For the principal engineer running the technical review. CONDUCTOR orchestration, license enforcement at the kernel, every agent broken down by what it scans, what it detects, what it outputs, what it integrates with, and where it sits in the decision flow from cloud API to evidence pack.
The question every security reviewer asks first: what does TITAN put inside our environment, and what does it open? The honest answer — nothing that listens, and nothing you pay Azure for.
TITAN AI ships as one signed binary. CONDUCTOR reads the license, spawns only entitled agents, routes findings through CONDUIT to customer-owned destinations. Nothing TITAN-owned ever holds customer data.
+--------------------+ | Customer cloud(s) | | Azure / | | Snowflake | | / Databricks | +---------+----------+ | | read-only API calls v +----------------------------------------------------------------+ | CONDUCTOR --> license check, tier enforcement, kernel | | --> only entitled agents are allowed to spawn | +--------+------+--------+-----+---------+------+--------+------+ | | | | | | | v v v v v v v [ Cloud sec ] [ Comply ] [ Vertical ] [ Data ] [ Network ] [ Health ] [ Resil. ] SCOUT COMPLY HIPAA AI GUARD BASTION ENGAGE CONDUCTOR SENTINEL AUDIT CMMC LATTICE EXFIL VOICE REASON FORGE PHI FLUX SCANNER PULSE PHOENIX SHADOW SIGNAL PREDICT DR-GUARD | | findings + priority + playbook + ATT&CK v +--------------------+ | REASON | 3-candidate think-first | pre-fix reasoning | (off in AIRLOCK) +---------+----------+ | v +--------------------+ | CONSENT GATE [y/N] | audit + paid licenses only +---------+----------+ | approved v +--------------------+ | FORGE | remediation execution | rollback ready | snapshot before write +---------+----------+ | v +--------------------+ | PHOENIX | cascade recovery if | cascade recovery | a downstream breaks +---------+----------+ | v +--------------------+ | CONDUIT | field-level mapping | routes to dest | per platform +---------+----------+ | +---------+---------+---------+---------+---------+ | | | | | | v v v v v v Splunk Sentinel Datadog Jira webhook +----------------------------------------------------------------+ | AUDIT chain --> SHA-256 hash chain across every action | | --> tamper-evident, satisfies HIPAA 164.312(b) | +----------------------------------------------------------------+
CONDUCTOR is the kernel: license check at startup, agent spawn gate at runtime, audit chain writer for every event. Audit and trial licenses physically cannot reach FORGE; the consent gate is bypassed because the FORGE entitlement bit is off. AIRLOCK mode disables CONDUIT external destinations and the optional REASON LLM call.
The license token carries the agent list, AIRLOCK flag, FORGE bit, integrations whitelist. Token is signed; tamper rejects. CONDUCTOR exports the entitled-agent list as an env var to the runtime.
Every one of the 45 agents checks the license gate at construction time. An agent you have not licensed never touches your environment. Discovery is silent: no cloud API call, no log entry, nothing.
SCOUT iterates resource types (50+), SENTINEL iterates attack patterns (CIS + custom), COMPLY iterates 247 controls across 9 frameworks. Findings buffered in-memory; partial results checkpointed every 100 resources.
Every finding gets P1 / P2 / P3 with a specific SLA (24h / 72h / sprint). Playbook fields: owner role, effort estimate, exact az / Terraform command, rollback command, evidence pointer, regulatory citation. MITRE ATT&CK technique mapping where relevant.
Three candidate fixes generated. Each scored on blast radius, rollback ease, and side-effect risk. Highest-scored candidate is the one presented at the consent gate. Off in AIRLOCK mode and any time the customer disables it.
Operator sees the finding, the proposed command, the rollback, and the snapshot ID. Approve once, approve all-of-type, defer, or deny. Approval is signed and recorded in the audit chain.
FORGE snapshots the current configuration (or makes a soft-delete-recoverable change), executes the command, re-runs the detector to confirm the finding is gone. If verification fails, FORGE rolls back automatically.
