Clear answers about what Nova does, and where its limits remain.

Nova is an AI-Native Autonomous Cloud Defense Platform, or ACDP. It combines CNAPP cloud security capabilities with SecOps detection, prioritization, behavior analytics, threat intelligence, threat hunting, investigation, detection improvement, and governed response. Security teams can connect a cloud finding to related alerts and affected assets, then investigate and coordinate the next steps in one platform.

A Cloud-Native Application Protection Platform, or CNAPP, brings cloud security capabilities together across applications, infrastructure, identities, data, and workloads. A CNAPP evaluation should confirm the exact asset, posture, exposure, code, workload, data, compliance, and threat coverage needed for the customer environment.

Nova includes CNAPP capabilities for cloud asset inventory, Cloud Security Posture Management, external exposure, attack paths, cloud data context, supported code and workload checks, compliance evidence, and cloud threat detection. Nova is positioned as an ACDP because it carries that cloud context into SecOps prioritization, investigation, autonomous analysis, detection improvement, and governed response.

These categories describe different security jobs. CNAPP addresses cloud-native security, SIEM centralizes security events and detections, XDR connects detection and response across supported domains, SOAR coordinates workflows and actions, and UEBA identifies behavior that differs from a baseline. Nova brings capabilities from these areas into an ACDP workflow. Whether it replaces or works alongside an existing tool depends on the required data, retention, integrations, and controls.

A cloud misconfiguration may matter more when the same asset is involved in suspicious activity. Nova brings those details together with the investigation history, so teams can assess the risk and work on the same case.

The same authorized evidence can inform cloud risk, detection, investigation, supported response and reporting. Nova keeps source, confidence, coverage and decision context attached instead of flattening every signal into one unexplained score.

Nova covers cloud asset inventory, configuration checks, data exposure, attack surface management, and compliance evidence. SOC teams can use alert triage, behavior analytics, threat intelligence, threat hunting, detection engineering, investigation, and supported response actions.

Explore Nova's engines for behavior analytics, alert prioritization, detection engineering, AI-assisted investigation, threat patterns, attack modeling, and response.

Nova includes event search, detection, investigation and response workflows, and it can work with existing security systems. Whether it replaces any current tool depends on the required data sources, retention, workflows and controls in the customer environment.

Yes, where the required connection is supported. Nova can connect cloud, identity, endpoint, software service, intelligence, ticketing and response systems. Hansec confirms the exact evidence, action and permission coverage for each environment.

Nova is designed for enterprise security operations, cloud security, detection engineering, security leadership and managed security service teams that need evidence-backed decisions, separated customer boundaries and controlled response.

No. Available features depend on your subscription, enabled modules, connected systems, and user permissions. Hansec confirms what is included and any relevant regional limits before onboarding.

Nova has evaluated connections across AWS, Microsoft Azure, Google Cloud, Kubernetes and supported identity, endpoint, software service, intelligence, ticketing and response systems. The available evidence and action set varies by connection and is confirmed for each customer environment.

Access depends on the selected evidence and response workflows. Collection should use the least privilege needed for the agreed scope. Response permissions are separate, explicit and limited to supported actions that customer policy allows.

Users can access only the customer data and actions permitted by their assigned access. Managed security teams can work across authorized customers while those customers' data and response controls remain separate.

Nova keeps complete, partial, degraded, unavailable, not applicable, not assessed and unknown states distinct. Missing evidence never becomes a passing control, normal behavior, low risk or proof that no threat exists.

No. An empty result means no matching issue was found in the data that was assessed. It does not prove that the environment is safe. Check the selected time range, source coverage, and assessment status before drawing a conclusion.

For supported sources, Nova relates connection and evidence state to cloud posture, detections and investigations. Exact coverage depends on the systems connected, the granted scope and the evidence available in each environment.

Cloud security posture management evaluates configuration and control evidence across supported environments. Nova shows what was assessed, what failed and where evidence is missing, so an incomplete assessment does not appear as a pass.

Nova can relate findings to affected assets, exposure, identities, attack paths, active security signals and evidence quality. The available factors depend on the connected sources and are kept visible for review.

For supported sources, Nova presents the available resource identity, provider, account, region and service context. It can also connect exposure, posture findings, ownership and related evidence when those records are available.

For supported data assets, Nova connects resource identity with the available exposure, access review, policy, ownership and related cloud risk evidence.

No. Classification and evidence coverage depend on the connected source, granted access and supported asset type. Unavailable or not assessed evidence remains visible rather than becoming a confirmed classification.

No. Nova can organize supported control mappings and evidence, including missing and not assessed states. It does not replace an independent auditor, legal advice or a formal certification decision.

Nova presents mapped views for supported frameworks and controls. Hansec confirms the exact framework, control and evidence coverage for each environment before it is relied upon.

Nova brings the available investigation data together and distinguishes observed events from possible explanations and missing information. When Nova Prime is enabled and the case qualifies, it can add an AI-written explanation with references to supporting evidence.

No. Core collection, search, assessment, detection review, evidence coverage and investigation workflows remain available without a generative model. Optional AI assistance is used only where enabled, entitled and supported by sufficient evidence.

Nova Core builds the investigation assessment from the available evidence using defined analysis rules. Nova Prime can add an AI-written explanation with evidence references when it is included, enabled, and available for the case. If Prime cannot complete, the Core assessment remains available.

