Five steps, each with something to show for it.
Radius observes the surface, reasons over the attack graph, attacks the paths that matter, validates how far each one got and reports it. Once you fix a path, it attacks that path again. This page is what each step does and what it leaves behind.
Observe
Radius discovers and watches the surface: assets, services, identities and dependencies, including what was never in the inventory. Passive by default: nothing is written to a controller unless you authorize active probing, asset by asset.
Reason
Radius builds the attack graph and decides what to try first, by where each path leads, not by severity score. It starts from what it already knows about your environment from the last run.
- Every path traced to what it reaches
- Ordered by consequence, not CVSS
- Chains that share a hop share a fix
- Findings mapped to MITRE ATT&CK techniques
Attack, then validate
Radius runs the real chain against your environment, inside the rules of engagement you signed, and confirms how far it got. It does not simulate the attack, and it stops before the destructive payload.
The rules you signed live in the engine, checked before every action
Non-bypassable safety patterns above your own blocklist and per-asset rules
A stop button that works mid-run
Every action logged with the decision, the reason and the rules in force
Integrations
Findings go where your team already works, with the validated chain behind each one. The list below is split into what ships today and what is planned. Nothing is listed as available that you cannot switch on.
Shipping connectors are documented product behaviour. Planned connectors are on the roadmap and cannot be switched on today.
Microsoft Sentinel
Palo Alto XSOAR
SplunkIT Service Management
Jira
ServiceNowVulnerability Scanners
Qualys
Rapid7 InsightVM
TenableCloud Security
AWS Security HubEndpoint Detection & Response
CrowdStrike FalconReport
Every run produces three reports (executive, technical, compliance), each at three levels: the whole run, a single asset, or a single finding. Alongside them sits the safety trail and a knowledge base the next run starts from.
Executive: what was exposed and what changed after remediation, for people who do not run the tooling
Technical: the validated paths hop by hop, with the command, the timestamp and the evidence at each step
Compliance: the run as control evidence, meaning what was tested, when, under whose authorization, with what outcome
REST API
Everything the console can do, the API can do. Issue keys from the console, scope them to what the integration needs, and revoke them when it is done.
API documentation// Webhook events
finding.created
ticket.updated
scan.completed
Start with one run.
A scoped run against the environment you authorize. It starts with a 30-minute call, and the rules of engagement are signed before the run does.
Scope a run