PHOENIX watches for cascade failures (a fixed NSG cuts a service, a tightened IAM policy breaks a workload). Detects within 60 seconds, rolls the change back, surfaces an incident on CONDUIT.
CONDUIT maps each finding to the destination's schema (Incident table, Jira issue, Splunk HEC event, Datadog log) with severity routing, assignment-group inference, and reassignment-watcher learning.
Every scan, every finding, every consent decision, every fix, every approval is appended to a SHA-256 hash chain. Any modification breaks every downstream hash. Satisfies HIPAA 164.312(b), PCI DSS req 10.5, SOC 2 CC7.2 on day one.
Cloud posture management across Azure. Iterates 50+ resource types: VMs, SQL, storage, IAM, networking, Kubernetes, containers, serverless, secrets, certificates, log analytics. Builds the asset graph the rest of the platform uses.
SCOUT → CONDUIT → SIEM; asset graph feeds SENTINEL, FORGE, COMPLYReader + Security Reader on AzureRuntime threat detection plus continuous pen-testing patterns. Walks the SCOUT asset graph and probes for live exploits: open management ports, public storage, unauthenticated APIs, misconfigured load balancers, unpatched workloads. Read-only by default, never destructive.
SENTINEL → FORGE for optional remediation (opt-in) candidates; SENTINEL → CONDUIT → SIEMExecutes the actual fix. Snapshots the current configuration (or uses soft-delete-recoverable changes), runs the exact az / Terraform command, re-runs the detector to verify, rolls back on verification fail. Every write requires per-finding consent; trial / audit-only licenses cannot reach FORGE.
REASON → consent gate → FORGE → PHOENIX → CONDUITDetects unsanctioned AI tools (ChatGPT, Claude, Gemini, Copilot, 130+ shadow AI services), audits machine identities (service principals, managed identities, OAuth apps, IAM users without humans behind them), scores license waste. Runs against egress logs and identity directories.
247 controls cross-mapped across CIS, SOC 2, ISO 27001, HIPAA, HITRUST, PCI-DSS, NIST 800-53, FedRAMP, CMMC. Reads the SCOUT asset graph plus FORGE history, evaluates each control on every scan, emits framework-by-framework readiness percentages.
COMPLY → AUDIT for evidence collection; COMPLY → CONDUIT for drift alertsAuto-collects the actual evidence auditors ask for: permission cards, security logs, admin groups, metrics screenshots, NSG rules, encryption status, key-rotation evidence. Outputs PDF + DOCX evidence packages per control. Sold standalone for teams that want only evidence, not the cloud-security suite.
COMPLY → AUDIT → evidence pack on disk → optional CONDUIT push to your GRC platformTCPA consent-lifecycle tracking, CPNI auditing for carriers and CLECs, STIR / SHAKEN attestation verification, revenue-leakage detection, churn prediction, FCC filing automation. Built for outbound dialers and US carriers facing six-figure-per-day CPNI penalty exposure.
Stops PHI / PII / PCI / source-code from leaking into ChatGPT, Claude, Gemini, Copilot. Browser-free passive monitoring, redact-and-forward policy mode, prompt-injection defense, vendor-breach intake. V195 Portal + Vendor Risk Pack adds reverse-ETL egress and Tableau workbook audit.
Continuous Snowflake and Databricks audit. Unity Catalog grants, cluster policy enforcement, row + column-level access review, workspace permission drift, masking-policy coverage, external stages, bulk-export QUERY_HISTORY. 13 detectors including continuous Unity Catalog drift sweep.
Azure Data Factory pipeline security, Azure Synapse audit, managed Airflow (Composer) monitoring. Credential-in-pipeline detection, sensitive-data-in-logs scanning, auto-fix for 40+ pipeline misconfigs.