Nova can analyze activity, score alerts, identify unusual behavior, and prepare detection improvements automatically where the required data and controls are available. Response actions still require the appropriate permissions, policy checks, and approvals. Autonomous does not mean unrestricted action.

Velora is Nova's security intelligence and reasoning engine. It connects alerts, cloud findings, affected entities, threat context, and earlier assessments to explain a developing security concern. Analysts can review structured reasoning, ask focused questions in Investigation Studio, and explore relationships in the threat graph. Observed facts, supported conclusions, and unanswered questions remain distinct throughout the investigation.

NovaSignal helps analysts prioritize alerts by explaining the risk score and its contributing factors. Alert priority combines machine learning with available security information. Event and exposure scores use defined rules. Analysts can review the confidence, source information, and any data gaps.

Qyronis detects unusual behavior in users, resources, and services by comparing activity with patterns learned for your organization. It explains what changed, how confident the assessment is, and whether enough recent data is available. Unusual activity still needs investigation before it is treated as a threat.

The Nova Autonomous Detection Engine helps detection teams find gaps in coverage and develop rules that address them. NADE uses observed activity, threat context, and detection feedback to prepare a proposed change with its rationale and expected behavior. Teams can examine the supporting evidence and validation results before approval. A generated proposal is not an active rule.

RAZE helps teams explore how an attacker might move through an environment and where defenses may have gaps. It analyzes possible attack scenarios. It does not carry out destructive attacks or treat a modeled scenario as an incident that actually happened.

VFP is an emerging Velora capability that ranks recurring platform-observed patterns and turns supported results into hunt, prioritization or coverage proposals. It is not represented as generally available federated learning. Availability, data scope and allowed outputs are confirmed for each controlled evaluation.

Nova connects rule inventory, mapped coverage, observed alert activity, analyst feedback and reviewable proposals so teams can identify and govern improvements from one workflow.

Not by default. Manual and AI-assisted proposals require review. Where automatic rule promotion is configured, a proposal must pass checks for supporting evidence, usefulness, quality, safety, duplication, and audit history. Promoting a detection rule does not authorize a response action.

No. Qyronis highlights activity that differs from an established pattern. Analysts need to review the original events, related activity, and available data before deciding whether it indicates a threat.

Detection balances sensitivity against noise, so legitimate but unusual activity can require review. Submit the alert identifier and relevant context through Hansec Support. Tuning is assessed against the available evidence and the applicable agreement.

Investigate a security question beyond the alerts already in the queue. Nova supports focused Threat Hunting with reports that bring the hypothesis, examined activity, findings, affected entities, and follow-up suggestions together. Threat Relevance helps analysts assess which threats matter to their environment, while coverage and confidence explain how far the available evidence supports a conclusion.

No. A hunt must first have support from related alerts. Qyronis can help prioritize it when unusual behavior or a significant change adds useful information. An anomaly score or a timing change alone does not create a hunt.

No. It is evidence for analyst validation, not proof of a detection gap. Only direct rule-evaluation evidence can support that conclusion.

Qyronis identifies behavior that differs from the usual pattern. Proactive Hunting searches a wider set of events to see whether suspicious behavior repeats, including activity that did not generate an alert. Analysts review the results of both.

Cloud threat detection and response connects suspicious cloud activity to identities, assets, exposure and supporting evidence, then helps teams investigate and coordinate an authorized response. Nova keeps evidence quality, affected systems and progress visible through the supported workflow.

No. A recommendation alone cannot run an action. The action must be supported by the connected system and allowed by the user's permissions and the organization's policies. Containment and other high-impact actions remain subject to the required approvals.

Supported advisory and lower-risk workflows may run without approval for every execution only when customer policy, granted permissions and the connected system allow it. Containment and other high-impact actions require approval. Hansec confirms the exact model for each deployment.

Action availability depends on the connected system, granted permissions, customer policy and enabled integration. Hansec confirms the supported action set, simulation behavior and approval requirements for each environment.

Not always. Nova records the state reported by the connected system and keeps acceptance, progress, outcome and reconciliation context distinct. A provider acceptance is not represented as successful completion when follow-up verification is still required.

Use the active incident contact and submit a priority request through Hansec Support. Include what you observed, affected systems, when it started and any containment already taken. Follow your incident response plan and preserve relevant evidence.

Support hours, severity coverage and response targets are defined in the applicable agreement. Submit the request with the appropriate severity and use the active incident contact when the matter is in progress.

Submit a privacy request through Hansec Support. The Privacy Policy explains the available rights, required information, verification process and response periods that apply to the request.

Renewal, cancellation, refunds, service credits and post-termination handling follow the signed Order or other applicable agreement. The public website does not create a separate refund window or cancellation deadline. Review the commercial terms disclosure, then contact Hansec Support with the relevant Order or invoice.

Submit the document through Hansec Support. Hansec will confirm the documentation available and the review process that applies to the engagement.

Data location and any available residency option depend on the agreed deployment and supported service scope. Review the Privacy Policy and confirm regional requirements with Hansec before onboarding.

Use Hansec Support with the vulnerability report topic and review the responsible disclosure policy before testing. Test only assets that Hansec has explicitly authorized, never another customer environment.

Use the cookie preferences control on the Policies and Disclosures page. The control lets you review and update the optional cookie categories available on this site.