Technology // WARDOG Brain
Investigation with a burden of proof.
Brain does not produce a confident narrative and stop. It generates competing explanations, seeks the evidence that would refute each one, and reports what it could not establish.
Governing constraint
Intelligence can recommend. Authority must be earned.
Brain has no execution rights. It can request an authorisation from the Gate; it cannot grant one, widen one, or bypass one.
Specialist roles
Eight perspectives, one adjudicated conclusion.
Each role has a defined remit and defined inputs. Disagreement between roles is a signal, not a failure.
Attacker
Proposes how an adversary would have achieved the observed state, and what they would do next.
Defender
Establishes what normal looks like for this tenant, asset and identity before treating anything as anomalous.
Sceptic
Actively attempts to refute the leading hypothesis and surfaces the benign explanation that fits the same evidence.
Identity
Reasons about authentication, tokens, sessions, consent and privilege paths.
Endpoint
Reasons about process lineage, persistence, module loads and local artefacts.
Forensics
Establishes ordering and provenance: what happened first, and what depends on what.
Blast radius
Calculates reach and the cost of both action and inaction across the graph.
Response
Proposes the minimum sufficient action set, with preconditions and rollback paths stated.
Bounds
What Brain is not allowed to do.
Autonomy without limits is not a feature. These constraints are enforced outside the model.
No free-form execution
Actions exist only as a fixed, reviewed catalogue with typed parameters. There is no arbitrary command path.
No self-granted scope
Tenant and asset scope are supplied by the platform and validated at the Gate, never inferred by the model.
No unevidenced conclusions
A conclusion must cite graph evidence. Unsupported reasoning is recorded as uncertainty, not promoted to fact.
Walkthrough
Reasoning, stage by stage.
A demonstration scenario showing how observation becomes a verified, authorised, proven outcome.
scenario · credential compromise → oauth persistence → c2
Simulated scenarioIdentity reasoning
Impossible-travel sign-in accepted
An identity authenticates from a new ASN eleven minutes after a session in another region. On its own, an alert. In the graph, a starting point.
- identity.signin.success
- geo_delta=4,180km
- mfa=satisfied
Request early access
WARDOG is in early access with a small number of design partners. Tell us about your estate and we will get back to you.