CVE triage with exploitability scoring
Combines CVSS, EPSS and CISA KEV catalog to prioritize what matters now. Stops you from patching CVSS 9.8 theoretical issues while ignoring the CVSS 7.5 vuln being actively exploited.
Cybersecurity, model in Intel TDX
AI Cybersecurity Analyst in a hardened Intel TDX enclave
Triage CVEs, reconstruct incidents and map findings to MITRE ATT&CK, without sending your security posture to a third-party model.
Pentest reports, vulnerability scans, SIEM logs and firewall configs are the most sensitive documents in any organization. A leak of this data is itself a security incident. Here, documents are parsed by our servers and passed to an open-weight model in an Intel TDX enclave, under a French controller. The agent prioritizes findings by real-world exploitability, maps everything to MITRE ATT&CK and generates a P0-P3 remediation roadmap. Built for SOC teams and pentest firms that do not want this data on a general-purpose AI service.
Built for: SOC managers, CISOs, MSP/MSSP teams, pentest firms, incident responders
The pain
Average pentest costs $30-150K, and SOC analysts spend much of their time on triage rather than investigation. And the documents that drive remediation, pentest reports, scan output, incident artifacts, are the documents an attacker would most want to read.
The outcome
Triage 100s of vulnerability findings by real-world exploitability (CVSS + EPSS + CISA KEV) in minutes, with inference in a CPU-encrypted Intel TDX enclave and nothing stored.
Capabilities
What the Cybersecurity Analyst does on every document, with a TEE model that runs inside an Intel TDX hardware enclave.
MITRE ATT&CK technique mapping
Every finding mapped to a specific ATT&CK technique (e.g., T1566.001, Spearphishing Attachment). Coverage map highlights tactics with no detection, your real blind spots.
Attack-path analysis
Chains individual findings into the highest-risk attack path a real adversary would follow. Quantifies time-to-compromise ("Domain Admin in ~3 steps, 2-4 hours from initial access").
Pentest report validation
Distinguishes validated findings (PoC demonstrated) from theoretical or false-positive findings. Tells you which 47 findings actually need work, and which are noise.
Incident timeline reconstruction
Reads SIEM logs and EDR alerts, rebuilds the timeline with ATT&CK techniques, IOCs and confidence scores. Useful for IR retrospectives and tabletop exercises.
Board-ready risk summary
Translates security findings into FAIR-methodology business risk: annualized loss expectancy, top three exposures, investment to reduce to acceptable level, peer comparison.
How it works, end to end
Four steps from upload to export. Your document is parsed by our servers and passed to a TEE model; never used for training.
- 01
Upload security artifacts
Pentest report (PDF), Nessus / Qualys scan output, SIEM exports, firewall configs, cloud config snapshots. Files go over TLS, are parsed by our servers and passed to a TEE model; never used for training.
- 02
Inference inside Intel TDX
During inference, the model runs in memory encrypted by the CPU inside an Intel TDX enclave. Nothing is sent to OpenAI, Anthropic or Google.
- 03
Review prioritized findings
Threat summary, finding-by-finding breakdown with ATT&CK mapping, attack-path diagram, P0-P3 roadmap, MITRE coverage map, executive risk summary.
- 04
Hand off to ticketing
Markdown for IR write-ups and tabletop sessions; the OpenAI-compatible API (Pro tier) for your own Jira / ServiceNow / TheHive scripts.
Frameworks and regulations covered
Every output cites the specific article, section or control. The Intel TDX hardware boundary handles the data-protection side; the agent handles the analytical side.
NIST CSF 2.0MITRE ATT&CKISO 27001 / 27002SOC 2 (Trust Services Criteria)NIS2 DirectiveCIS Controls v8PCI-DSS v4.0DORA (EU financial)
What people actually ask it
Real prompts from cybersecurity teams.
Triage this vulnerability scan, prioritize by real-world exploitability, not just CVSS.
Map this pentest report to MITRE ATT&CK. What's the most dangerous attack chain?
Analyze these SIEM logs, reconstruct the incident timeline.
This pentest found 47 findings, which ones are false positives?
Sample output
Prompt: Generate a P0-P3 remediation roadmap from this assessment.
