Internal test server, no sensitive data, strong segmentation, no observed exploitation.
POLOXI SECURITY INVESTIGATION & RESPONSE INTELLIGENCE
A model-agnostic reasoning engine for security investigation, threat analysis, and explainable response.
Security operations begin with uncertainty: something suspicious happened, multiple explanations are possible, evidence is scattered across systems, and additional investigation may be required before reaching a defensible conclusion.
POLOXI does not replace the SIEM, EDR, SOAR, firewall, IAM platform, or analyst. It becomes the governed reasoning and investigation layer above them.
Persistent investigationEvidence groundedThreat awarePolicy governedAuditable
10Security capabilities
24×7Investigation readiness
HITLGoverned response
01Reasoning core
From event to explainable assessment and governed action.
SECURITY EVENT → Generate competing explanations
↓
Determine required evidence → Query security systems
↓
Evaluate evidence → Apply security constraints
↓
Reweight / eliminate hypotheses
↓
Evidence missing? YES → Investigate further ↺
NO → Converge
↓
Explainable assessment → Recommended response
↓
Human / authorized automated actionSOC TRIAGE
Intelligent Security Alert Triage
Impossible travel: jsmith@company.com logged in from Los Angeles at 09:07 and Romania at 09:22.
A traditional rule may immediately label this a high-risk compromise. POLOXI investigates alternative explanations first.
H1 → Account compromised H2 → Corporate VPN H3 → Cloud proxy H4 → Mobile routing H5 → Security testing H6 → False geolocation Evidence plan: Authentication logs · Device IDs · MFA · IP reputation VPN logs · Endpoint telemetry · Session tokens Travel history · Provider · Prior logins · Privileged access Evidence found: Los Angeles → Known corporate laptop Romania → Different unmanaged device Romania IP → Known malicious infrastructure MFA → Three failures followed by success Session → New browser fingerprint Account compromise 0.93 ↑ Corporate VPN 0.04 ↓ Cloud proxy 0.07 ↓ Mobile routing 0.03 ↓
SECURITY ASSESSMENT · CRITICALProbable account compromise
Supported by an unseen device, malicious IP reputation, repeated MFA failures, a new browser fingerprint, and no corporate VPN association.
Response: Revoke sessions, temporarily disable the account, reset credentials, review MFA registration, and investigate post-authentication activity.
INCIDENT INVESTIGATION
Security Incident Root-Cause Investigation
“Why is a database server sending unusual outbound traffic?”
H1 Malware · H2 Compromised service account H3 Authorized backup · H4 Misconfiguration H5 Insider activity · H6 Data exfiltration H7 Vulnerability exploitation Database + EDR + Firewall + Network flow + IAM + Application logs + Change records + Threat intelligence First evaluation: Malware .42 Service account .68 Backup .26 Misconfiguration .31 Insider .14 Exfiltration .62 Exploit .48 Highest-value next evidence: Login history · Credential rotation · Process lineage Vulnerability results · Inbound history · Commands New evidence: Service account authenticated from unusual host PowerShell launched by application service Credential not rotated for 426 days No relevant exploit observed Outbound destination is known command-and-control Service account .94 Exfiltration .86 Malware .79 Exploit .19
ROOT-CAUSE ASSESSMENTProbable service-account compromise
Evidence supports malicious execution and outbound transfer activity. Initial access, persistence, credential access, and exfiltration remain separately tracked investigation stages.
IDENTITY SECURITY
Account Takeover Intelligence
One employee account logs in at 2:14 AM, downloads 700 customer records, creates an API key, changes an email-forwarding rule, and later connects from another country. Five independent alerts may represent one compromise.
H1 Normal activity · H2 Account takeover H3 Malicious insider · H4 Authorized automation H5 Compromised OAuth application Authentication → Mailbox rule → API credential → Bulk download → External login Evidence: Schedule · Historical behavior · Device telemetry · MFA OAuth permissions · API and email logs · IP reputation · HR status
Initial access→Persistence→Credential creation→Collection→Possible exposure
POLOXI converts disconnected events into a coherent, evidence-backed attack narrative.