Firewall-rule audit (Azure NSG), certificate posture (expiry, weak ciphers, missing SAN), DNS hygiene (dangling CNAME, lame delegations), GPO drift, service-account sprawl, secrets in unexpected places. 140+ checks across the network and identity surface.
ML-powered member risk scoring for healthcare payers and hospital systems. Predicts which members need intervention before crisis. Reduces ER visits and improves outcomes by routing high-risk members to care managers earlier.
AI call summarisation, QA scoring, sentiment analysis, compliance-flag detection. Every member call is analysed for quality and HIPAA compliance automatically. Replaces manual call-listening QA programs.
Outreach optimisation. Finds the right message, right time, right channel for every member. AI-driven A/B testing and segment strategy. Consumes ENGAGE risk scores and tunes outreach cadence.
Predicts costly health events. ER visits, hospitalisations, readmissions. Identifies high-risk members and calculates ROI of early intervention. Feeds into care-management prioritisation.
The kernel. Reads the signed license token, exports the entitled agent list, refuses to spawn any agent not on the list. Also handles auto-deploy: fetches the right binary version, verifies the SLSA 3 signature, runs install or upgrade, rolls back on failure.
Watches for cascade failures triggered by a FORGE write. A tightened NSG cuts a service. A stricter IAM policy breaks a workload. A rotated key leaves a stale-cache. PHOENIX detects within 60 seconds, rolls the change back, surfaces an incident on CONDUIT.
Continuous DR posture: backup currency, cross-region replication health, runbook freshness, RTO / RPO drift, secondary-region scan parity. Quarterly tabletop drill output captured as audit artifact (drill log, failover trace, recovery-objective comparison).
The output layer. Routes correctly-classified alerts and tickets to Jira, Datadog, PagerDuty, Slack, Teams, BMC Remedy, Freshservice, Zendesk, Splunk HEC, or any generic REST webhook. Field-level mapping per platform, severity routing, assignment-group inference. CONDUIT learns from 90 days of closed tickets and online-corrects routing on human reassignments.
Connects to GitHub, Azure DevOps, GitLab, Bitbucket, AWS CodeCommit / CodePipeline and GCP Cloud Source Repos / Cloud Build from a pasted URL, reads every pipeline definition and every file, finds secrets (22 credential patterns, entropy, committed key files, git remote credentials), PHI (9 HIPAA identifiers) and pipeline / IaC weaknesses, fixes the reversible ones (INC) on a branch, prepares the rest (CHG) with a suggested patch, re-scans to prove the result, and writes HTML, JSON, DOCX and PDF. PIPEFIX page →
Builds any dashboard a client asks for from one plain-English sentence: which resources, clouds, environments and frameworks, how to sort, whether to show cost. Reads a TITAN scan, any CSV / JSON export, or a live read-only inventory of Azure, AWS and GCP, and returns one self-contained page in the TITAN theme.
Point it at any source (CSV, JSON, Parquet, Excel, SQLite, any SQL database, REST endpoint, whole folders) and it runs the full loop by itself: profiles every column, classifies PII / PHI before a byte lands, plans the target schema and masking policy (Claude refines, a validator keeps it honest), generates the Airflow DAG + Delta DDL + dbt tests, loads to Parquet / SQLite / Databricks, reconciles counts, proves masking on read-back, and self-heals bad type guesses with quarantined rejects instead of silent drops. Deterministic core finishes with the network cut. Details
Every card below is a real module in the agent folder with its own detectors, learning state and evidence output. Numbers continue from the cards above; the total is 41.
