Fintra Trust feature
Three findings, or one attack path?
AegisGraph, Attack Path
Example figures- PATTERNS
- 10 named
- toxic combinations
- RISK FLOOR
- ≥ 80
- confirmed combo
- MODE
- graph-at-ingest
- deterministic
- Contractor (J. Rivera)
- actor
- ↳ OAuth app · excessive scope
- edge
- ↳ SaaS export, then PII data class
- target
- toxic_data_exfiltration_path
- risk floor 80
- response
- human_review_required
Graph truth before the LLM reasons
AegisGraph compiles a deterministic “graph truth statement” about an action (its actor, its scopes, the data classes it touches, its blast radius) before any language model reasons about it. It matches that against ten named toxic-combination patterns (agent runtime breakout, OAuth-to-sensitive-data, data-exfiltration path, and more). A confirmed combination isn’t a soft score: it forces a hard risk floor of 80, so a cross-domain attack path can’t be reasoned away.
Questions people ask
What is a toxic combination?
It is a set of individually-benign conditions that together form an attack path, for example a contractor, an over-scoped OAuth app, and access to a sensitive data class. AegisGraph names the combination and scores it as one path, not three findings.
What does the risk floor do?
A confirmed toxic combination forces a hard minimum risk of 80, so a genuine cross-domain attack path can’t be diluted to a low score by a single-signal model.
How is this different from a SIEM?
A single-signal SIEM sees the three findings separately. AegisGraph compiles a graph-truth statement across identity, cloud, SaaS, and data classes and matches named attack-path patterns before deciding.
Does it block attacks?
It decides and exports evidence in simulation mode: a decision fabric your systems consult. It does not itself actuate production containment.
Keep reading
Calculators
One finance briefing a week
New guides, checklists and benchmarks, by email. Unsubscribe from any issue.
See it decide on your own data
Book a walkthrough and watch the AI make, and prove, a real decision.