30

Security Modules

37

Compliance Frameworks

90%

Faster Triage

100×

Larger Inputs

Architecture

Three layers. One unified engine.

Every security task flows through the same intelligent pipeline — from raw input to actionable intelligence in seconds.

Layer 1 — AI Engine

GraphRAG + RLM + Mixture-of-Experts

Core Intelligence

GraphRAG Knowledge Graph Recursive Language Model (RLM) Mixture-of-Experts (MoE) Payload & Malware Expert Compliance Auditor Threat Intel Analyst OSINT Investigator DevSecOps Expert

Prava Core

Core Intelligence

28 offensive and defensive security modules — web, network, cloud, AI/LLM, hardware, and more.

Satyam Intel

Dark Web Intelligence

Real-time OSINT and dark web monitoring — credential leaks, threat actor tracking, digital exposure scoring.

SACT

Compliance Automation

37 frameworks, 1,718+ controls — automated evidence collection, gap analysis, and audit readiness.

Layer 3 — VM Execution Layer

GCP ephemeral instances · Sandboxed Python REPL · Selenium browser automation · Tool calls

GCP e2-standard-4 Sandboxed Python REPL Selenium OSINT VirusTotal API Shodan / Censys CVE / NVD API gVisor Sandbox 120s Timeout

AI Engine

The intelligence behind every decision.

Three breakthrough AI technologies fused into a single inference pipeline — designed from the ground up for the scale and complexity of modern cybersecurity.

GraphRAG

Knowledge Graph Retrieval

A semantic knowledge graph built over CVEs, OWASP Top 10, MITRE ATT&CK, all 37 compliance standards, and live Satyam dark web feeds. Semantic chunking at 512 tokens feeds a FAISS/Pinecone/Qdrant vector store for sub-100ms retrieval.

Multi-hop graph traversal
512-token semantic chunking
FAISS · Pinecone · Qdrant vector stores
CVE, OWASP, MITRE ATT&CK coverage

RLM — Recursive Language Model

Infinite Context Architecture

Stores inputs as persistent Python variables in an external REPL — sidestepping context window limits to handle 100× larger inputs than standard LLMs. Recursive sub-problem decomposition mirrors real SOC analyst cognition, reducing MTTC by 90%.

100× larger input handling
90% reduction in MTTC
External Python REPL state
Sub-problem decomposition engine

Mixture-of-Experts (MoE)

5 Specialist Personas

Each token is routed to the most relevant specialist sub-model. Five expert personas cover every cybersecurity domain — ensuring maximum precision whether you're writing exploit payloads or preparing a SOC 2 audit trail.

Payload & Malware Expert

Compliance Auditor

Threat Intel Analyst

OSINT Investigator

Code & DevSecOps Expert

Data Flow

From input to intelligence in seconds.

Every security request traverses the same deterministic pipeline — ensuring reproducible, auditable results every time.

1

User / Trigger

Security scan request, scheduled assessment, SIEM alert, CI/CD webhook, or API call arrives at the Prava ingestion layer. Inputs can be URLs, code repos, cloud configurations, network ranges, or raw documents up to 100× standard LLM context.

2

RLM Orchestrator

The Recursive Language Model decomposes the task into sub-problems, stores inputs as Python variables in the external REPL, and plans the execution graph — determining which modules, knowledge sources, and tools to invoke.

3

GraphRAG Retrieval

The knowledge graph is queried via multi-hop graph traversal and FAISS vector similarity search — pulling relevant CVEs, OWASP controls, MITRE ATT&CK techniques, compliance requirements, and historical threat patterns.

4

Satyam Intelligence Feed

Dark web data, credential leak databases, threat actor tracking, IOC feeds, and OSINT sources are ingested in real-time — enriching the knowledge graph with current threat context that static databases lack.

5

VM Execution Layer

Active security tasks are dispatched to ephemeral GCP e2-standard-4 instances — running sandboxed Python/Shell REPL, VirusTotal and Shodan API calls, and Selenium browser automation. Instances are destroyed after task completion.

6

Context Fusion

Results from VM execution, GraphRAG retrieval, and Satyam feeds are fused into a unified context representation — weighted by recency, confidence, and relevance to the specific security domain.

7

MoE Transformer Inference

The fused context is routed to the appropriate MoE specialist(s) for final inference — token-level routing ensures each expert processes only the data most relevant to their domain.

8

Structured Output

Actionable findings, threat intelligence reports, compliance evidence packages, and remediation guidance are delivered — structured as CVSS-scored vulnerabilities, MITRE ATT&CK mappings, framework control evidence, or developer-ready fix instructions.

VM Execution

Isolated. Ephemeral. Secure by design.

Every active security task runs in a fresh, sandboxed compute environment — destroyed the moment it completes. Zero cross-session contamination.

GCP e2-standard-4 Instances

4 vCPU, 16 GB RAM compute instances provisioned on-demand via Google Cloud Platform. Sized for parallel security tool execution without resource contention.

gVisor Sandbox Isolation

Google's gVisor container runtime intercepts all system calls — providing kernel-level isolation without hardware virtualisation overhead. Threat code cannot escape to host infrastructure.

