Platform
Nine capabilities, one source of truth.
From asset inventory to validation evidence, every Velosight module reads from and writes to the same system of record and relationship graph. No second findings list whose numbers never match.
Velosight Discover
Eight connectors, each seeing the environment from a different angle — exactly as in the real world. On the live dataset, every connector is a real API client configured from the console: endpoint, credentials, sync interval, and connection test.
| Connector | Sees | Doesn't see | Identity variant |
|---|---|---|---|
| Active Directory | computer objects, users, privileges | IPs, ports, vulnerabilities | PC-REZA + FQDN |
| CrowdStrike Falcon | MAC, local IP, serial, cached credentials | agentless assets | pc-reza, device_id |
| Tenable.io | ports, services, vulnerabilities | unscanned assets | sometimes IP only |
| VMware vCenter | VM UUID, guest hostname | physical assets | VM name |
| AWS Inventory | instance-id, tags, public IPs | on-premises assets | instance-id |
| Kubernetes | nodes & workloads | anything outside the cluster | deploy/ns/name |
| ServiceNow CMDB | owner, business unit, criticality | technical data | PCREZA |
| FortiGate | network devices, firewall policies | endpoints | device name |
Adding a new integration = implementing the connector.Connector interface and registering it in the registry. The pipeline behind it doesn't change.
Filling in what connectors can't see.
Two things will never come from vendor integrations: assets no system can see, and business context that only lives in people's heads. Three entry paths cover both — and all of them still go through the same pipeline.
Manual input
A single asset along with its criticality, business unit, and owner. Operator-supplied values override machine classification; anything left blank is still determined by the machine.
Spreadsheet import
.xlsx and .csv files with a validation preview before commit.
- Rejected rows shown with reasons
- Unrecognized columns flagged
- Common CMDB export headers detected automatically
Credentialed network scan
ICMP/TCP sweep, reverse DNS, TLS certificate inspection, then credentialed enumeration.
- SNMP v2c/v3 (full USM, AES-128/DES)
- SSH — explicit read-only commands
- WinRM — read-only WQL
One physical device = N identities. We unify them.
The core CAASM problem is solved in three stages, and every decision is traceable.
- Blocking — serial, MAC, IP, and compacted hostname to avoid O(n²) comparisons.
- Pairwise scoring — weighted signals with protection against over-merging.
- Per-field survivorship — business context from the CMDB, OS from AD, MAC from EDR, ports & vulnerabilities from the scanner.
- Decision trail — stored in
correlation_decisionsand visible in each asset's Source Correlation tab.
# ~7,000 source records → ~2,050 golden asset records AD : PC-REZA uppercase, FQDN, no IP EDR : pc-reza MAC + IP + serial Tenable : 10.10.20.25 IP only CMDB : PCREZA / SN12345 no hyphen │ ▼ ASSET-000412 one Golden Asset Record ~70% dedup
Relationships are where risk hides.
Neo4j stores assets, identities, credentials, vulnerabilities, and applications as a property graph. If Neo4j is unavailable, the platform runs in degraded mode and builds the graph from PostgreSQL — every feature keeps working.
// relationships CAN_REACH ADMIN_OF LOGS_IN_TO STORES_CREDENTIAL GRANTS HAS_VULNERABILITY PART_OF // example chain User → Laptop → Local Admin Credential → Application Server → Database → Critical App
Not shortest path. Attacker state search.
Attackers carry the credential material they've already compromised, and every hop requires a technique with its own prerequisites — vulnerability exploitation, credential reuse, or an admin relationship. The search uses k-best Dijkstra on -log(probability) to produce several alternative paths per crown jewel.
PATH-0001 score 84 likelihood 63% Internet → VPN-GW-01 [CVE-2024-21762] → LAP-00094 [CVE-2017-0144] → SERVER-AD02 [CVE-2020-1472] Choke point: 100% of paths to 7 critical targets pass through VPN-GW-01 100% of paths to 4 critical targets pass through SERVER-AD02
Choke point analysis
Answers the most practical question for remediation teams: “If we can only fix a few things today, which ones cut the most paths?”
- Multiple alternative paths per target, not just one.
