01
External / Web
SurfaceLooks for
Internet-facing web apps, APIs and TLS, mapped and fuzzed for weak spots.
Proves
Injection, authentication bypass and misconfiguration, proven on the target.
See your whole estate. Prove what’s exploitable.
CAIVA finds every asset you own without agents, shows which ones an attacker can reach, and proves it. A person approves before anything runs.
In a sample estate of 2,481 assets (72% running endpoint protection), CAIVA proved 17 attack paths an outsider could use. Four reach the finance database; fixing one server, dc-01, breaks three of them.
seenexploitableyou decideColour means the same thing on every chart.
Chapter 1 of 4: discover
Everything you own
CAIVA sweeps your network without agents or credentials. Servers, cloud accounts, network gear, databases and endpoints land on one graph, in cyan, the moment they are seen.
- Servers
- Cloud
- Network
- Databases
- Endpoints
Chapter 2 of 4: reach
What’s actually reachable
Most of the estate is noise. One route is not: from the internet to edge-proxy, then app-api-01, then dc-01, and on to your finance database, fin-db-02.
4 chains reach fin-db-02. 3 of them pass through dc-01.
Chapter 3 of 4: approve
A person approves
CAIVA stops at the gate. Nothing is exploited until your analyst reviews the plan and approves it, and the proof stays inside the targets they signed off.
How the gate worksplan: app-api-01 to dc-01 to fin-db-02, bounded proof
Waiting for your approvalApproved by your analyst
Chapter 4 of 4: proven and fixed
Fix dc-01 and 3 of 4 chains break.
Evidence comes back with every step logged. The last open chain runs through ci-runner, and that is your next fix.
- 3 chains closed
- 1 still open
Why CAIVA
What scanning leaves you with, and how CAIVA closes it.
A scanner tells you what might be wrong. CAIVA maps everything you own, ranks it by real-world risk, and proves what an attacker can actually exploit, with a person approving every step.
Too many raw scanner findings, ranked by CVSS alone.
One register, re-ranked by CISA KEV, EPSS and real exposure.
Unknown and shadow assets you were never counting.
Agentless discovery finds every device, managed or not.
“Is this actually exploitable, or just theoretically?”
A human-gated proof: bounded exploitation your analyst approves.
An audit needs evidence, not a story.
Evidence returned per finding, plus a full audit log of who did what.
Fixes still have to follow the change process.
Help Desk change approvals route remediation through your CAB.
Findings pile up and never close the loop.
SLA-tracked tickets that close only after a retest verifies the fix.
Every module, in flow order
Nine modules, one estate
It starts where your estate does — discovery and inventory — then risk, proof and remediation. Each box opens its own page with the real dashboards, and they share one inventory, so a finding in one is a ticket in another.
- IT Asset
Asset Discovery
A credential-free sweep finds every device you own — managed, unmanaged or hiding behind NAT — and makes each a tracked asset.
Open in depth - IT Asset
Asset Inventory
One record per asset, with CIS benchmarks and licences reconciled.
Open in depth - IT Asset
Assets Risk Posture
Every asset scored by real-world risk, rolled up into one posture.
Open in depth - Cybersecurity
Vulnerabilities
One CTEM register ranked by KEV, EPSS and exposure, with choke-points, departments and SLA tiers.
Open in depth - Cybersecurity
AI Pentest
Finds the reachable path across six isolated lanes and stops at a human gate — exploiting only after your analyst approves, then returns evidence.
Open in depth - Native ITSM
Help Desk
Incidents, problems, changes and requests, with SLAs, a CMDB and an end-user portal.
Open in depth - Reporting
Reports
Branded per-run pentest and vulnerability reports from the live estate.
Open in depth - Executive posture
Performance
One risk score for the whole estate, and whether it is improving.
Open in depth - Access & control
Administration
SSO, roles, teams, scanners, connectors and the audit log.
Open in depth
Explore your estate
Everything you own, in one place
Seven asset lanes orbit one core. Drag to orbit, or pick a lane to see what CAIVA knows about it.
Drag to orbit, or pick a lane to open its data
The whole platform
Six product areas. One estate at the core.