Output: P0 (24h): CVE-2024-3094 xz utils backdoor on bastion host, in CISA KEV. CVE-2023-44487 HTTP/2 Rapid Reset on edge proxies, active exploitation. P1 (7d): 12 findings with EPSS >0.5 and no compensating control. P2 (30d): 38 findings with patches available but compensating controls in place. P3 (90d): 84 informational and hardening recommendations.
Prompt: Which 47 pentest findings are false positives?
Output: 14 false positives identified: 6 are network-level SSL ciphersuite findings mitigated by upstream load balancer (CONFIRMED via config review); 4 are theoretical XSS where input is server-side templated only; 2 are CVEs that do not apply to the specific minor version deployed; 2 are CVSS-by-policy findings (info disclosure of build numbers) you have explicitly accepted. Recommend marking these as risk-accepted in the report rather than re-litigating with the pentester.
Pricing
Every tier runs inside Intel TDX hardware enclaves. Plans stay in sync with /pricing.
Plus
$20/mo
1,000 requests/month, 1 seat. For independent pentesters, blue-team consultants.
Starter
$349/mo
3 seats, 2,000 requests/month, 100 MB uploads, audit log. For small SOC teams and MSSPs.
Pro
$1,199/mo
10 seats, 5,000 requests/month, 500 MB uploads, API access for SIEM / SOAR integration, 12-month audit log.
Enterprise
Contact sales
Unlimited seats, fine-tuning on your internal IR playbook, SSO/SAML, dedicated TDX capacity, custom DPA, EU-hosted customer database.
AI Cybersecurity Analyst vs the alternatives
Honest comparison. Hardware-rooted confidentiality is what most alternatives are missing.
| Alternative | Pros | Cons vs VoltageGPU |
|---|---|---|
| Dropzone AI |
|
|
| Charlotte AI (CrowdStrike) |
|
|
| ChatGPT Enterprise |
|
|
FAQ
Is sending vulnerability data to an AI tool really safe?
It depends on where the data goes. Here, files are parsed by our servers and passed to an open-weight model in an Intel TDX enclave; never used for training. Nothing goes to OpenAI, Anthropic or Google. The controller is French; compute sub-processors are US-based and listed. Decide what to upload based on that data path.
How does this compare to running a model locally?
Local deployment keeps data on your own hardware but requires GPU capex, ops headcount, model maintenance and patching. This service avoids that, at the cost of sending documents to our servers for parsing and to a TEE model for inference. If data must never leave your premises, run a model locally.
Does it replace my SOC analysts?
No. It takes on first-pass triage so your team can focus on threat hunting, IR and detection engineering. Output is framed as analysis for trained security professionals, not autonomous response.
Will it correctly identify active threats in our environment?
When SIEM/EDR logs are provided, the agent flags active threats with an explicit "ACTIVE THREAT DETECTED, escalate immediately" banner. It will not redact or downplay findings. It also redacts credentials, API keys and private keys that appear in source documents.
Can I integrate it with Jira, ServiceNow or TheHive?
Not natively. On the Pro tier, you can script the OpenAI-compatible API to push structured findings into your ticket system or detection engineering workflow. Requests pass through our relay, which sees them in clear (TLS ends at our host). To keep plaintext off our servers, run your own inference server in a Confidential VM and terminate TLS inside its trust domain.
What about MITRE ATT&CK v15 and ATT&CK for Containers?
The agent is current on MITRE ATT&CK v15, including ATT&CK for Containers and Cloud sub-techniques. Coverage maps include the relevant matrix for the artifact type (enterprise, mobile, ICS).
Does it understand cloud-specific findings?
Yes. CIS Benchmarks for AWS, Azure and GCP, CSPM findings (Wiz, Prisma, Orca format), Kubernetes pentest output and IaC scan reports. Cloud config drift gets mapped to specific CIS controls and CSPM rule IDs.
Pricing comparison vs an external SOC?
External SOC-as-a-Service runs $50-200K/year for mid-sized orgs. The agent does not replace 24/7 monitoring, it accelerates the human work inside your team or your MSSP. It is meant to work alongside an existing MSSP, not replace one.
Keep exploring
Run Cybersecurity Analyst on hardware you can prove
Model in an Intel TDX enclave, with an attestation of its serving instances on your nonce. French company (VOLTAGE EI), compute at US sub-processors under SCCs. Cancel anytime.