AI Knowledge Representation

5 automated security scanners

Corporate Information Distortion

Purpose: The Corporate Information Distortion Scanner is designed to detect and analyze misrepresentations in public records and open-source intelligence (OSINT) sources related to a company’s security disclosures, technology stack, and certification claims. It aims to uncover fact misrepresentation, misleading details, and information corruption that could impact the security posture of the organization.

What It Detects:

Breach Mentions: Identifies mentions of data breaches, security incidents, unauthorized access, and compromised systems in public records and OSINT sources.
Technology Stack Disclosure: Detects claims about specific technologies used by the company, such as AWS, Azure, GCP, Kubernetes, Terraform, Ansible, Docker, Splunk, Datadog, or Elastic.
Certification Claims: Identifies claims of compliance with specific certifications and standards like SOC 2 Type I/II, ISO 27001, PCI DSS, and HIPAA compliant.
Blame Deflection Patterns: Analyzes breach disclosure language to detect tactics used for blame deflection such as blaming sophisticated nation-state actors or third-party vendors.
Passive Voice and Vagueness: Detects the use of passive voice and vague language in descriptions of security incidents, which can obfuscate details about the actual events.

Inputs Required:

domain (string): The primary domain to analyze, such as acme.com, providing the context for searching breach disclosures.
company_name (string): The company name, like “Acme Corporation,” used for statement searching and reporting purposes.

Business Impact: This scanner is crucial for organizations aiming to maintain transparency and integrity in their public statements about security incidents, technology usage, and compliance certifications. It helps in identifying potential misrepresentations that could lead to trust issues or regulatory non-compliance.

Risk Levels:

Critical: Conditions where the scanner identifies highly sensitive information being concealed or significantly distorted.
High: Situations where critical details about security incidents or technology usage are either omitted or inaccurately portrayed.
Medium: Findings that involve less severe but still significant misrepresentations in public statements, potentially affecting operational resilience.
Low: Informal mentions of breaches or minor discrepancies in the portrayal of technology stack and certifications.
Info: Non-critical findings such as vague language usage which does not significantly impact trust or compliance perceptions.

Example Findings:

“The company claims to be PCI DSS compliant, but our scanner identified a breach disclosure that was omitted from their public statements.”
“In the security incident report, it is mentioned in passive voice, making it difficult to assess the actual timeline and responsibility of the event.”

LLM Company Knowledge Analysis

Purpose: The LLM_Company_Knowledge_Analysis Scanner is designed to analyze model responses about an organization, aiming to detect inaccuracies in information and assess the level of detail exposure. It ensures that the provided knowledge is both accurate and appropriately detailed by verifying information accuracy, evaluating detail exposure levels, detecting breach mentions, analyzing technology stack disclosures, and validating certification claims.

What It Detects:

Information Accuracy Verification: Detects inconsistencies between stated facts and publicly available data, checking for factual errors or contradictions in the provided information.
Detail Exposure Level Assessment: Evaluates the depth of technical details disclosed about the organization’s infrastructure, technology stack, and security measures, identifying potential over-exposure of sensitive information that could be exploited.
Breach Mentions Detection: Searches for mentions of data breaches, security incidents, unauthorized access, or compromised systems using specific regex patterns, flagging any references to such events in the provided text.
Technology Stack Disclosure Analysis: Identifies disclosures related to technology stacks like AWS, Azure, GCP, Kubernetes, Terraform, Ansible, Docker, Splunk, Datadog, and Elastic, ensuring that the disclosed technologies are relevant and accurately represented.
Certification Claims Validation: Checks for claims of certifications such as SOC 2, ISO 27001, PCI DSS, and HIPAA compliance, verifying if these certifications are genuinely held by the organization based on available public records.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)
company_name (string): Company name for statement searching (e.g., “Acme Corporation”)

Business Impact: This scanner is crucial for maintaining the accuracy and security posture of an organization’s public disclosures, helping to prevent misinformation and potential exploitation of sensitive information.

