Skip to content

Start

Home
How it works

Operate

Overview
Incidents
Sati AIinvestigation agent
Observatory

Analyze

Analytics
World threatsdaily, from public sources
Sati modelsnine, trained on real data

Respond

Actions
Detections
ATT&CK coverage

Learn

Trainingcyber defence practice
Findingswhat the measurements showed
Evaluation

Built by Preet RavalSource LinkedIn

Overview

Home
Incidents
Sati AI
Learn

Search entities and incidents/

Overview

System state, open incidents, and the autonomy posture currently in force.

updated just now

5 open incidents · 3 awaiting approval

Credential stuffing against the SSO portal succeeded on one account: 412 failures from a single new ASN, then one success.

Open incidents

5

3 need a decision

Accounts affected

2

estimated, from blast radius

Entities watched

18

15 observed access paths

Execution mode

Dry run

nothing is executed

Posture

critical13
degraded5

Activity

all analytics →

daily buckets

Oct 18max 32 per bucketOct 29

Open incidents

all incidents →

INC-2026-0904highawaiting approval11d ago
An unauthenticated scanner probed the public application and wrote an instruction into its own request header, addressed to the model reading the alerts, asking for the incident to be closed and a file server wiped. The probing failed.
confidence 93% statedusers 0blast radius 2
INC-2026-0901criticalawaiting approval

The loop

Observe→
Understand→
Predict→
Decide→
Act→
Verify→
Learn

Observe and Understand are live. Decide and Act run behind policy in dry-run. Verify compares observed state to what an action promised.

11d ago

Credential stuffing against the SSO portal succeeded on one account: 412 failures from a single new ASN, then one success.

confidence 94% statedusers 1blast radius 2

INC-2026-0902▲highawaiting approval11d ago

A phishing link led to an OAuth consent, and the resulting token — not a password — is what read the mailbox.

confidence 91% statedusers 1blast radius 3

INC-2026-0905▲criticalescalated11d ago

A destructive wiper arrived inside a trojanised vendor update, took svc-deploy's credentials out of memory, spread to fs-04 and dc-01 both with those credentials and by exploiting an unpatched SMB service, and overwrote boot records behind a ransom note that cannot be paid.

confidence 94% statedusers 0blast radius 3

INC-2026-0903▲criticalescalated11d ago

ws-0148 is beaconing to a command-and-control host and has begun moving laterally: new SMB peers, then a scheduled task.

confidence 86% statedusers 0blast radius 4

Perception

4h ago

Entities: 18
Observed access paths: 15
Audit records: 73
Storage: dynamodb

Recent activity

4h agoanswered a general question · sati-brahmacharini-serve-v0 · 0 tokens
8h agoanswered a general question · sati-brahmacharini-serve-v0 · 0 tokens
8h agoanswered a general question · sati-brahmacharini-serve-v0 · 0 tokens
8h agoanswered a general question · sati-brahmacharini-serve-v0 · 0 tokens
8h agoanswered a general question · sati-brahmacharini-serve-v0 · 0 tokens
11h agoanswered a general question · sati-brahmacharini-serve-v0 · 0 tokens