Every area reads the same inventory and writes back to it. Drag to orbit, or pick an area to light its sub-modules and the data it exchanges.
IT Asset
Discover, inventory, score
The spine: a credential-free sweep finds every device, and each becomes one record that everything else reads.
Cybersecurity
Vulnerabilities · AI Pentest
The register ranked by real-world risk, and the pentest that proves what is exploitable at a human gate.
Help Desk
Native ITSM
Findings close as SLA-tracked tickets, with a CMDB synced from the inventory and change approvals on record.
Reports
Branded, from live data
Per-run pentest and vulnerability reports, and the board posture report, all built from the live estate.
Performance
Executive posture
One risk score for the estate and whether it is improving.
Administration
Access, identity, audit
Who can do what, how they sign in, what connects, and an append-only record of every action.
From every asset to one fix
Five layers, each built on the one below
CAIVA starts from everything you own and narrows to the one change that closes the most risk. Scroll to stack the layers; hover one to light it and its card.
- cyan: seen and recorded
- red: proven exploitable
- amber: a human decision
- Layer 1Every device foundAgentless discovery, managed or not2,481 assets seen across 36 subnets
- Layer 2One inventoryOwner, criticality and CIS on every record72% of assets run endpoint protection
- Layer 3Risk-scoredCISA KEV, EPSS, exposure and criticality17 attack paths; fin-db-02 at 94/100
- Layer 4Proven attack pathinternet → edge-proxy → app-api-01 → dc-01 → fin-db-02dc-01 is the choke point
- Layer 5One approved fixCHG-2210 approved by the CAB, dc-01 patchedRetest verified: 3 of 4 chains closed
Every asset lane, one register
01 / 07
Cloud
AWS and Azure resolved without agents: instances, buckets and roles, each with its exposure and misconfigurations.
Scroll through the estate, or drag to orbit a lane
How CAIVA works
One system, end to end
Seven stages, one estate. Each opens into its own module with the full dashboards.
01Asset Discovery
Find every device, agentless
A credential-free sweep resolves every host by IP, MAC and vendor, including the ones behind the firewall.
- No agents, no credentials
- Unmanaged and shadow assets surfaced
- Owner, MAC and vendor per device
02Asset Inventory
One record for everything you own
Discovery, imports and connectors resolve into one asset record, benchmarked against CIS, with licences reconciled.
- Owner, criticality and EDR posture
- CIS benchmark per asset
- Licences reconciled
03Assets Risk Posture
Score real risk across the estate
KEV, EPSS, exposure and criticality score every asset and roll up into one posture you can track.
- Per-asset risk score
- Assets by risk band
- Posture and its trend
04Vulnerabilities
Fix what attackers actually use
One CTEM register re-ranks raw CVSS by known exploitation and reach, then routes each finding to an SLA tier.
- Ranked by KEV, EPSS and exposure
- Choke-points and CTEM scopes
- SLA tiers 7, 30, 90, 180 days
05AI Pentest
Prove what’s exploitable, with a person at the gate
CAIVA runs isolated lanes and lights up the reachable path to the crown jewel. Exploitation waits for a person to approve, and it returns evidence, not a foothold.
Plan
scope the lanes
Find
scan / DAST
Gate
human approval
Exploit
bounded proof
Report
evidence back
Internet entryHost (seen)Reachable exploit pathCrown jewelFix dc-01 and 3 of 4 chains break.
06Reporting
Report posture over time
Every run produces branded pentest and vulnerability reports from the live estate, so the board sees the trend.
- Per-run pentest reports
- Vulnerability reports
- Branded templates
07Help Desk
Close the loop in a real service desk
Proven risk becomes an SLA-tracked ticket with an owner, and it closes only after a retest.
- Findings become tickets
- Department routing and SLA
- Retest before close
AI Pentest · lanes
Six lanes, isolated, each with one job
Each asset type runs in its own sealed lane with its own depth posture — never a single engine pointed at everything. Some lanes stay at the surface; others go deep only once they have credentials.
02
Host / Network
Deep, with credsLooks for
Open services, host exposure and weak configuration across the network.
Proves
Remote code execution and credential attacks, bounded to the approved scope.
