Visitor guide
The Keystone demo: what you're looking at
Everything in the demo is synthetic. It's a guided tour, not a live assessment of anyone's real systems.
What Keystone is
Security teams run a handful of tools that each see a company from one angle: external recon, network traffic, cloud posture, brand monitoring, AI-agent exposure. Each produces its own report. Keystone is the layer that correlates them into one evidence-backed picture of what a business actually looks like. Instead of five disconnected reports, you get one story where every claim traces back to the sensor that observed it.
It's the correlation tier of the Threat Tape platform, and one design choice is deliberate: Keystone categorizes and connects; it never scores. The risk numbers are the job of the products that read from it. That separation is what keeps the evidence reusable and defensible.
What's in this demo
A small synthetic company (one employee workstation, a domain controller, a cloud account, and the paperwork) seen through every sensor at once. From those scattered observations Keystone has assembled:
- 2 assets correlated across multiple sensors: one host seen by external recon and internal inventory, reconciled into a single record.
- All nine finding classes: an internet exposure, suspicious outbound traffic, a cloud privilege-escalation path, an on-prem credential path to the domain controller, a brand look-alike domain, an exposed AI agent, and more.
- A topology graph wiring it together: 15 nodes and 11 relationships, each tagged with how confident we are (directly observed vs. inferred from configuration).
- Claimed-vs-observed reconciliation: where the paperwork (a CMDB) disagrees with what the sensors actually saw.
Signing in
- Open the live demo.
- Enter the demo password from whoever shared this site.
- On each view, click Load to fetch its data.
There's no account to create. Your session lasts a working day; use Sign out in the green bar at the top to end it sooner.
Taking the tour (about 3 minutes)
- Overview: the cockpit. Headline counts and every finding class at a glance.
- Topology: the whole correlated model as a graph; every edge has a source and a confidence class.
- Findings: the individual issues, each tied back to its evidence.
- Consumers: how a downstream product (RiskTape or CGAP) would read this to do its own scoring. Keystone hands over inputs; it doesn't put a number on them.
Honest notes
- Synthetic data. The company, hosts and findings are made up for the tour.
- An early preview. The correlation engine and console are real and work end to end; connecting live sensors is the next phase.
- Read-only for you. You're seeing the correlated model; you can't change anything from here. Views that change settings or governance will tell you access is denied, and that's expected.