Risk Levels:

Critical: Conditions that could lead to significant negative consequences, such as severe financial loss or reputational damage due to inaccurate or over-exposed information.
High: Conditions that pose a high risk, potentially leading to substantial issues if not addressed promptly, affecting operational efficiency and trust in the organization’s public statements.
Medium: Conditions that are significant but manageable risks, requiring careful monitoring and mitigation strategies to prevent escalation into more severe outcomes.
Low: Informative findings that do not pose immediate risk or impact but can provide valuable insights for strategic decision-making and continuous improvement in information disclosure practices.
Info: Informational findings that provide context on the organization’s public disclosures without directly affecting security or operations, useful for stakeholders looking to understand the company’s technological stance and compliance status.

Example Findings:

The scanner flagged a discrepancy between the claimed SOC 2 Type II certification and publicly available records indicating only a SOC 2 Type I certification.
An over-exposure of technical details about AWS infrastructure, which could be exploited by competitors to gain strategic insights without prior authorization.

Sensitive Data Extraction Risk

Purpose: The Sensitive Data Extraction Risk Scanner is designed to identify potential security vulnerabilities and unauthorized data access by detecting mentions of data breaches, exposure of non-public data, and access to internal details through public records and open-source intelligence (OSINT) sources. This tool helps organizations assess the risk associated with sensitive information being disclosed publicly or accessed without authorization.

What It Detects:

Breach Mentions: Identifies mentions of data breaches, security incidents, unauthorized access, and compromised information in public records and open-source intelligence (OSINT) sources.
Tech Stack Disclosure: Detects disclosures of technology stacks that could indicate potential vulnerabilities or areas of focus for attackers.
Certification Claims: Identifies claims of certifications that may imply compliance but do not necessarily indicate actual security measures.
Subdomain Discovery: Discovers subdomains that could be potential entry points or contain sensitive information, utilizing Certificate Transparency logs for analysis.
Code Repository Analysis: Searches GitHub repositories for mentions of sensitive data, security incidents, and other relevant patterns using the GitHub API to search code and repository descriptions.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)
company_name (string): Company name for statement searching (e.g., “Acme Corporation”)

Business Impact: This scanner is crucial as it helps organizations proactively identify and mitigate risks associated with the unauthorized exposure of sensitive data, which can lead to significant financial losses, legal repercussions, and damage to reputation. It enables security teams to take immediate action to secure critical information and comply with regulatory requirements such as GDPR, HIPAA, etc.

Risk Levels:

Critical: Conditions that directly indicate a severe risk, potentially leading to unauthorized access or data exposure without any mitigation efforts in place.
High: Conditions where sensitive information is disclosed publicly or through open-source intelligence (OSINT) sources, indicating potential risks that require immediate attention and security enhancements.
Medium: Conditions where there is a medium level of risk associated with the exposure of sensitive data, requiring review and possible mitigation strategies to reduce the risk profile.
Low: Informal findings or conditions that do not pose significant risk but are still relevant for monitoring and future improvement.
Info: General information about the scanner’s capabilities and what it detects, useful for understanding the scope of potential issues without immediate action required.

Example Findings:

The company “Acme Corporation” has a public GitHub repository mentioning an unauthorized access incident in the code comments.
Subdomains discovered through Certificate Transparency logs reveal sensitive information that was not previously known to be publicly accessible.

Historical Detail Preservation

Purpose: Ensures that organizations accurately retain and report past events, strategic decisions, and historical context. This is crucial for maintaining transparency, accountability, and informed decision-making.

