Cloud assets, posture, exposure, data, and attack paths
AI-Native Autonomous Cloud Defense Platform (ACDP)
Nova cloud security and SecOps. One connected platform.
Nova is an AI-Native Autonomous Cloud Defense Platform, or ACDP. It connects CNAPP cloud security with SecOps so teams can understand exposure, prioritize active threats, investigate with the evidence in view, improve detection coverage, and coordinate supported response under the approvals and oversight their organization requires.
For enterprise security teams and managed security service providers (MSSPs).
Cloud context. Security in action.
Nova connects CNAPP cloud security, SecOps, autonomous security engines, and governed response around shared evidence.
Threat detection, investigation, hunting, and coverage
NOVA
AI-Native ACDP
Evidence-connected defense
Prioritization, behavior, reasoning, and validation
Supported actions under your policies and approvals
- ObserveEvidence
- UnderstandContext
- PrioritizeRisk
- DefendControlled action
Your team controls high-impact actions.
The Nova platform
Understand your exposure. See the whole investigation.
A cloud misconfiguration, an unusual sign-in, and a security alert may be parts of the same incident. Nova brings the affected assets, identities, activity, and threat intelligence into a shared security context. Cloud teams and SOC analysts can assess the risk together, follow the evidence, and coordinate what happens next.
Know what is at risk
Understand your cloud assets, security posture, sensitive data exposure, and potential attack paths. See which weaknesses affect important resources and where remediation deserves attention.
Understand what is happening
Bring detections, behavior analytics, threat hunting, and investigation into everyday SecOps. Connect related activity, test the explanation against the evidence, and keep decisions and response work with the case.
What is Nova? Explore Nova CNAPP capabilities Explore Nova ACDP
Security operations with Nova
Built around the work of your SOC.
SecOps needs more than an alert queue. Nova helps analysts establish priority, investigate related activity, and carry the case through handover, escalation, and response. The evidence stays with the investigation as responsibility moves between people and teams.
- Triage with contextReview alert priority alongside behavior, affected assets, and threat intelligence.
- Investigate beyond the alertFollow events and relationships, use AI-assisted reasoning, and hunt for related activity.
- Coordinate action and improve coverageTrack ownership and supported response actions, then review detection gaps and proposed improvements.
Incoming signals
Activity change
Cloud finding
Threat match
Context
EntityExposureThreatEvidence
Priority queue
Review firstReachable riskEvidence linked
InvestigateContext incomplete
MonitorLow-impact activity
From Risk to Response
From the first alert to incident response.
Collect the relevant data, prioritize the risk, investigate the activity, and track the response in the same workflow.
01
Connect
Connect supported cloud, identity, endpoint, and security tools.
02
Prioritize
Review exposure, affected assets, and alert context to choose what needs attention first.
03
Investigate
Follow related users, assets, and events through the investigation timeline.
04
Decide
Check the findings and decide whether to investigate further or prepare a response.
05
Respond with DRX
Review supported actions, apply your approval rules, and track the reported result.
Cloud security and SecOps
One place for cloud security and security operations.
Cloud security teams can review exposure and misconfigurations. SOC analysts can investigate related alerts and activity, then coordinate the next steps with the people responsible.
CLOUD
Cloud Security
Find cloud assets, review misconfigurations, assess data exposure, and prioritize attack paths.
SECOPSSecurity Operations
Prioritize alerts, investigate suspicious activity, hunt for threats, and coordinate incident response.
Inside Nova
Specialized intelligence across the security lifecycle.
Qyronis explains behavioral change. NovaSignal helps prioritize alerts. NADE proposes detection improvements. Velora connects evidence and reasons through security questions. RAZE models attack scenarios, and DRX manages supported response actions. VFP adds recurring-pattern intelligence through controlled evaluations. These capabilities have distinct roles and availability, with the underlying evidence available for review.
01 · Observe
Qyronis
Detect unusual activity by comparing it with the behavior normally seen in your organization.
02 · PrioritizeNovaSignal
Prioritize alerts using risk scores, related activity, and an explanation of the factors behind each score.
03 · ImproveNova Autonomous Detection Engine
Identify detection gaps and propose rule improvements for your team to test and approve.
04 · ReasonVelora
Help analysts understand an investigation, review supporting evidence, and decide what to check next.
05 · Emerging PatternsVelora Federated Patterns
Identify recurring threat patterns and propose threat hunts and detection improvements for review.
Emerging Capability 06 · ModelRed-team Adversary eXecution Engine
Explore possible attack scenarios and detection gaps through analysis, without carrying out destructive attacks.
07 · GovernNova Detection & Response eXchange
Coordinate supported response actions with policy checks, approvals, and a record of the result.
NOVA · AI-NATIVE AUTONOMOUS CLOUD DEFENSE PLATFORM
Understand what each engine does.
