Notealy Security Engine
In developmentTools verify.The model reasons.
The Security Engine is the orchestration layer of Notealy. It coordinates specialized security tools rather than relying on model output alone, and it keeps what the AI suspects apart from what has been independently confirmed.
01What it does
Ten responsibilities,one pipeline.
Asset discovery
Map applications, APIs, and cloud resources inside the scope you have verified.
Tool orchestration
Run specialized scanners and analyzers — static, dynamic, dependency, and container — and normalize their output.
Telemetry collection
Gather the signals already produced by your cloud, observability, and security systems.
Agent execution
Let AI agents plan and carry out investigations through structured, permissioned tool interfaces.
Knowledge retrieval
Ground reasoning in curated security knowledge such as CWE, ATT&CK, and vulnerability intelligence.
Threat intelligence correlation
Relate what is found in your environment to known weaknesses and actively exploited vulnerabilities.
Controlled validation
Confirm a potential issue with a safe, scoped check before it is called a finding.
Evidence collection
Attach the requests, responses, code locations, and tool output that support each conclusion.
Remediation workflows
Route confirmed issues to the right owners with root-cause context and fix guidance.
Retesting and regression detection
Re-run validation after a fix, and alert if the same weakness comes back.
02Findings
Suspected is notthe same as confirmed.
Every finding has two layers, like our symbol: the signal that raised it, and the evidence that confirms it. Only the second reaches your team as confirmed.
Layer one
Potential finding
- Raised by model reasoning or a single tool signal.
- Shown as unconfirmed, with the reasoning that produced it.
- Never escalated or reported as a confirmed vulnerability.
Layer two
Validated finding
- Independently confirmed by a tool or a controlled, in-scope check.
- Carries the technical evidence your engineers need to reproduce it.
- Tracked through remediation, then retested to confirm the fix.
03Operational safety
Active testing,on your terms.
- Ownership first
- Assets are verified as yours before anything active runs against them.
- Explicit scope
- You define what may be assessed, when, and how. Out-of-scope targets are refused.
- Rate limits
- Active checks are paced to avoid disrupting production systems.
- Passive and active stay separate
- Continuous monitoring observes; active testing only runs when authorized, scheduled, or requested.
- Auditable by default
- Every action the engine takes is recorded, so your team can see what ran and why.
Notealy
Let's talk aboutyour security.
Interested in Notealy Platform for your organization, or in our research? Tell us about your environment and your security program.