Platform Features

CISO Command Center New

One synthesis home for the whole program: unified posture score, ranked next actions across every surface, 30-day trend sparkline, per-module drill-downs, and a board-ready PDF summary.

Morning Brief New

A daily, auto-generated stand-up: what changed overnight across incidents, KEV additions, detections, and deadlines — before your first coffee.

Threat Digest New

Periodic org-specific digest correlating your reports and exposure against fresh external intelligence.

On-Call Brief New

Handoff-ready situational summary for the incoming on-call: open incidents, live obligations, and what to watch.

Incident Manager + Regulatory Engine New

Declare an incident and Felswerk auto-evaluates which notification laws apply (GDPR, SEC 8-K, HIPAA, state AGs, and more), computes each deadline, and starts the clock.

Regulatory Countdown Pill New

A live header countdown on every page showing the tightest regulatory clock — green, amber, or pulsing red as deadlines approach.

Live Incident War Room New

A single working surface per incident: timeline, tasks, evidence, obligations, and comms in one place while the incident is hot.

Breach Comms Drafting New

AI-drafted regulator and customer notifications from templates keyed to each regulation — reviewed, versioned, and delivery-tracked.

Post-Mortem Generator New

Structured after-action reports composed from the incident record: timeline, root cause, action items, and lessons.

Decision Journal New

Sign off risk decisions with owners, rationale, and expiry — the audit trail regulators and boards ask for. Waiving an obligation requires a signed-off decision.

Budget Memo Composer New

Turn a security ask into a finance-grade memo: Monte-Carlo loss modeling, risk-reduction assumptions, peer-spend comparison, and linked findings as evidence.

Meeting Prep Packs New

Paste an agenda, get a briefing pack tuned to the audience — board, exec team, finance, audit committee, or regulator.

Security Program Maturity New

Continuous maturity scoring across program dimensions, computed from what you actually do in the platform — not a self-assessment survey.

Security Roadmap Sequencer New

Orders your backlog of security work by risk reduction per unit effort, with dependency-aware sequencing.

Peer CISO Benchmark New

How your posture, coverage, and velocity compare to anonymized peers in your industry and size cohort.

Cyber Insurance Gap Analyzer New

Maps your evidenced posture against common policy warranties and exclusions — know your coverage gaps before renewal (or a claim).

M&A Due Diligence New

Rapid security due-diligence memos for acquisition targets, exportable as Markdown or PDF.

Policy Drift Detector New

Paste (or upload) a security policy and Felswerk flags where written policy has drifted from observed practice in your data.

Analyst Skill-Gap Analysis New

Identifies the technique and tooling areas where your team's demonstrated coverage is thinnest, with a training plan.

Detection Engineering Advisor New

Paste findings or pick techniques and get a prioritized detection plan: what to detect first, which rules to deploy, and per-verdict evidence.

Alert Triage Intelligence New

Point your SIEM at a signed webhook and Felswerk re-prioritizes alerts against your real exposure — org CVEs, observed techniques, adversary interest — with analyst-feedback learning.

Detection Stack Translation Core

Declare your stack (Splunk, Sentinel, Elastic, CrowdStrike, 30+ platforms) and every Sigma rule and detection recommendation is translated to your query language.

Detection Rule Validation

Scheduled validation tasks track which deployed rules have actually been tested — unvalidated detections feed the Defensive Debt score.

Collective Intelligence New

Anonymized cross-tenant signal sharing: see which techniques and CVEs are trending across the Felswerk fleet. Privacy-first with easy opt-out.

Vulnerability Manager New

Full lifecycle tracking with SLA clocks, KEV-aware due dates (BOD 22-01), breach lists, MTTR, and per-vulnerability detail pages.

Scanner Imports Core

Ingest Burp XML, Nessus CSV, and Qualys XML directly — findings are indexed, scored, and joined to the same analytics as report uploads.

KEV Intelligence Suite Enhanced

KEV burndown, remediation velocity, vendor concentration, ransomware exposure, detection heatmap, a next-KEV predictor, and per-CVE adversary emulation plans.

