Skip to main content
RootViel
ES EN

Official catalog

The 8 entries of the RootViel catalog

Every entry runs on the same RootViel correlation engine, sharing traceability, risk scoring and a verifiable Ed25519 chain of custody. Explore the technical detail, the main capabilities and the use cases of each block.

Entries
8
Languages
40+
Reg. frameworks
12
Crypto. signature
Ed25519
Explore RV-01 See B2B pricing Request a guided demo ← Back to homepage

Catalog index

8 entries integrated · RootViel catalog

↑ Top
01 / 08
RV-01 Catalog · Reasoning engine

Reasoning engine · Offensive intelligence with generative AI

Seed entry of the RootViel catalog: combines generative AI models trained on MITRE ATT&CK® TTP corpora, CISA Known Exploited Vulnerabilities, CAPEC and offensive intelligence to produce multi-step attack paths with probability scoring, reasoning traceability and contextual remediation per asset.

Main capabilities of Reasoning engine · Offensive intelligence with generative AI

  • Automatic correlation of 42 primary sources: MITRE ATT&CK, CAPEC, CISA KEV, NVD.
  • AI-assisted generation of multi-step paths with exploitation probability scoring.
  • Remediation engine: suggests patches, WAF rules and asset-specific hardening.
  • Technical explainability per finding, with references and an evidence chain.
02 / 08
RV-02 Catalog · Infra surface

Infrastructure surface · Server, port and banner assessment

Active inventory, precise technology-stack fingerprinting, banner validation against authorized CPE databases, TLS cipher suites and HSTS policy, checked against CIS benchmarks, DISA STIG and official hardening guides.

Main capabilities of Infrastructure surface · Server, port and banner assessment

  • Exposed surface inventory: DNS, subdomains, IP ranges, clouds and multi-tenant estates.
  • Correlated fingerprinting with Nmap + Amass + fingerprint.codes, built for zero false positives.
  • TLS 1.3 validation, cipher suites, HSTS, X.509 and trust chain checks.
  • Detection of missing patches, unnecessary services and over-privileged accounts.
03 / 08
RV-03 Catalog · Malware

Malware and threats · Static and dynamic binary analysis

AI-assisted cross-platform disassembly of PE, ELF, Mach-O and embedded firmware. Isolated sandbox emulation, generic unpacking, ATT&CK technique detection, and IOC extraction ready for SIEM ingest.

Main capabilities of Malware and threats · Static and dynamic binary analysis

  • Layer, byte-layer and obfuscated-string analysis with AI assistance.
  • Detection of ATT&CK techniques, packers, anti-debug and anti-VM tricks.
  • Automatic extraction of SHA-256 hashes, YARA indicators and network IOCs.
  • Integration with VirusTotal and MalwareBazaar for initial triage.
04 / 08
RV-04 Catalog · Exploitation

Controlled exploitation · Online pentesting with double opt-in

Safe, parameterizable execution of official PoCs against authorized targets. Requires a prior Ed25519 grant, an explicit execution window and dual operational confirmation before every destructive vector. Automatic rollback plus forensic evidence.

Main capabilities of Controlled exploitation · Online pentesting with double opt-in

  • 2,140 PoCs: CISA KEV, Metasploit, public Nuclei plus RootViel's private team templates.
  • Parameterizable execution windows so production operations are never impacted.
  • MANDATORY human review before every destructive category (DELETE, RCE with persistence).
  • Ed25519 chain of custody plus automatic rollback and DFIR postmortem.
05 / 08
RV-05 Catalog · Topology & traffic

Topology and traffic · Networking and microsegmentation analysis

Passive 10G PCAP capture, mutually-agreed TLS decryption, Zeek-aware flow reconstruction, firewall policy validation, VLAN/ACL topology mapping and detection of open DNS / SMB / RDP / IPMI / SNMPv2 exposures.

Main capabilities of Topology and traffic · Networking and microsegmentation analysis

  • Automatic topology map with VLANs, ACLs and DMZ segmentation.
  • Detection of Kerberoasting, DCSync and SMB relay lateral movement.
  • Integration with AWS VPC Flow Logs · Azure NSG · GCP Firewall logs.
  • Identification of DNS/ICMP tunnels and unauthorized proxies that evade controls.
06 / 08
RV-06 Catalog · DevSecOps

DevSecOps · SAST + DAST + SBOM + SLSA signing

Multi-language SAST (40+), dynamic DAST, SCA composition analysis, CycloneDX 1.6 SBOM, hardcoded-secret detection and pipeline policy validation: branch protection, code owners, Sigstore/GPG SLSA 4 signing.

Main capabilities of DevSecOps · SAST + DAST + SBOM + SLSA signing

  • SAST + AI for 40+ languages: TypeScript, Java, Go, Rust, Python, Cobol, ABAP.
  • SCA with CycloneDX SBOM, detection of vulnerable dependencies (EPSS + adjusted CVSS).
  • Secret detection across repo and Git history: tokens, API keys, cloud credentials.
  • Verified Sigstore/GPG commit signing; alerts filtered by real-world exploitability.
07 / 08
RV-07 Catalog · Governance

Governance · Compliance reporting and regulatory mapping

Automatic mapping of every demonstrated finding to frameworks: ISO 27001:2022, SOC 2 Type II, NIST CSF, PCI-DSS, HIPAA, GDPR Art. 32/35, Spain's LOPDGDD, Brazil's LGPD, EU AI Act Annexes III-VIII. CSV/JSON/PDF export ready for Vanta/Drata/OneTrust/Secureframe.

Main capabilities of Governance · Compliance reporting and regulatory mapping

  • Overlay of 12 regulatory frameworks with a RACI matrix per control and owner.
  • Remediation SLA tracking by severity: high <24h, medium <7d, low <30d.
  • Evidence export to GRC platforms in CycloneDX JSON format.
  • EU AI Act Annex III-VIII overlay: documentation listed for the supervisor.
08 / 08
RV-08 Catalog · Audit & integrity

Audit and integrity · Ed25519 cryptographic seal + VC-DM

Ed25519 cryptographic seal per report and per finding. RFC 3161 timestamp (DigiCert TSA authority, 10+ year validity) and issuance as a W3C VC-DM 1.1 Verifiable Credential. Public verification with no account or login.

Main capabilities of Audit and integrity · Ed25519 cryptographic seal + VC-DM

  • Ed25519 asymmetric signature plus RFC 3161 timestamp · publicly verifiable.
  • Independent verification from any browser with just the PDF + .signature.json.
  • SHA-256 hash per finding and per report · immutable and reproducible.
  • Optional export to a public blockchain for permanently immutable audits.