Average recall of the best frontier LLM on unguided threat hunting.
Attack-path intelligence for human and machine identities
Find the attack paths that matter — then cut them.
Your tools give you a list of two hundred findings. VALXR gives you the three changes that eliminate most of your exposure — with the reachability path behind each one shown in full.
IDENTITY GRAPH SYNCED
48 REACHABLE PATHS → 3 CUTS
CHOKE POINTSLIVE ANALYSIS
48paths to crown jewels
3changes required
79.2%paths eliminated
10assets protected
01
−26 pathsServiceAccount: dataset-processor→ ClusterRole: CSI driver bound_to
02
−9 pathsMesh-VPN enrollment key→ Corporate mesh VPN joins_network
The problem
Every tool sees a slice. The attacker walks the seams.
SIEMs, EDRs, cloud posture tools and vulnerability scanners each hold part of the picture. None of them answers the question a security team actually has: if this identity is compromised, what can it reach — and what is the smallest change that stops it?
For one shared connector credential to grant cluster-admin across two production clusters.
An autonomous intrusion ran end to end undetected, while alerts fired on multiple security layers.
What we have built
A digital twin that models machines, not just people.
VALXR keeps a continuously synced graph of your identities, assets, permissions and business impact — with agents, service accounts, credentials, clusters and signing keys as first-class nodes.
Attack-path traversal
Multi-hop reachability from any identity to any critical asset, across cloud IAM, Kubernetes RBAC, network and source control.
Choke-point analysis
The smallest set of changes that breaks the most paths. As permissions to revoke, or nodes to isolate.
Counterfactual simulation
Ask what happens before you change anything. Remove a permission hypothetically, watch the paths collapse.
Approval-gated containment
Propose → human approves → isolate → draft fix → restore. Nothing destructive runs on its own.
The differentiator
Everyone lists paths. We tell you what to cut.
Path enumeration tells a customer they have a hundred problems. Choke-point analysis answers the second question: what do we do on Monday?
RANKED CUTGREEDY SET-COVER
01
ServiceAccount: dataset-processor→ ClusterRole: CSI driver bound_to
−26 paths54.2%02
Mesh-VPN enrollment key→ Corporate mesh VPN joins_network
−9 paths72.9%03
Autonomous eval agent→ Third-party eval sandbox can_access
−3 paths79.2%Exact minimum cut is NP-hard, so this is a greedy set-cover approximation — and the API says so in its own response rather than calling it something it isn't.
Credibility over comfort
What we don't claim
Initial access in the July 2026 intrusion was an input-validation bug in a dataset processor. No digital twin would have prevented it, and ours wouldn't have either.
Our claim is narrower and testable: a day-one foothold became day-three cluster-admin only because nobody had computed the blast radius first. That part was knowable before the attacker ever arrived.
Who it is for
Built for estates that span more than one vendor.
AI-native companies
Running your own inference or training infrastructure on Kubernetes. Agents and service accounts are multiplying faster than anyone can inventory them.
Multi-cloud SaaS
Series B to D, 200–2000 people, security team of three to eight. Too multi-cloud for single-vendor exposure tooling, too lean to triage a raw findings list.
How to start
Your first report needs no integration.
You send read-only exports. We return the choke-point report in ten business days. No agent, no production access, nothing for your vendor-security process to clear.
01
You export
One afternoon of a platform engineer’s time.
02
We analyse
Your estate becomes a graph.
03
You get the cut
Ranked changes and what each eliminates.
Live, specific, no slides
See it run against a real intrusion.
Thirty minutes. We'll seed the July 2026 Hugging Face attack chain live and run the analysis in front of you.