Protects your own AI agents: what they may call, what they may read, and a record of everything they did. Closes the 9 enterprise AI-agent risk categories that no other agent fully covers: prompt injection, browser automation risk, autonomous execution risk, tool/MCP supply chain, settings-injection RCE, agent audit-log gaps. Details
Tracks every Business Associate Agreement and the evidence behind it. Audits BAAs for required HIPAA clauses, expiry, vendor-coverage gaps, subcontractor chain, and reassessment cadence. Mirrors the 9 required clauses of 164.504(e)(2). Details
Connects to your CRM (Salesforce) and checks profiles, sharing rules, connected apps and guest access, with the exact setting to change for each gap. Connects to a CRM platform via REST API and runs read-only detection queries against org configuration, profiles, permission sets, sharing rules, and metadata. Emits findings in the same JSON shape as databricks_lattice / Details
Connects to your EHR through its FHIR interface and checks authentication, scopes, audit and data exposure, with the exact configuration change for each gap. Connects to EHR platforms (Epic, Cerner, Meditech) via FHIR R4 APIs and runs read-only detection queries against FHIR resources, SMART-on-FHIR configuration, and EHR security posture. Emits findings in the standard TITAN JSON shape with Details
Connects to your ERP and checks privileged profiles, default passwords and separation of duties, with the exact transaction and step to fix each one. Connects to an SAP NetWeaver or S/4HANA system via OData and REST APIs and runs read-only detection queries against user management, RFC destinations, gateway security, transport configuration, audit logging, and password policy. Emits Details
CMMC 2.0 Level 2 readiness scored the DoD way: 110 requirements, read-only tenant checks, SPRS score, POA&M and SSP outline. Plus FedRAMP and NIST 800-53 / 800-171 gap evidence. Maps cloud and on-prem state to FedRAMP Moderate/High and CMMC L2/L3 control requirements. Identifies gaps before assessment. Dual-mode (online with LLM context / airlock with full deterministic). Details
Connects to your financial system and proves the controls SOX auditors ask about: responsibilities, segregation of duties, audit trails, with the exact fix for each gap. Connects to financial ERP systems (Oracle EBS, NetSuite, PeopleSoft) via REST API and runs read-only detection queries against configuration, user management, and security posture. Emits findings in the same JSON shape as databricks_lattice Details
Connects to your HR system and finds payroll, integration-user and access gaps, with the exact security policy change for each one. Connects to HCM platforms (Workday, SuccessFactors, ADP) via REST API and query languages and runs read-only detection queries against tenant configuration, security groups, domain security policies, integration system users, and Details
Continuously proves the HIPAA Security Rule is being met, with the paperwork to show it. Targets HIPAA Privacy Rule (164.500-534), Security Rule (164.302-318), and Breach Notification Rule (164.400-414). Detects PHI exposure, audit-log gaps, BAA gaps, training-currency gaps, termination access removal, breach-notification timing. Details
Audits vendor portals and reverse data flows for what is leaving your estate. Audits vendor portals and reverse data flows for what is leaving your estate.
Eighteen checks for patient data in places it should not be, that ordinary cloud scanners never run. Healthcare-specific PHI exposure detection across applications, databases, URLs, logs, error messages, support sessions, and ML pipelines. Critical for HIPAA-covered entities and business associates. Details
Finds patient data hiding in storage, logs and test environments. The healthcare tier historically relied on catalog agents (phi, hipaa, baa, ...) that only fire when handed a pre-computed `triggered_detector_ids` list - nothing in the live Azure pipeline populated those for healthcare, so a real scan emitted
Counts every resource you pay for, spots the idle ones, and puts a dollar figure on the waste. Auto-discovers every resource in the connected Azure environment and produces a real-time inventory dashboard with resource counts by type, idle/active classification, and estimated cost savings for cleanup. Details
Checks the application code itself for the mistakes that turn into breaches. Scans source repos and running apps for OWASP Top 10, hard-coded secrets, vulnerable dependencies, weak crypto, and CI/CD security gaps. 1. Hard-coded secret in source (AWS / Azure / generic)
Watches for settings that drift away from the approved state and raises the flag before an auditor does. Monitors configuration drift, control effectiveness, KPI degradation, and anomalous deviation from approved baselines. 1. Config drift on critical resource
EXFILTRATION: capability of CONDUIT / SENTINEL; SCANNER: capability of SENTINEL / BASTION; REASON: free planning layer, bundled; LEGACY: coverage mode; CERTIFY: COMPLY HITRUST export; RESOLVE: front end over FORGE. We keep them documented so a buyer can tell an agent from a capability from a packaging label.