Newly-KEV'd Alerts Enhanced

When CISA adds a CVE that appears in your reports, affected findings are flagged and the right people are notified automatically.

Threat Intelligence Feeds Core

Real-time CISA KEV + 10+ sources. Automatic IOC enrichment and campaign attribution.

APT Playbook Library 290+ Groups

Match reports to known APT groups. Generate targeted campaigns from MITRE + GapMATRIX.

Advanced Threat Intel Enhanced

Dark web monitoring, peer benchmarking, threat actor timelines, campaign correlation.

Ransomware Readiness v2 Enhanced

55 techniques, 11 kill chain phases. 20 real-world group profiles (LockBit, BlackCat, Cl0p, Akira).

RaaS Ecosystem Mapping Enhanced

RaaS vs independent groups. Fastest encryptors, highest ransoms among matched groups.

GapMATRIX Integration Core

290+ actors, 300+ CVE mappings, weekly sync. 74+ ransomware groups.

Global Threat Heatmap Enhanced

Technique frequency across all 290+ actors. Full MITRE ATT&CK matrix by tactic.

CVE-Actor Correlations Enhanced

Which actors exploit which CVEs — and vice versa. 300+ documented relationships.

Technique Maturity Index (TMI)

Per-technique 0-100 readiness score across 6 dimensions: Detection, Compliance, Testing, Remediation, Intelligence, Assessment.

Compliance Blast Radius

Cross-framework regulatory impact — shows which controls are violated per technique with estimated penalties.

Defensive Debt Score

Compound risk metric from overdue tasks, unvalidated detections, recurring techniques, and compliance gaps.

Entity Persistence Map

Cross-report infrastructure graph revealing repeatedly targeted assets and chronic compromises.

Technique Dependency Graph

Causal DAG showing attack supply chains — which techniques enable which.

Attacker ROI Calculator

Adversary economic modeling — effort, cost, success probability, and potential payout per attack path.

Kill Chain Velocity Tracker

How quickly attackers progress through kill chain phases. Detects acceleration or deceleration across reports.

Threat Actor Convergence Warnings

Detects when multiple unrelated threat actors show simultaneous interest in the same techniques or CVEs.

Adversary Adaptation Predictor

Game-theoretic forecast of how adversaries will shift tactics based on your defensive improvements.

Industry Threat Weather Map

Anonymized peer data showing active, intensifying, or declining threats across your sector.

Finding Correlation Fingerprints

Root-cause clustering via CWE/OWASP similarity — group reports by underlying security problems.

Automated Threat Briefings

Personalized weekly intelligence digests with urgency signals and prioritized action items.

Shadow IT Discovery Engine

Unmanaged infrastructure detected by mining entity graphs from offensive reports.

Predictive Compliance Drift

Detects where emerging threats are concentrating in areas of weak compliance coverage.

NL Remediation Orchestrator

Natural language commands trigger multi-step remediation workflows with full audit logging.

LOLDrivers Integration

Complete catalog of vulnerable and malicious kernel drivers with hashes, CVEs, and publisher metadata. Cross-referenced during report analysis.

DeTT&CT Visibility Mapping

Technique-to-data-source visibility map. Know exactly which telemetry covers which ATT&CK techniques.

Elastic Detection Rules

1,000+ open-source detection rules parsed with MITRE technique mappings, severity, and risk scores.

ATT&CK for ICS

Full ICS/OT threat matrix — brings industrial control system techniques into all existing analytics.

RE&CT Framework

45+ incident response actions mapped to ATT&CK techniques across 6 response stages.

MITRE ATLAS

40+ AI/ML adversarial techniques including prompt injection, model poisoning, and LLM jailbreaks.

VERIS-ATT&CK Mappings

Real-world incident classification patterns mapped to ATT&CK for compliance and benchmarking.

OSSEM Event Metadata

40+ security event sources across Windows, Linux, and Cloud with ATT&CK technique coverage.

OpenSSF Scorecard

Supply chain security scores for 20+ critical OSS packages. Tracks code review, maintenance, and vulnerabilities.

MITRE Engage

26+ adversary engagement activities for deception, denial, and disruption mapped to ATT&CK techniques.

