Your AI estate runs on other people’s models, tools and services. The Threat Lab catalogues the common ones, checks what it finds against first-party sources, and turns each finding into a check the platform runs for you.
Kapālins connects directly to the model providers, SaaS products, identity providers and security tools below. Whatever cannot be connected is found by Shadow AI discovery, and the Threat Lab’s intelligence covers every AI vendor it catalogues.
Through the AI gateway: every prompt and reply is checked inline, before it reaches the model or comes back.
Through each product’s audit log or admin API: who used the AI, on what, and what it did.
Through the device sensor, which recognises 68 AI tools on laptops and servers, and agent hooks that ask Kapālins before a tool runs.
Through sign-in grants, which reveal 31 AI apps people have connected to their work accounts.
Where findings go: alerts and evidence land in the tools your security team already works in.
Shadow AI discovery covers what cannot be connected: the device sensor recognises 68 AI tools by their processes and destinations, and identity grants reveal 31 AI apps. Each one found can be governed by device policy.
Shadow AI discoveryThe Threat Lab catalogues 55 AI vendors in 6 categories, from coding agents to the AI inside SaaS, against the same 8 kinds of signal.
Developer AIs10Enterprise AIs10Self-Hosted LLM & RAG15Operational SaaS AIs10Embedded SaaS AIs10Shadow & Consumer AI10
The 2026 lesson from AI-led vulnerability research is that finding flaws is now far easier than fixing them. The Threat Lab’s job is to close the gap between a finding and a control.
The Threat Lab files each finding under the most authoritative source behind it, from the vendor’s own pages down to community chatter, and only the top two tiers can reach your tenant. Beside it, the feeds a workspace can switch on.
The source ladder
Changelogs, release notes, status pages, security advisories and filings published by the company the finding is about.
Vulnerability databases, standards bodies and regulators: the NVD, MITRE, OWASP, NIST, CISA and their peers.
Credible secondary reporting, corroborated. Trusted, but not first-hand.
Forums, social posts and single-author blogs. A lead to follow up, never a fact.
The gate. A finding reaches a customer only when it is verified, published, and backed by a T1 or T2 source. Compliance, cost, vulnerability and regulation findings count toward a metric only on the same terms.
Threat intelligence feeds
Built in
AI and LLM advisories reviewed by hand and shipped with the platform, each with its real publish date.
AI vendor and model threats from the Threat Lab, served only once verified and backed by a T1 or T2 source.
Free public feeds
The US catalogue of vulnerabilities known to be exploited, filtered to AI and machine-learning software.
Recent indicators of compromise from abuse.ch ThreatFox.
Your own subscriptions
Bring your Recorded Future subscription. Its intelligence on AI vendors and components will arrive beside ours.
Bring your Cyble Vision subscription, for dark-web and threat intelligence beside ours.
Bring your Google Threat Intelligence subscription, with Mandiant frontline research, beside ours.
What arrives lands in the workspace’s Threat Center. A feed is marked as fetching only when the platform pulls its intelligence today.
About 250 poisoned documents were enough to backdoor models from 600 million to 13 billion parameters in a 2025 study, and in 2026 criminals tricked an AI vendor’s evaluation sandbox into handing over production keys. A model is a supply chain.
61 probes in 4 suites: jailbreak and injection, harmful behaviour, malicious code, and accuracy. Where our Labs team has published a garak pack, the red team runs on NVIDIA garak for models served through Groq, xAI and OpenAI. Your own team can add probes of its own, kept apart from the score.
Attack techniques are placed on the MITRE ATLAS matrix of adversary tactics against AI. For each technique, a Bayesian loss model runs thousands of simulated trials to give a loss range in dollars, with its uncertainty shown and its assumptions open. It is labelled as built on sector priors until your own profile tunes it.
NIST Center for AI Standards and Innovation (now CAISSI)
For your estate. Frontier-grade offensive capability no longer stays behind a provider’s safeguards for long. Assume it is available to anyone with a GPU.
Source: NIST news
Anthropic
For your estate. Every tool that runs prompts against your models holds your keys. Treat evaluation and testing infrastructure as production.
Anthropic
For your estate. Expect the vulnerability backlog in the AI components you run to grow faster than vendors patch it. Know which ones you depend on.
Source: Anthropic research
We will map the models, tools and AI vendors your estate runs on, and show which findings and checks apply to each.
Automated feeds from the US National Vulnerability Database, GitHub security advisories and CISA’s catalogue of exploited vulnerabilities. The vendors’ own changelogs, status pages and advisories are added when our research team reviews them; they are not collected automatically today. Each source is tiered. Compliance, cost, vulnerability and regulation findings count only when a first-party or authoritative source backs them, and community posts never feed a metric.
Not today. The Threat Lab checks the components and provenance recorded for a model: known and exploited vulnerabilities, missing provenance and licence risk. Scanning model weights and uploading an AI bill of materials are in development.
The red team runs our own probe suites, or runs on NVIDIA garak where our Labs team has published a garak pack, for models served through Groq, xAI and OpenAI. Every prompt fired is kept with its reply and verdict, and none of it counts toward a score until it has been graded.