Watches outbound flows for anomalous data egress: bulk download to personal webmail, unusual S3 PUT to non-corporate buckets, data-warehouse query then export-to-CSV pattern, USB / clipboard signals from endpoint hooks, cloud-to-cloud sync to non-sanctioned destinations.
Lightweight intrusion-detection heuristics for cloud-native workloads. Hooks into VPC flow logs, Application Gateway / ALB logs, and WAF events. Pattern-matches against known attack signatures (SQLi, XSS, command injection, path traversal, recon scans). Surfaces alerts via CONDUIT.
Before any FORGE write, REASON generates three candidate fixes, scores each on blast radius, rollback ease, and side-effect risk, and presents the highest-scored one at the consent gate. The other candidates are visible to the operator on request. Off in AIRLOCK mode.
Coverage for end-of-life systems you cannot retire. Windows Server 2012 / 2008, RHEL 6, Java 8 estates, vendor appliances at EoL. Compensating-control evaluation, network-isolation posture, ESU / ELS lifecycle tracking, and per-system risk write-up auditors accept.
The HITRUST module. Builds your exact e1 / i1 / r2 requirement set from the scoping profile, auto-collects the proving Azure artifact for each technical requirement (Entra ID, RBAC, NSG, Key Vault, Defender, encryption, audit-log state), assigns and chases owners on human-process controls, and exports a MyCSF-ready workbook plus per-requirement PDF / DOCX packs for the external assessor.
The agent your team talks to. Answers plain-language questions about any finding or incident from live tenant state, proposes the fix with a blast-radius preview, and — only after explicit approval — applies it through the consent-gated execution engine: configuration snapshot first, re-run the detector after, automatic rollback if verification fails. Covers Azure infrastructure and the application layer (App Service, Functions, AKS configuration).
Assesses a live estate against all 46 Key Security Indicators of FedRAMP's Consolidated Rules for 2026 and emits a Security Decision Record in FedRAMP's own JSON schema. Fourteen indicators are machine-verified from real API readings; the rest return NOT ASSESSED with the reason, because training records and exercise reports are not visible in cloud configuration and inferring them would be fabrication.
FEDRAMP KSI → CONDUIT → GRC; shares the estate graph with SCOUTReader onlyScores all 110 NIST SP 800-171 requirements against a live tenant using the DoD Assessment Methodology. Sixty-five are checked automatically; the remaining forty-five are marked Examine or Interview rather than guessed, and the automated, attested and floor scores are reported separately.
Every resource, every environment, every dollar. Azure, AWS and Google Cloud in one table, priced from the providers' own published rate APIs rather than a lookup table typed in eighteen months ago.
Reader + Cost Management ReaderConnect, detect and brief the room in one command. Takes whatever credentials are already on the machine, finds every subscription, account and project they can see, and produces the briefing before the call ends.
Drift detection says a thing is different. That is not enough to act on at three in the morning. FORENSICS answers who did it, when, from where, and whether that is why the application is down.
Reader + activity log readEvery vendor ships auto-remediation backed by a hand-maintained allow-list somebody wrote months ago. AUTONOMIC derives safety from the live estate instead: it proves the blast radius of a fix before running it, and refuses anything it cannot prove.
Finding → AUTONOMIC → verified fix; shares the safety gate with FORGEA client says in one sentence what they need watched. GENESIS turns that sentence into a real, running, licensed TITAN agent on the call, while they are still talking.
Connects to a Snowflake account read-only and audits the warehouse the way the data team actually uses it: roles and grants, network policies, masking, replication, and the spend attached to each.
Read-only scan against your own cloud, all entitled agents, full evidence pack on every finding.