Architecture
Cyber engine & Intelligence. Decisions stay deterministic.
Velosight draws a firm line between the layer that proposes (AI) and the layer that decides (a deterministic engine with policy, approval, and audit trail). Every component boundary is designed to be replaceable without changing anything else.
Data flow
From data sources to the console.
Connector Framework
GoNormalization & Correlation
GoStorage
SoR + GraphAI Service
Python · FastAPIExposure Validation Engine
Go · deterministicWeb Console
Next.jsSix AI engines
An explainable intelligence layer.
Every score comes with an explanation, every answer with its sources, and every engine has a deterministic fallback when supporting services are unavailable.
Entity Resolution
Probabilistic resolution that complements deterministic correlation, with protection against over-merging.
Classification
Determines asset type and criticality; operator-supplied values always win over machine guesses.
Risk Prioritization
An eight-factor multiplicative risk model with per-factor contributions and narrative.
Attack Path Prediction
Attacker state search, k-best Dijkstra, and choke point analysis.
Exposure Planner
Translates attack paths into validation plans — which are then checked by policy.
Security Copilot
Graph RAG over Neo4j, PostgreSQL, and a pgvector knowledge base.
Technology stack
Chosen for speed, readability, and control.
| Layer | Technology |
|---|---|
| Frontend | Next.js · React · TypeScript · Tailwind · Cytoscape.js · Apache ECharts · TanStack Query |
| Cyber engine | Go — connectors, correlation, graph projection, validation engine, REST API |
| Intelligence engine | Python 3.11 · FastAPI — 6 AI engines, Graph RAG |
| System of record | PostgreSQL 16 + pgvector |
| Graph | Neo4j 5 — Asset, Identity, Credential, Vulnerability, Application property graph |
| Object storage | MinIO — evidence and artifacts |
| Cache | Redis |
| Deployment | Docker Compose · Kubernetes manifests |
Design principles
Decisions that make the platform trustworthy.
One pipeline for every entry path
Vendor connectors, manual input, imports, and network scans all produce a SourceRecord. There is no shortcut that writes directly to the asset table.
Degraded mode, not failure
Without Neo4j, the graph is built from PostgreSQL and the graph source is shown in the UI. Without an LLM API key, the deterministic narrator takes over.
Secrets never come back
Connector and scan credentials are sealed with AES-256-GCM and never returned by the API.
Separate live and demo datasets
Each has its own PostgreSQL, Neo4j, and AI service — demonstrations never pollute the real inventory.
An event log ready to scale
Topics such as asset.raw, exposure.detected, and risk.updated run in-process today, with isolated replacement points for Kafka, ClickHouse, and Temporal.
Honesty about uncertainty
Failed, unreachable, and pending states are kept distinct; potential findings never form attack paths.
Deployment
Runs on your infrastructure.
Self-hosted with Docker Compose for evaluation, or Kubernetes manifests for production. The vulnerability knowledge base is supplied by Velosight Hub as signed bundles.
- A full discovery cycle in seconds.
- The Service Status page monitors core-api, each dataset's databases, the AI service, scheduler, feed, Redis, and MinIO.
- A complete REST API for integration with SOAR, ticketing, and reporting.
# local evaluation $ make up $ make seed # API examples GET /api/v1/stats/overview GET /api/v1/assets/{id}/correlation GET /api/v1/attack-paths GET /api/v1/exposures?on_attack_path=true POST /api/v1/campaigns POST /api/v1/campaigns/{id}/approve POST /api/v1/ai/copilot
Discuss the architecture with our team.
We can walk through integration requirements, sizing, and deployment models for your environment.