The correlation tier of the Threat Tape platform
One trustworthy picture, assembled from every sensor.
Security teams run a handful of tools that each see a company from one angle. Keystone correlates their observations into a single, evidence-backed model of what the business actually looks like, and every claim in it traces back to the sensor that saw it.
Five reports in a folder, or one story
External recon, endpoint inventory, network egress, brand monitoring and AI-agent exposure each produce their own report. Nobody owns the picture they add up to. Today it lives in an analyst's head, and when an auditor asks how you knew something two years ago, there is no answer.
How it works
Sensors report what they observe. Keystone resolves those observations into entities, relationships and findings. The products that score risk read from it.
Built to be defensible
These properties are part of the engine, not settings on top of it.
It categorizes; it never scores
Keystone states facts and findings. The risk numbers belong to the products that read from it, which keeps the evidence reusable and the scoring defensible.
Nothing is silently hidden
Noise can be suppressed and risks formally accepted, but both are recorded, reversible, and re-open automatically when the world changes.
Claimed never masquerades as observed
What the paperwork says and what the sensors saw sit side by side until the evidence reconciles them. "We think it's patched" never becomes "it's patched".
Tamper-evident and point-in-time
The underlying log is append-only and hash-chained, and any past state can be reconstructed as of an assessment date: the snapshot an audit asks for.
Where it is today
An early preview. Here is exactly what is built and what is next.
| Part | State |
|---|---|
| Correlation engine: ingest, resolve, derive, reconcile, govern, serve | Built and tested end to end |
| Console covering every view, plus the governance controls | Built and tested |
| Authentication and per-capability access control | Built and enforced |
| Live connections to the five sensors and to AI models | Next: built against stand-ins, not yet run live |
See it on a synthetic company
A guided tour of about three minutes: one small made-up business seen through every sensor at once, correlated into assets, a topology graph and all nine classes of finding. You'll need the demo password from whoever shared this site.