Behavior analytics, alert scoring, threat hunting, detection engineering, AI-assisted investigation, and response work together in Nova. Each result keeps the supporting information your team needs to review it.
Explore Nova ACDPCloud Security
Find exposed assets. Understand attack paths. Prioritize remediation.
Review cloud resources, misconfigurations, access permissions, and related alerts together. Use exposure and attack-path information to identify which weaknesses could put important systems at risk.
Prioritize Cloud RiskExternal exposureReachable serviceObserved
Identity reachAccess relationshipEvidence checked
Protected resourcePotential impactPrioritize review
Evidence available
Coverage partial
Owner required
Observed sequence
Observed activityControl-plane change
Behavior changeOutside recent baseline
Related evidenceSource events
Assessment
KnownActor and action observed
UnknownBusiness intent
ConflictCoverage is incomplete
Velora Intelligence
AI assistance that helps analysts investigate.
Velora summarizes related activity, explains possible causes, and suggests further checks. Analysts can review the supporting evidence and any missing information. A recommendation does not authorize a response action.
Meet VeloraSource reach, technique mapping, and active logic stay visible.
MeasuredObserved activity and analyst feedback reveal where tuning matters.
Review requiredProposed improvements remain controlled until an analyst approves use.
Published disabledDetection outcomeImprove detection coverage while keeping rule changes under analyst review.
Detection Engineering
Find detection gaps. Test improvements before release.
Review rule performance and MITRE ATT&CK coverage, identify gaps, and evaluate proposed improvements. Your team reviews and approves changes before they become active detections.
Strengthen Detection CoverageProactive Threat Hunting
Look for threats beyond the alert queue.
Start with related alerts and suspicious behavior, then search for matching activity across the available events. Check whether the pattern repeats, what the data covers, and whether similar activity occurred without an alert.
Explore Proactive HuntingUse a complete set of related alerts and supporting evidence before starting a hunt.
Related alerts checkedQyronis can raise the priority of a hunting hypothesis when unusual behavior or a growing risk supports further investigation. Timing alone is not enough.
Evidence and behavior checkedSearch related events for repeated behavior and matching activity that did not trigger alerts. Check the available coverage.
Validation requiredThreat Hunting resultsReview hunting suggestions, runs, findings, Hunt Insights and reports.
Why Nova
Connect cloud risks, investigations, and response.
Nova brings the affected assets, security activity, and investigation history into the same workflow. Teams can review the facts, assign work, and track the response without losing the details of the incident.
See why Nova is different01
Connected investigations
Connect cloud posture, behavior, intelligence, detections, investigations and response.
02
Risk-based prioritization
Prioritize the paths that can reach privileged identities and critical assets.
03
Improve detections as your environment changes
Turn recurring patterns and missed coverage into improvements your team can review before they go live.
04
Blind spots stay visible
Missing, stale and incomplete evidence never appears as an all-clear.
Solutions
Find the use case that fits your team.
SOC
Modernize security operations
Unify queue context, detection improvement, investigations and supported response workflows.
CLOUDUnderstand cloud risk
Connect posture, exposure, assets and active threat context.
IRAccelerate investigations
Build one evidence chain across search, graph, timeline and response.
MSSPOperate across customers
Keep customer data, access and actions separated while standardizing detection and response.
Trust and Governance
Blind spots stay visible.
See when a source has stopped reporting or an assessment lacks enough data. Review those gaps before treating a result as low risk.
Trust and GovernanceExpected sources
Cloud activityConnected
Identity activityConnected
Endpoint signalsEvidence delayed
Evidence scopeFreshness + scopeSource-aware
Coverage posture
ObservedEvidence current
GapDecision limited
Nova FAQ
Questions about Nova cloud security and SecOps.
What problem does Nova solve?
A cloud misconfiguration may matter more when the same asset is involved in suspicious activity. Nova brings those details together with the investigation history, so teams can assess the risk and work on the same case.
Is Nova a SIEM replacement?
Nova includes event search, detection, investigation and response workflows, and it can work with existing security systems. Whether it replaces any current tool depends on the required data sources, retention, workflows and controls in the customer environment.
How does Nova use AI?
Nova brings the available investigation data together and distinguishes observed events from possible explanations and missing information. When Nova Prime is enabled and the case qualifies, it can add an AI-written explanation with references to supporting evidence.
What does autonomous mean in Nova?
Nova can analyze activity, score alerts, identify unusual behavior, and prepare detection improvements automatically where the required data and controls are available. Response actions still require the appropriate permissions, policy checks, and approvals. Autonomous does not mean unrestricted action.
Which teams is Nova designed for?
Nova is designed for enterprise security operations, cloud security, detection engineering, security leadership and managed security service teams that need evidence-backed decisions, separated customer boundaries and controlled response.
Evaluate Nova
See how Nova fits your security needs.
Bring the cloud environments, security tools, and workflows you want to evaluate. We will review the supported connections and show you how Nova can help with your priorities.