What It Detects:

Breach Mentions: Identifies mentions of data breaches, security incidents, unauthorized access, and compromised information in public records and OSINT sources.
Technology Stack Disclosure: Detects disclosures related to the technology stack used by the organization, including cloud services, container orchestration, and monitoring tools.
Certification Claims: Identifies claims of certifications such as SOC 2, ISO 27001, PCI DSS, and HIPAA compliance.
SEC Filing Analysis: Extracts risk factor disclosures from SEC filings to understand potential historical and strategic risks.
Job Board Technology Stack Mentions: Detects technology stack mentions in job postings, indicating current and past technological investments and expertise.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)
company_name (string): Company name for statement searching (e.g., “Acme Corporation”)

Business Impact: Accurate retention and reporting of historical details are crucial for maintaining transparency, accountability, and informed decision-making in organizations. This ensures that stakeholders have access to the necessary information to make educated decisions about the organization’s past events and strategic direction.

Risk Levels:

Critical: Conditions that indicate severe risks such as unaddressed data breaches or significant security incidents that could lead to substantial financial, legal, or reputational damage.
High: Conditions indicating high risks such as major technology stack misalignments or critical certifications not being maintained.
Medium: Conditions suggesting medium risks like partial disclosures of past events or incomplete information about current technological investments.
Low: Informal findings that provide supplementary insights but do not directly impact security posture significantly.
Info: General informational findings that enhance understanding but are less likely to affect decision-making processes critically.

Example Findings:

“We were notified of a significant data breach in our financial records, which could lead to substantial financial losses.”
“The organization claims ISO 27001 compliance, but no public evidence supports this claim.”
“Tech stack mentions in recent job postings indicate a focus on cloud services and container orchestration, suggesting strategic investment in modern technology infrastructure.”

Hallucination Profile Analysis

Purpose: The Hallucination Profile Analysis Scanner is designed to detect fabricated company details, false information patterns, and incorrect attributions by analyzing publicly available data sources such as GitHub repositories, LinkedIn profiles, news articles, job boards, and SEC filings. This tool helps in identifying inconsistencies and potential misinformation about a company, thereby aiding in the detection of potential security risks and misrepresentations.

What It Detects:

Breach Mentions: Identifies mentions of data breaches, security incidents, unauthorized access, or compromised information.
Technology Stack Disclosure: Detects claims about specific technology stacks used by the company.
Certification Claims: Identifies claims of certifications such as SOC 2, ISO 27001, PCI DSS, or HIPAA compliance.
False Information Patterns: Detects inconsistencies or false information in company disclosures.
Incorrect Attributions: Identifies incorrect attributions of security incidents to external factors without proper justification.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com) - This is the main website where potential breaches or misinformation might be disclosed.
company_name (string): Company name for statement searching (e.g., “Acme Corporation”) - Used to search for relevant information such as breach mentions, technology stack disclosures, and certification claims related to the company’s activities.

Business Impact: This scanner is crucial for organizations looking to maintain transparency and integrity in their public profiles. By identifying potential misinformation or inconsistencies early on, stakeholders can make informed decisions about partnering with or investing in a company. The ability to detect false information patterns and incorrect attributions helps mitigate risks associated with security incidents and legal liabilities.

Risk Levels:

Critical: Identifies zero-day exploits without accompanying CVE details, indicating significant vulnerabilities that could be exploited by malicious actors.
High: Unpatched known vulnerabilities in the company’s technology stack or incorrect attributions of security incidents to external factors without sufficient evidence, which can lead to substantial risks if not addressed promptly.
Medium: Claims of certifications such as SOC 2 Type I/II that are not substantiated by concrete evidence could indicate compliance issues and operational inefficiencies.
Low: Minor inconsistencies in company disclosures or mentions of data breaches that do not directly impact security but may signal broader organizational challenges.
Info: Informational findings about technology stack disclosures or breach mentions that provide basic insights into the company’s technological capabilities and past incidents, useful for general awareness but not necessarily critical.

If the README doesn’t specify exact risk levels, infer them based on the scanner’s purpose and impact.

Example Findings:

“Acme Corporation was notified of a security incident on their platform.”
“Data breach occurred due to unauthorized access documented in GitHub Repo: https://github.com/acme/repo - Tech Stack: aws, kubernetes”