Report Analysis Core

Upload pentesting or red team reports. AI maps to MITRE ATT&CK, STRIDE, DREAD, CIS, NIST.

Purple Team Exercises Enhanced

Track execution vs detection. Automated scoring and gap identification.

Adversary Emulation Plans Enhanced

Generate from APT groups or import MITRE Navigator layers. Full technique enrichment.

Campaign Tracking Enhanced

Group reports into campaigns. Compare over time, track remediation progress.

Blast Radius & Dwell Time

Lateral movement reach. Dwell time from Mandiant M-Trends and Sophos research.

Data Exfiltration Analysis

Map exfil pathways. Detect double/triple extortion risk patterns.

Ransomware Exercise Templates 8 Templates

Step-by-step purple team exercises with tool recommendations.

Ask the Corpus Enhanced

Ask in plain English across everything you've uploaded. RAG-powered answers with inline citations and deep links back to the source.

Investigation Copilot New

Guided investigation sessions: the copilot proposes hypotheses, pulls the relevant evidence from your corpus, and keeps a case log.

Peer Review Simulator New

Adversarial AI review of your report drafts and findings — catches weak evidence, missing impact, and unclear reproduction steps before a client does.

Predictive Threat Modeling Enhanced

Forecast attack patterns. Technique trends, APT targeting, risk trajectory, and what-if scenario simulation against specific APT groups.

AI Remediation Suggestions

Code snippets, config changes, detection rules for every finding.

What-If Simulator

Model control changes. See Rhino Score impact instantly.

CISO Dashboard Enhanced

Executive KPIs, ransomware intelligence, financial exposure, regulatory impact.

Security Trends Core

Rhino Score, detection coverage, remediation velocity. Technique drift and co-occurrence.

Security Insights Core

Risk attribution, compliance mapping, CVE dedup, detection gaps, confidence calibration.

Financial Impact Analysis

Ransomware exposure from IBM CODB and Coveware. Industry multipliers.

Regulatory Impact Mapping

8 frameworks: HIPAA, PCI-DSS, GDPR, SEC, FISMA, NERC CIP, NYDFS, CCPA.

Reports & Exports Core

PDF, Excel, CSV, JSON, STIX, MITRE Navigator, Attack Flow. Jira integration.

Critical Findings Alerts Enhanced

Compound-evidence email alerts. 6 signal types (CISA KEV, detection blind spots, DREAD, ransomware, LOLDrivers, APT). Only fires when 2+ signals converge.

Report Completion Emails Core

Automatic SendGrid notification with Rhino Score and direct link when processing finishes.

Scheduled Reports

Daily, weekly, or monthly. Email delivery.

Custom Dashboards

Configurable widgets: Rhino Score, coverage, techniques, heatmaps.

Integrations Core

Slack, Teams, PagerDuty, GitHub, Splunk, Elasticsearch. Real-time alerts and SIEM export.

Technique Explorer Core

Full MITRE ATT&CK catalog. Which 290+ actors use each technique.

Finding Libraries

Organization-wide reusable finding database. Templates and usage tracking.

Admin & Enterprise Core

SSO/SAML, custom frameworks, AI config, data retention, multi-region.

Audit Logs

Full audit trail. Filter, search, export for compliance.

API Usage & Rate Limits Core

Monitor request counts, endpoint utilization, rate limit consumption.

Terms of Use Active

Clear terms covering data ownership, acceptable use, AI processing, and service availability.

Privacy Policy Active

Transparent data collection, AES-256 encryption at rest, TLS 1.3 in transit, no data selling, no AI training on your data.

Contact & Support Active

Direct founder access, dedicated support form, and real-time response.

Dedicated Support & Expertise

Hands-on support from a security practitioner who built it. Direct founder access, real-time updates, guidance tailored to your maturity.

Continuous Evolution Always On

Weekly syncs from MITRE, GapMATRIX, CISA KEV. Features ship on threat trends — not quarterly cycles.

Enterprise Value, Startup Price

Full-stack threat analysis platform rivaling $50K–$200K/year platforms. 60–95% API savings via smart caching.