Understand Nova ACDP and its seven engines

Nova ACDP connects seven specialized engines. Each has a different job, from finding unusual activity to investigating incidents or managing response. They can use related findings, but an analysis from one engine does not authorize an action in another.

This separation matters during evaluation. A behavior change is not a risk verdict, a score is not a finding, a proposal is not an active rule, a modeled path is not an observed attack, and a recommendation is not permission to act.

Qyronis

Learns the normal behavior of identities and assets, then highlights unusual changes with supporting evidence, confidence and coverage information.

NovaSignal

Prioritizes supported alert evidence with an explainable score, contributing factors, confidence, and historical movement.

Nova Autonomous Detection Engine

Finds gaps in detection coverage and drafts proposed improvements. Proposals stay inactive until they pass the required review and approval.

Velora

Brings related events, identities, assets and earlier findings into an investigation, with guidance on what to check next.

Velora Federated Patterns

Ranks recurring platform-observed patterns into hunt, priority, or coverage proposals during controlled preview.

Red-team Adversary eXecution Engine

Explores possible attack scenarios and expected activity without launching an attack or changing the protected environment.

Nova Detection and Response eXchange

Manages supported response actions with checks for customer access, policies, required approvals and recorded results.

The engines do not have to run as one fixed chain. Nova connects them when the use case and available evidence justify it. The handoff keeps the source, quality state, uncertainty, and intended consumer attached.

1. 01
   Observe

   Collect source-linked activity, assets, findings, and threat context.

2. 02
   Assess

   Use the appropriate engine to measure behavior, priority, coverage, or a security hypothesis.

3. 03
   Connect

   Review related identities, assets, timelines and evidence in the same investigation.

4. 04
   Decide

   The responsible team reviews the findings and controls approvals and response permissions.

5. 05
   Record

   Retain the supported outcome and the evidence used to reach it.

• Use Qyronis when the question is what changed for an entity and whether the baseline is mature enough to interpret it.
• Use NovaSignal when the question is which supported alerts deserve attention first and why.
• Use the Nova Autonomous Detection Engine when the question is where observed evidence indicates a detection-coverage opportunity.
• Use Velora to investigate related activity, review earlier findings and identify what still needs checking.
• Use Velora Federated Patterns when controlled-preview recurrence could sharpen a hunt, priority, or coverage question.
• Use the Red-team Adversary eXecution Engine when the team needs to challenge coverage assumptions with a non-destructive adversary hypothesis.
• Use Nova Detection and Response eXchange when an approved decision must reach a supported provider outcome under explicit controls.

• Missing or stale evidence remains visible and does not become a low-risk conclusion.
• Scores, hypotheses, proposals, and recommendations remain linked to their supporting evidence and quality state.
• Preview and assisted capabilities do not imply general availability or inclusion in every customer environment.
• An AI recommendation does not authorize a response. Required permissions and approvals are checked before an action runs.