CAREFUL GOVERNANCE
Insider-Risk Investigation
Unusual employee behavior does not automatically establish malicious intent. POLOXI explicitly separates technical evidence from conclusions about a person.
H1 Normal job activity · H2 Legitimate handoff H3 Authorized backup · H4 Accidental bulk download H5 Unauthorized collection · H6 Deliberate exfiltration Evidence: Files and sensitivity · Responsibilities · Normal baseline Device · USB · Cloud uploads · Attachments Manager instructions · Approved projects · Destinations 2,150 files downloaded 1,730 directly related to responsibilities 420 outside the employee's normal department 115 confidential strategic documents External USB connected shortly afterward 93 of the 115 files confirmed copied
POTENTIAL INSIDER-RISK EVENTUnauthorized collection requires investigation
Evidence supports access outside normal scope, confidential material, external media usage, and confirmed copying.
Important: Intent cannot be established from technical evidence alone.
Response: Security, HR, and Legal review.
THREAT PROGRESSION
Malware & Ransomware Investigation Intelligence
Initial endpoint → Entry point → Credential compromise → Lateral movement → Privilege escalation → Data access → Encryption → Potential exfiltration H1 Isolated infection · H2 Active ransomware operation H3 Authorized security test · H4 False positive H5 Broader enterprise compromise Evidence: EDR · Identity · SMB · RDP · PowerShell · Event logs Cloud authentication · Firewall · DNS · Backups · Threat intel Endpoint A infected → Credential dumped → Admin used → 12 additional servers → Backup console authentication → Cloud storage upload → Encryption begins
INCIDENT CLASSIFICATION · CRITICALActive ransomware intrusion likely
Scope: At least 13 systems.
Evidence: Credential theft, lateral movement, backup-system targeting, and possible pre-encryption data staging.
POLOXI continues investigating what other systems the stolen credentials can access.
EMAIL & TRANSACTION SECURITY
Phishing & Business Email Compromise Intelligence
“Please urgently update our bank account before sending today's payment.”
H1 Legitimate vendor request · H2 Vendor mailbox compromised H3 Spoofed vendor · H4 Internal mailbox compromised H5 Normal account change Email + Vendor record + Communication history + Domain registration + Mailbox activity + Payment history + Established contacts Sender domain differs by one character Bank account is new Writing style differs No prior vendor notice Domain registered three days ago
PROBABLE PAYMENT FRAUD ATTEMPTVendor impersonation
Lookalike and recently registered domain, urgent bank change, no supporting vendor record, and inconsistent communication pattern.
Response: Do not process. Verify through a previously established contact method.
RISK PRIORITIZATION
Vulnerability Prioritization Intelligence
POLOXI prioritizes operational risk rather than relying on severity scores alone.
Internet-facing VPN, privileged authentication, active exploitation, critical remote-work dependency.
PATCH PRIORITY1. Vulnerability B · Critical risk
Internet accessible, part of authentication infrastructure, known exploitation, high-value access path, and limited compensating controls.
2. Vulnerability A · Moderate risk: Severe technically, but strongly isolated.
RELATIONSHIP INTELLIGENCE
Lateral Movement & Attack Path Intelligence
Compromised laptop
↓
User has Helpdesk role
↓
Can reset developer passwords and MFA
↓
Developer has CI/CD access
↓
Pipeline identity has production access
↓
Production secrets
Validate every transition:
Helpdesk reset permitted? YES
Developer MFA enforced? YES
Can MFA also be reset? YES
Developer has CI/CD access? YES
Pipeline reaches production? YES
HIGH-RISK ATTACK PATHEndpoint → Helpdesk → Developer → CI/CD → Production
Contain the specific privilege path rather than isolating the original endpoint alone.
