Certainty Intelligence
At its core, Certainty Intelligence works by achieving Irrefutable Attribution. This is done by aggregating and correlating data from multiple, diverse sources—not just technical logs or scanning results, but also external information like legal filings, financial disclosures, and operational details. By fusing these data points, the system can definitively link a technical security finding (such as a publicly exposed credential or an insecure configuration) to a known organizational asset, a responsible business unit, a specific adversarial technique, or a regulatory compliance mandate.
This process provides security leaders with the absolute proof required to make strategic decisions confidently. It shifts the focus from merely detecting a vulnerability to establishing the undeniable reality of the risk and its precise business impact, thereby justifying resource allocation, accelerating remediation efforts, and ending the analysis paralysis often caused by uncertain data.
The ThreatNG solution is designed to address the "Attribution Chasm" by converting ambiguous, low-confidence technical findings into verified, high-certainty, and actionable evidence, which is the core concept of Certainty Intelligence. ThreatNG achieves this by fusing multi-source data to provide Irrefutable Attribution and Legal-Grade Attribution.
Here is how ThreatNG's capabilities help deliver Certainty Intelligence:
External Discovery and Assessment
ThreatNG starts with purely external unauthenticated discovery using no connectors, gathering all possible technical findings from an attacker's perspective. It then conducts a continuous External GRC Assessment that maps these findings directly to relevant GRC frameworks.
The platform generates Security Ratings (A-F) that provide immediate context and certainty about specific risks:
Non-Human Identity (NHI) Exposure Security Rating: This critical governance metric directly quantifies vulnerability from high-privilege machine identities, such as leaked API keys and service accounts. This capability achieves certainty by continuously assessing 11 specific exposure vectors, including Sensitive Code Exposure and misconfigured Cloud Exposure, using purely external unauthenticated discovery. The rating converts chaotic technical findings into irrefutable evidence by applying the Context Engine™ to deliver Legal-Grade Attribution.
Data Leak Susceptibility: This rating is derived from uncovering external digital risks across Cloud Exposure (specifically exposed open cloud buckets), Compromised Credentials, and Externally Identifiable SaaS applications. The finding of an exposed cloud bucket, for example, is a tangible, high-certainty data-leak risk.
Cyber Risk Exposure: This rating assesses findings across technical indicators, such as invalid certificates and sensitive code exposure (code secret exposure). The specific finding of a private IP address exposed via Subdomains Intelligence provides high certainty about an internal network exposure point.
Continuous Monitoring and Reporting
ThreatNG provides Continuous Monitoring of the external attack surface, digital risk, and security ratings for all organizations. This ongoing process ensures that any change in risk is immediately identified.
The Reporting capability converts these continuous findings into high-certainty, contextualized documents:
Security Ratings Reports (A-F): These provide a precise, objective measure of security posture.
External GRC Assessment Mapping Reports: These reports directly map findings to compliance mandates such as PCI DSS, HIPAA, and GDPR.
The embedded Knowledgebase within the reports provides: Reasoning to give context and insights into the risks, and Reference links to additional information, enabling organizations to make informed decisions about risk mitigation.
Investigation Modules and Intelligence Repositories
Investigation Modules are crucial for achieving certainty by drilling down into technical details and multi-source correlation:
Sensitive Code Exposure: The Code Repository Exposure investigation uncovers digital risks such as Access Credentials (Stripe API keys, AWS Secret Access Keys) and Database Exposures (SQL dump files, PostgreSQL password files) in public repositories. The discovery of a hardcoded AWS Access Key ID, for example, is a finding with high certainty and immediate, irrefutable impact.
Subdomain Intelligence: This module confirms the existence and configuration of subdomains, performing checks for Subdomain Takeover Susceptibility (checking CNAME records against a comprehensive Vendor List for inactive or unclaimed resources to verify the "dangling DNS" state) and WAF Discovery and Vendor Identification. These specific, validated technical checks leave little room for ambiguity.
The Intelligence Repositories (DarCache) are the source of the crucial external context needed for Certainty Intelligence:
Vulnerabilities (DarCache Vulnerability): This repository proactively manages external risks by integrating four distinct data sources: NVD (technical details/severity), KEV (vulnerabilities actively being exploited in the wild), EPSS (probabilistic estimate of likelihood of future exploitation), and Verified Proof-of-Concept (PoC) Exploits(direct links to exploits on platforms like GitHub). By confirming a vulnerability is on the KEV list and has a verified PoC, ThreatNG provides the absolute certainty required to prioritize remediation.
Examples of ThreatNG Helping
Certifying Risk: A routine scan reports an open port on a subdomain. ThreatNG's Subdomain Intelligence confirms that the open port is an exposed Remote Desktop Protocol (RDP) service. This high-certainty finding, combined with DarCache Vulnerability showing an actively exploited RDP vulnerability (KEV data), allows the CISO to eliminate the "Crisis of Context" and immediately justify investing in closing the port.
Irrefutable Attribution: The Context Engine™ iteratively correlates an external technical finding (a publicly exposed service account email found in NHI Email Exposure ) with a decisive legal or financial context. This fusion provides Legal-Grade Attribution that definitively links the leaked identity to a high-value system owner, providing the "absolute certainty" needed to justify a security action.
Cooperation with Complementary Solutions
ThreatNG's high-certainty output can work well with complementary solutions by providing the verified context they often lack:
Working with a Security Orchestration, Automation, and Response (SOAR) Solution: ThreatNG's Contextual Risk Intelligence and Policy Management (DarcRadar) ensures that only high-certainty, customized, and strategically prioritized evidence is sent to the SOAR platform. For example, the SOAR is only triggered to automatically initiate a firewall rule change after ThreatNG's external assessment confirms the exposed port. It validates it with KEV/PoC data from the Vulnerabilities repository.
Working with a Vendor Risk Management (VRM) Solution: ThreatNG's Supply Chain & Third-Party Exposure Security Rating and continuous assessment of vendor-related risks from a purely external perspective (e.g., identifying SaaS vendors within Domain Records) provides objective, unauthenticated evidence of a third-party's security posture. This high-certainty rating serves as input to the VRM solution, helping it bypass lengthy questionnaire cycles and prioritize vendor reassessment based on external reality.
