ThreatCanary uses exposure, API, identity and graph context to reason about realistic compromise paths, then validates exploitability with controlled evidence.
The AI can choose what to investigate next. A finding still crosses an evidence boundary before it reaches a customer.
Open the sample evidence packRepresentative product workflow. This diagram explains the evidence model; it is not presented as a customer result or live product capture.
The engine chooses a target-relevant method from live graph context instead of replaying the same checklist.
Direct answers on scope, evidence, safety controls and how ThreatCanary differs from tools you already run.
ThreatCanary uses exposure, API, identity and graph context to reason about realistic compromise paths, then validates exploitability with controlled evidence. Rather than replaying a fixed set of checks, the platform forms testable hypotheses from what it observes about the target, selects or adapts methodology, and confirms whether a path actually works.
A.R.T. stands for Autonomous Reasoning & Testing. It is the ThreatCanary component that uses graph context to generate attack hypotheses, select the appropriate methodology and validate exploitability. It is the layer that decides what is worth testing on a given target, instead of running the same predefined checks everywhere.
Safety controls govern automation depth, tool trust, scope, approval gates and execution limits. Combined with scope management, which defines exactly what the platform may discover, test and validate, these constraints keep offensive workflows inside authorised boundaries. Human approval controls remain part of the model rather than being optional.
Yes — hypothesis-driven testing exists for exactly that case. Novel vulnerability hypothesis research generates and tests new hypotheses from exposure patterns, API behaviour, technology fingerprints and graph context. Where a hypothesis cannot be tested with existing capability, controlled test generation can produce a purpose-built validation test case under the same safety controls.
Continuous learning feeds detection, methodology, prompts and test coverage from captured evidence, logs and real validation outcomes. Vulnerability intelligence adds exploit and research context to sharpen hypothesis generation and prioritisation, and prompt management versions, tests and governs the prompts used by autonomous workflows and advisors.