CAPA INTELLIGENCE
Security Control Failure & Corrective Action Intelligence
Signals: ↑ MFA exceptions + ↑ risky sign-ins + ↑ helpdesk password resets + ↑ account-compromise incidents H1 Random increase · H2 Training issue H3 Helpdesk weakness · H4 MFA policy weakness H5 Identity configuration defect · H6 Targeted attack June 7: New MFA exception group created June 10: Helpdesk begins adding locked-out users July: Group grows from 8 to 213 users August: 70% of compromised users belong to the group
SYSTEMIC SECURITY CONTROL ISSUEMFA exception workflow expanded beyond intended use
Review membership, restore enforcement, require time-limited exceptions, add approval, and monitor exception volume.
INVESTIGATION & RESPONSE
Autonomous Investigation with Governed Response
SIEM alert: Suspicious administrator login.
Objective: Determine whether the privileged account is compromised and whether containment is required. H1 Legitimate admin · H2 Compromised credentials H3 Security test · H4 Malicious insider · H5 Automation Cycle 1: Login · Device · IP · MFA · Schedule Compromise confidence: 0.58 → insufficient Cycle 2: Commands · Systems · Privilege changes · Endpoint New global administrator created EDR disabled on server Credential vault queried Compromise confidence: 0.94 Policy: If privileged compromise confidence > 0.90 + confirmed sensitive-system access → Emergency containment authorized
The reasoning engine and action authority remain separated. POLOXI never treats “AI believes something happened” as unrestricted permission to act.
A reasoning layer above the existing security ecosystem.
SIEMEDR/XDRIAMDirectoryFirewallVPNDNSEmail SecurityCloudCASBDLPVulnerability ScannersThreat IntelligenceCMDBTicketingSOARApplication LogsDatabase AuditCI/CDSecrets
Security ecosystem → Governed evidence layer
↓
Logs + Threat intelligence + Business context
↓
POLOXI REASONING
Hypotheses + Evidence + Constraints
↓
Candidate competition → Confidence → Convergence
↓
SECURITY DECISION
Alert · Analyst review · Authorized SOAR action
POLOXI does not need to store every source. It needs governed access to the evidence required for each investigation.
Every investigation maintains structured state.
Investigation ├── Objective, scope, assets, users, initial alert ├── Hypotheses H1…Hn ├── Evidence E1…En ├── Constraints and confidence ├── Contradictions and evidence gaps ├── Investigation cycles ├── Recommended and executed actions └── Final disposition
This persistent state is a fundamental advantage over a stateless security chatbot.
Investigate before escalating.
Validate signatures, hashes, software inventory, deployment tools, change tickets, and administrator activity. Approved software deployments can be dispositioned as likely benign with a complete evidence trail.
Expand hypotheses as evidence appears.
Search for unusual service-account use, interactive logins, new hosts, privileged authentication, remote protocols, PowerShell, credential access, and unexpected process launches.
Turn analytics into priority decisions.
Investigate dormant privileged identities, MFA exemptions, legacy authentication, weak service accounts, unmanaged devices, stale credentials, and privilege accumulation.
From one login alert to systemic corrective action.
ONE UNUSUAL LOGIN
↓
New device + Malicious IP + MFA anomaly
↓
ACCOUNT COMPROMISE
↓
Mailbox rule + OAuth app + SharePoint download
↓
Possible collection → Outbound transfer
↓
DATA EXPOSURE
↓
Are other accounts affected? → 9 accounts
↓
What do they share? → 8 received same phishing message
↓
Why did controls fail?
↓
Legacy authentication + Conditional-access exception
↓
COMMON ATTACK VECTOR → CONTROL FAILURE
→ ROOT CAUSE → CORRECTIVE ACTION
Reasoning does not imply unrestricted action.
Read evidence → Reason → Recommend → Policy check → Authorization check → Human approval when required → Execute → Audit
POLOXI investigates and reasons across the security ecosystem.
SIEM detectsEDR observesSOAR executesThreat intelligence informsLLMs interpret
POLOXI Cybersecurity Intelligence is an evidence-grounded investigation and reasoning layer that connects security signals, tests competing explanations, identifies missing evidence, determines probable attack paths and root causes, and produces explainable recommendations or governed responses.POLOXI investigates and reasons across all of them.