Platform
A living graph of your environment,
with the judgment to act on it.
SecSemantic is a semantic context graph over your security and data stack. It fuses what you run with what you observe, computes what an attacker could actually do with it, and gates every automated action behind a confidence bar and a human.
Entities and relationships,
not rows and alerts.
Everything SecSemantic knows lives in one typed graph. Your applications, servers, data stores, identities, and business units are first-class entities; telemetry attaches to them as evidence. That structure is why questions like “can the internet reach payroll data?” have computable answers.
What your team works in.
Overview
Start every morning with a briefing, not a queue.
The Overview leads with your posture in plain language, written by your private model from facts computed on the graph. Two honest halves — how much you can see, and how much you could contain — because a single vanity score hides exactly the gap that matters.
- Grounded briefing — names the reachable crown jewels and the first fix
- Posture, split honestly — visibility and containment scored separately
- Everything clickable — every number opens the entities behind it
Your environment is visible but reachable. 3 of 11 crown-jewel systems can be reached from the internet-facing surface; the shortest route is 2 hops, through the payroll application tier. One access change severs 2 of the 5 critical paths — start there.
WRITTEN BY YOUR PRIVATE MODEL · GROUNDED IN 693 ENTITIES · NOTHING LEFT YOUR WALLSYou can see 84% of ATT&CK-relevant activity — but contain only 38% of routes to critical data. The gap is the work.
Attack paths & chokepoints
See the routes. Then see the one fix that closes them.
SecSemantic walks the graph the way an attacker would — from internet exposure, CVEs, and over-privileged identities toward the data your business depends on. Then it finds the chokepoints: single edges whose removal collapses whole families of paths. Click one and watch the routes it severs go dark before you change anything real.
- Ranked by blast radius — business criticality, not raw CVSS
- What-if simulation — preview the fix before you make it
- One click to action — promote a chokepoint into the response queue
Confidence-gated response
Autonomy with a bar to clear, not a blank check.
For every incident, the AI scores its confidence against business context — severity, ATT&CK signals, threat radius, what the target actually is. At full confidence it contains automatically. One point below, it waits for a person. Either way, the decision, the reasoning, and the outcome land in an immutable audit trail.
- A visible reasoning trace — every factor that raised or lowered confidence
- Named playbooks — approve or reject in bulk, with SLA countdowns
- Audit-ready — who decided, when, and on what evidence
Autonomous investigation
An AI analyst that shows its work.
Point it at anything — a host, an identity, an alert — and the agent runs a real investigation plan: scope, blast radius, crown-jewel exposure, attack paths, ATT&CK signals, decision. Every step is a genuine graph query with its result on screen. No vibes, no summary theater.
- Six steps, all inspectable — the query and the observation, side by side
- Ends in a decision — with a confidence score and a recommended action
- One click to the queue — the recommendation becomes a pending response
get_entity — AI agent, operated by IT, touches 3 systemsblast_radius — 14 entities within 2 hopsfilter_crown_jewels — worker-pii-db ◆ in radiusattack_paths — 1 direct path, no approval step on write scopealerts_attack — T1071 app-layer traffic observed on hostreason_decision — scope the agent’s grant; confidence 92Conclusion: the copilot service holds a standing write grant it uses for one nightly job. Scoping it to read-only outside that window removes the only direct route to worker PII from an AI-operated identity.
CONFIDENCE 92 · ＋ SEND TO RESPONSE QUEUEAsk
Plain questions. Cited answers.
Anyone on the team can ask in plain language — “which internet-facing services can reach worker PII?” — and get an answer computed from the graph, phrased by your model, with citations to the exact entities and paths behind every claim. If the graph doesn’t know, the answer says so.
- Grounded, not generative — facts come from graph queries, never from the model’s imagination
- Citations you can click — every referenced entity opens in the Explorer
- Readable by non-analysts — severity and jargon translated into plain concern levels
Detection coverage
ATT&CK coverage that admits what it can’t see.
SecSemantic maps the telemetry you actually ship against MITRE ATT&CK Enterprise — per tactic, per technique — and separates “we could see this” from “we have seen this.” Thin telemetry gets flagged, not flattered. Blind spots become a worklist instead of a surprise.
- Grounded in event volumes — coverage claims trace to your real data sources
- Gaps stated plainly — missing log sources named, with what they’d unlock
- Never “protected” — coverage means visibility, and the UI says so
Blind spot: no email-gateway telemetry. 6 phishing-adjacent techniques are currently unobservable. We show the gap; we don’t paper over it.
The graph supplies the truth.
The AI supplies the judgment.
Numbers — blast radius, attack paths, confidence inputs, coverage — are computed deterministically on the graph. The model reasons over those facts, decides, and explains. That division of labor is why SecSemantic can put AI in the loop without putting hallucinations in your audit trail.
Private by default
Your model, inside your walls.
Point SecSemantic at the model endpoint you trust — Ollama or vLLM on your own metal, Bedrock in your AWS account, a private Azure deployment. Public APIs are supported, but they’re a choice you make, never a default you discover.
- OpenAI-compatible endpoint — swap models without swapping platforms
- Model badge everywhere — every AI-written sentence shows who wrote it
- Deterministic fallback — if the model is offline, the facts still flow
deterministic analytics
Azure private · on-prem
What leaves the boundary: nothing.
The same context plane,
machine-readable.
Your copilots and agents shouldn’t reason about security from screenshots and stale wikis. SecSemantic exposes the graph over MCP — tenant-isolated, read-governed, and identical to what your analysts see. Ask it for blast radius, attack paths, or entity context and get grounded, citable answers.
MCP context plane
Grounded answers for anything that can call a tool.
- Same retrieval core — humans and agents read one source of truth
- Tenant isolation enforced — an agent sees its environment, nothing else
- Citations included — downstream agents can show their evidence too
tools/call context.attack_paths
{ "target": "worker-pii-db" }
← 3 paths · shortest 2 hops · 1 chokepoint
{
"chokepoint": "restrict portal-app → worker-pii-db",
"severs": 2, "grounded": true,
"cited": ["portal-app", "payroll-app", "worker-pii-db"]
}
Thirty minutes. One incident, end to end.
We’ll walk your team through the console live — alert, blast radius, chokepoint, decision, audit — and leave you with the questions to ask any vendor who says “context.”