120-Second Hard Timeout

All VM tasks are bounded by a 120-second execution timeout — preventing runaway processes and ensuring consistent, predictable response times across all security modules.

Non-Root Service Account + VPC Firewall

Instances run under a scoped non-root service account with minimal IAM permissions. VPC firewall rules block all inbound traffic and restrict outbound to approved security intelligence APIs only.

vm-execution-config.json

// VM Execution Layer — Security Config
{
  "instance_type": "e2-standard-4",
  "vcpu": 4,
  "memory_gb": 16,
  "runtime": "gvisor",
  "ephemeral": true,
  "timeout_seconds": 120,
  "cross_session_persistence": false,
  "user": "non-root",
  "tools": [
    "python_repl",
    "shell_repl",
    "selenium_browser",
    "virustotal_api",
    "shodan_api",
    "censys_api",
    "cve_nvd_api"
  ],
  "network": {
    "inbound": "deny-all",
    "outbound": "allowlist-only",
    "vpc_firewall": true
  }
}
              

Zero cross-session persistence
Every VM instance is a clean slate. No data, state, or credentials persist between tasks — ensuring complete isolation even when analysing active malware samples or performing red team simulations.

Why Prava

One platform beats 45+ siloed tools.

Legacy security stacks are expensive, slow, and fragmented. Prava replaces them with one AI-native system that learns, adapts, and scales with you.

Capability	Legacy Security Stack	Prava Next-Gen AI
Architecture	45+ disconnected, siloed security tools	One unified LLM-powered platform — 30 integrated modules
Detection approach	Rule-based signatures, static analysis	Behavioural AI, predictive intelligence, adaptive learning
Monthly cost	$5,000–$50,000+ per year per tool	From $199/month — all 30 modules included
Mean time to close (MTTC)	Days to weeks for complex threats	90% faster — hours to minutes via RLM orchestration
Context window	Single-tool scope, no cross-domain correlation	100× larger inputs via RLM external REPL state
Compliance automation	Manual evidence collection, expensive audits	37 frameworks, 1,718+ controls, 90% audit prep reduction
Dark web intelligence	Separate subscription, manual correlation	Satyam integrated — real-time dark web + OSINT feeds
Setup time	Months of integration and configuration	Start in minutes — no agents, no infrastructure

Integrations

Plugs into your existing stack.

Prava connects to the tools your security and engineering teams already rely on — via REST API, webhooks, and native SIEM/SOAR connectors.

SIEM Integrations

Native connectors for Splunk, Microsoft Sentinel, and IBM QRadar — push findings, alerts, and threat intelligence directly into your existing SIEM.

SOAR Automation

Palo Alto XSOAR integration — automatically trigger Prava assessments as SOAR playbook steps and return structured findings for automated response workflows.

CI/CD Webhooks

Embed security testing directly into GitHub Actions, GitLab CI, Jenkins, and CircleCI pipelines — shift security left with every pull request and deployment.

REST API

Full programmatic access to all 30 security modules via a clean REST API with OpenAPI 3.0 documentation, JWT auth, and webhook event delivery.

API-first design

Every capability in Prava is accessible via our REST API — from triggering a web application pentest to pulling real-time Satyam dark web alerts. Authenticated with JWT, rate-limited by plan, with full OpenAPI 3.0 documentation and SDK libraries for Python, Node.js, and Go.

Get API Access

Roadmap

Where we're going.

Prava is built to evolve. Our four-phase roadmap takes us from MVP to fully autonomous AI SOC — with clear milestones and public progress tracking.

In Progress Q1–Q2 2025

Foundation & MVP

Core platform architecture is live. First 15 security modules shipped. Satyam dark web intelligence integration complete. MVP available for early-access customers.

GraphRAG + RLM + MoE architecture
First 15 security modules live
Satyam dark web integration
Early access customer onboarding

15

Security modules shipped in Phase 1

In Progress

Planned Q3–Q4 2025

Full Platform Launch

All 30 modules shipped. VM Execution Layer goes live. MSSP white-label portal opens. Public REST API and full SIEM/SOAR integrations available.

All 30 security modules
VM Execution Layer (GCP)
MSSP white-label portal
REST API + SIEM/SOAR connectors

30

Total modules at Phase 2 completion

Planned

Planned Q1–Q2 2026

Enterprise & Certification

ISO 27001 and SOC 2 Type II certifications achieved. Autonomous incident response capabilities ship. Target $500K ARR reached with enterprise customer expansion.

ISO 27001 certification
SOC 2 Type II certification
Autonomous incident response
$500K ARR milestone

$500K

ARR target at Phase 3 completion

Planned

Future Q3 2026+

Autonomous AI SOC

Fully autonomous AI Security Operations Centre — zero human intervention for Tier 1 and Tier 2 triage. Zero-day prediction via behavioural analysis. Series A fundraise to accelerate global expansion.

Fully autonomous AI SOC
Zero-day prediction engine
Series A fundraise
Global expansion & partner network

AI SOC

Zero human intervention for Tier 1 & Tier 2 triage

Future Vision

One platform. Infinite intelligence.