Cyber Intelligence Exposure Platform
See your environment the way attackers see it.
See Every Asset. Understand Every Path. Validate Every Exposure.
Velosight unifies Cyber Asset Discovery (CAASM), an Asset Relationship Graph, Attack Path Analysis, context-based risk prioritization, and automated exposure validation in a single platform — with six AI engines as the intelligence layer and deterministic engines as the decision makers.
The problem
A vulnerability list is not a picture of risk.
Security teams are drowning in thousands of high-CVSS findings, while an attacker needs only one path. Scanners don't know which assets connect to the Domain Controller, whose credentials are stored on which laptop, or whether a vulnerability is actually exploitable.
- One device, many identities. AD, EDR, scanners, and the CMDB each call the same asset by a different name.
- Scattered context. Ownership lives in the CMDB, ports in the scanner, credentials in the EDR — nobody sees all of it.
- Misdirected priorities. A CVSS 9.8 on an isolated asset gets fixed before a CVSS 7.5 that opens a path to the crown jewels.
- hostname
- idn5a9F2c (AD)
- mac / serial
- from EDR
- ports & vulns
- from scanner
- owner · unit
- from CMDB
Continuous CTEM cycle
From discovery to retest — in one pipeline.
Every cycle rebuilds the understanding of your environment in seconds, while asset identities, analyst decisions, and history persist across cycles.
Capabilities
One integrated architecture, not a pile of tools.
Every module reads from the same system of record and graph — the numbers in dashboards, reports, and attack paths always match.
Velosight Discover
Eight vendor connectors, manual input, spreadsheet import, and credentialed network scanning (SNMP, SSH, WinRM).
Learn more → 02 · Entity resolutionNormalization & Correlation
Blocking, pairwise scoring, and per-field survivorship produce a single, traceable Golden Asset Record.
Learn more → 03 · GraphAsset Relationship Graph
Assets, identities, credentials, vulnerabilities, and applications connected in a single Neo4j property graph.
Learn more → 04 · AI #4Attack Path Analysis
Attacker state search with k-best Dijkstra — complete with the choke points that cut the most paths.
Learn more → 05 · AI #3Risk-Based Prioritization
An eight-factor multiplicative risk model, with per-factor contributions and a “Why?” explanation.
Learn more → 06 · ValidationAutomated Exposure Validation
AI proposes, the deterministic engine decides: policy, scope, approval, evidence, and audit trail.
Learn more → 07 · AI #6AI Security Analyst
Graph RAG Q&A that answers from the actual state of your environment — with query plans and citations.
Learn more → 08 · Vuln intelligenceVulnerability Feed
Twelve sources — CVE List, NVD, OSV, KEV, EPSS, distro advisories — in signed bundles from Velosight Hub.
Learn more → 09 · DASTWeb App Scan
Passive application-layer scanning and import of ZAP, Nuclei, or Burp reports — findings become exposures on the host asset.
Learn more →Contextual prioritization
Context beats raw CVSS.
The multiplicative model ensures that a single very low factor — for example, a truly isolated asset — can pull down the overall score. Every score comes with per-factor contributions and a narrative explanation.
The result: your team works on what actually breaks attack paths, not just what lowers the numbers in a report.
Reachable from the internet and sits on an attack path to the Domain Controller.
No reachability and not on any path to a crown jewel.
AI proposes · deterministic engine decides
Exposure validation with auditable guardrails.
No step is executed just because the AI suggested it. Every step passes through policy, scope, and approval — and is then proven against facts about the environment.
Attack Plan
Translates an attack path into a sequence of validation steps.
Guardrail
Technique, risk class (safe / intrusive / destructive), CIDR scope, OT exclusions.
Sign-off
Intrusive steps require human approval. Destructive ones are always blocked.
Evidence
Prerequisites are checked against the graph; every transition is recorded in the audit trail.
AI Security Analyst · Graph RAG
Ask your environment, not your documents.
The primary context isn't document snippets but the actual state of your environment, pulled from the asset graph and the system of record. Every answer shows its query plan and knowledge-base citations.
- No hallucinated data. The model is forbidden from inventing hostnames, CVEs, or numbers outside the context.
- Works without an API key. A built-in deterministic narrator; an LLM (Anthropic / OpenAI) is optional.
- Hybrid retrieval. pgvector + lexical search over a security knowledge base.
- VPN-GW-01 — exploit CVE-2024-21762 from the internet
- LAP-00094 — cached local admin credential
- APP-SRV-07 — credential reuse → SAP-DB01
Integrations
Connects to the systems you already own.
Real API clients — not just CSV imports. Credentials are sealed with AES-256-GCM and never returned by the API. Adding a new integration only requires implementing a single connector interface.
FAQ
Frequently asked questions
How is Velosight different from a vulnerability scanner?
A scanner produces a list of findings per asset. Velosight correlates those findings with identities, credentials, network relationships, and business criticality in a single graph, then computes the real attack paths to your crown jewels. Your scanner findings become one of its inputs.
Does exposure validation run exploits on the production network?
No. The validation engine runs in simulation mode: every step is proven against facts in the graph and the system of record. The built-in Safe Discovery Only policy permits only non-intrusive techniques; OT networks are always off-limits and destructive techniques are always blocked.
Does our data leave our environment?
Velosight is deployed on your infrastructure (Docker Compose or Kubernetes). The AI Security Analyst works with a deterministic narrator that needs no API key; external LLM integration is optional and must be enabled explicitly.
What if an asset isn't visible to any connector?
The Add Asset page provides manual input, spreadsheet import with a validation preview, and credentialed network scanning. All of these paths still go through the same correlation pipeline — there is no shortcut that writes directly to the inventory.
Are analyst decisions lost in the next discovery cycle?
No. Asset identities (ASSET-000412) and exposures persist across cycles. Decisions such as accepting a risk, marking something as fixed, or not exploitable are recorded with a reason in the audit trail and re-applied every cycle.
Can we try it without connecting production systems?
Yes. Velosight ships with a separate demo dataset containing a synthetic enterprise environment (~2,000 assets, ~1,250 identities) with its own database and graph, so it never mixes with the live inventory.
Get started
Find the paths attackers will use — before they do.
See Velosight running on the demo dataset, or discuss a pilot in your environment with our team.