- Attack chain visualization and a validate button directly on every path.
- Only findings with
confirmed/reportedevidence may become entry points.
Every score is explainable.
A multiplicative model was chosen because a single very low factor must be able to pull down the overall score. The “Why?” button on the Exposure page opens the per-factor contributions along with a narrative explanation.
EPSS and CISA KEV status, plus evidence of public exploitation.
Whether the asset is reachable from the internet or from a compromised segment.
Privileged credentials stored on, or usable from, the asset.
Presence and status of EDR, segmentation, and compensating controls.
AI proposes. The deterministic engine decides.
The AI Planner (#5) translates attack paths into validation steps. Every step must pass policy before it executes, and every transition is recorded in the audit trail.
Attack Plan
A sequence of validation steps derived from an attack path.
Scope & risk class
Allowed techniques, safe / intrusive / destructive, CIDRs, excluded asset types.
Human-in-the-loop
Intrusive steps wait for approval; destructive ones are blocked.
Evidence
Technique prerequisites are checked against reachability, vulnerabilities, credentials, and EDR status.
Safe Discovery Only
Non-intrusive techniques only. No approval required.
Standard Exposure Validation
Intrusive with mandatory approval. OT networks prohibited, destructive techniques blocked.
Answers from the actual state, not from guesswork.
Questions are parsed into intent and entities, then answered from graph queries, asset/exposure queries, and hybrid knowledge-base retrieval. Every answer shows its query plan and citations.
- “What are the top 10 security risks in my environment?”
- “How can an attacker reach SAP-DB01?”
- “Why does SERVER-AD02 have such a high risk score?”
- “Which remediation would most effectively reduce the attack surface?”
question → intent + entity extraction → GRAPH QUERY Neo4j + ASSET/EXPOSURE PostgreSQL + KB RETRIEVAL pgvector · vector + lexical → answer synthesis # LLM_PROVIDER = deterministic (default) | anthropic | openai # the model may not invent hostnames, CVEs, or numbers
From inventory to exposure — with evidence quality.
Twelve sources with different roles are normalized into a single shape, then delivered to every installation by Velosight Hub as sequentially numbered, immutable, Ed25519-signed bundles — no NVD API key needed on the customer side.
Distro advisories beat upstream
Version comparison uses the real dpkg and rpmvercmp algorithms, so distro backports don't produce hundreds of false positives per Linux server.
Every finding carries its evidence
confirmed from authenticated scans, reported from scanners, potential from banner/CPE inference. A guess never raises the score as much as evidence does.
Coverage gaps are visible
CVEs not yet in the knowledge base are logged, failed sources are distinguished from those awaiting credentials, and NVD completeness is carried through to each installation.
The application layer, not just ports.
Web application findings become exposures on their host asset — included in risk scores, attack paths (T1190), analyst decisions, remediation tasks, and reports.
- No second findings list. The dashboard, asset details, and PDF reports use the same set.
- The built-in engine is deliberately passive. GET/HEAD only: security headers, cookies, TLS, CORS, directory listing, sensitive files, version disclosure.
- Import reports from OWASP ZAP, Nuclei, or Burp for active finding classes such as SQLi and XSS.
- Off by default. Runs only on allowed CIDRs; loopback, link-local, CGNAT, and cloud metadata endpoints are always refused.
web application finding └─▶ exposure rule=dast (keyed by exposure_key) │ ├─ risk score ├─ attack path T1190 ├─ analyst decisions ├─ remediation tasks └─ reports # only confirmed/reported may # become attack path entry points
Change what's right, not what's visible.
The inventory is rebuilt every cycle, so edits are made to the original input data — not to inventory rows that would disappear in the next cycle.
ASSET-000412
Asset and exposure numbers persist across cycles — safe to use in tickets, exports, and links.
Before → after
Every change is recorded per field, along with who made it.
Business context
Criticality, unit, owner, location — re-applied on every discovery.
Risk acceptance
Accept risk, already fixed, or not exploitable — openly contradicted if validation proves otherwise.
Want to see it all working together?
A full demo of one CTEM cycle — from ~7,000 source records to attack paths and validation — completes in seconds.