03
Active Directory
Deep, creds requiredLooks for
Domain layout, trusts and the reachable attack paths through it.
Proves
Privilege escalation toward domain control, step by step.
04
Cloud
Deep, creds requiredAWS · Azure · Entra
Looks for
Cloud and identity misconfiguration across your accounts.
Proves
Privilege escalation and lateral movement between accounts.
05
Container / K8s
Deep, with credsLooks for
Cluster, workload and image posture.
Proves
Container escape and lateral movement inside the cluster.
06
Code / Repo
SurfaceDetection-only — secrets & code
Looks for
Exposed secrets, risky dependencies and insecure code.
Proves
no exploitation in this lane — findings only
Every lane stops at the same human gate before anything is exploited, and returns evidence, not a foothold.
Open AI PentestCause chain
One finding, back to its cause and forward to its fix
The hero showed the path. This is the record behind it: every step, the module that took it, and the evidence it left. Play it, scroll it, or pick any step.
- same module
- hand-off to another module
Step 1 of 10Day 1 · 09:02
Asset Discovery
edge-proxy found, facing the internet
edge-proxy · 203.0.113.24:443
- Exposure
- Internet-facing
- Found by
- Agentless discovery sweep
- Evidence
- DSC-2481-118
Verdict
Follow the chain to the verdict.
The fourth chain, via ci-runner, stays open and tracked.
Sample run: IDs and times are illustrative. CVSS is the NVD base severity score out of 10; EPSS is the probability, 0 to 1, that a CVE is exploited in the next 30 days; KEV means CISA lists it as exploited in the wild.
Skip the room walkthrough
Inside the operation
Walk into the operation room
Scroll to walk the floor: discovery, triage, the human gate, then the proven path on the big board.
Business use cases
Six real questions, answered across the modules
Pick a question to watch it travel through CAIVA to an answer. Every step is a module you can open.
A KEV-listed CVE hits the news. Are we exposed?
- VulnerabilitiesMatch the CVE across the registerOpen Vulnerabilities
- Asset InventoryThree assets run the affected versionOpen Asset Inventory
- Assets Risk PostureOne faces the internet, so it is reachableOpen Assets Risk Posture
- VulnerabilitiesKEV + reachable sets the 7-day SLA tierOpen Vulnerabilities
- Help DeskTicket to NetOps; it closes only after a retestOpen Help Desk
Outcome: Answered from the live inventory: three affected, one reachable, one 7-day ticket.
Built for a bank’s controls
The controls your auditors will ask about, built in
Nine controls CAIVA enforces on every run and every fix. Each one opens the screen where it lives.
- Human gate before exploitationNothing is exploited until an analyst with the approver role signs off.AI Pentest
- Evidence, not a footholdA bounded proof returns evidence and leaves nothing running behind.AI Pentest
- Single sign-onPeople sign in through your identity provider, not a separate password.Administration
- Role-based accessRoles decide who sees what, and who may approve a pentest.Administration
- Password policyYour password rules, enforced on every local account.Administration
- Full audit logEvery action is recorded, append-only, with who did it and when.Administration
- Change approvals (CAB)Fixes go through your change board, and the decision stays on record.Help Desk
- SLA tiers7, 30, 90 or 180 days by real risk, with breaches escalated.Vulnerabilities
- Isolated pentest lanesEach asset type is tested in its own lane; lanes never cross.AI Pentest
Who it's for
Built for the teams who own the risk.
Regulated banks first, across cloud and on-premises estates, and the roles that carry the risk day to day — each with what they do in CAIVA.
CISO & security leadership
Board-ready posture and whether it is improving, in one score and its trend.
Open PerformanceSecurity analysts
Triage the register by real risk, known-exploited and reachable first, and route each fix to its owner.
Open VulnerabilitiesIT operations & service desk
One live inventory and CMDB, with findings as SLA-tracked tickets.
Open Help DeskRisk, audit & compliance
Evidence per finding, the audit log, and who approved what, on demand.
Open Administration
Request a demo
Fix dc-01 and 3 of 4 chains break. See it on your estate.
Tell us about your environment. We’ll show you the path an attacker would take through it, the gate your analyst approves, the proof, and the one fix that closes the most.