✓ Publish Monitor
yes no Trigger · Impossible travel
Impossible travel
speed: > 900 km/h · vpn: exclude corporate
AI · AI enrichment
AI enrichment
sources: TI, asset, identity
AI · AI triage
AI triage
model: triage-v4 · threshold: 0.80
Logic · Condition
Risk ≥ 0.80?
expr: risk ≥ 0.8
Action · Revoke sessions ⚠
Revoke sessions
scope: all platforms
Action · Open incident
Open incident (Sev 2)
severity: from triage
Action · Notify
Notify user and RO
to: on-call, owner
Action · Step-up with passkey
Step-up with passkey
Asks the user to prove possession of the
Logic · End
End
Ends the run and records the outcome.
Run log idle
Press Test run to replay a sample event through the graph. Nothing is executed against production.
Workflow
Sign-ins that imply impossible speed are enriched and scored. High risk revokes every session and opens an incident; lower risk asks for a passkey.
Runs · 30 days 1,204
Success 99.1%
Median duration 4.2 s
Resolved without a person 86%
Steps 9
Owner Security engineering
Guardrails
Every run is written to the hash-chained audit log
Test runs never execute actions
Corporate VPN exits are excluded before scoring
Revocation only when AI confidence ≥ 0.80
Versions
v3.2 Current
v3.1 Previous
Drag steps to move them. Drag from a step's right port onto another step to link. Click a step to edit it.