Skip to content
PlatformAI analystMicrosoft 365NIS2ISO 27001PartnersPå svenskaSign in
ARIA · AI verification

Findings go on trial.Verdicts come with evidence

ARIA is PollySec's AI analyst. It goes back to the target, runs real tools and hands down a verdict it can back with quotes from what those tools returned.

Book a demo Scan your domain free
The difference

Same finding.Two answers

A scanner sees a port and a banner and makes a guess. ARIA asks the service itself and shows you what it said.

What a typical scanner reports

High

Possible RDP exposure

vpn0.example.se:3389

Basis
version string in a banner
Confidence
unknown
Next step
you find out

What ARIA hands you

Verified

VEX · exploitable

vpn0.example.se:3389

Confidence
0.92
The evidence, from the tool output
“NLA required: No”
Checks, in order
TCP connect 0.2 sRDP handshake 1.4 s

Run from outside, by the cloud sensor

One run, replayed

Finding in.Verdict out

Real checks and real output. Only the domain is an example. The Redis check sends PING and never AUTH, and the quote in step 3 has to appear word for word in the tool's output.

01Finding

High

Redis reachable from the internet

cache.example.se:6379

Raised by the port scan. Not confirmed yet.

02Probe

  • › TCP connectcache.example.se:6379connected
  • › Redis checkPING, no AUTHRedis OPEN · responds to PING without authentication

ARIA picks the tools. The cloud sensor runs them against the live target, from the outside.

03Evidence

“responds to PING without authentication”The database answers anyone, no password asked.

Quote matched to tool output

04Verdict

Verified

High. Close the port or require AUTH.

VEX: exploitable

Guardrails

Hard on findings.Strict with itself

Testing for real needs rules. These hold on every run.

  • Scope, checked twice

    The sensor and the server both check that a tool only touches assets inside the finding's scope.

  • It speaks the protocol

    The tools do what an attacker would: a Redis PING, an anonymous FTP or LDAP login attempt, an SMTP relay test that never sends mail.

  • Targeted, not a flood

    A run is a handful of targeted checks: at most 12 tool calls, or 16 for Critical findings and for network-exposure, known-vulnerability and information-disclosure findings. Each tool has a hard 30-second timeout, a run stops by itself within 10 minutes, and ARIA never repeats the same call.

  • OT refused

    OT networks are refused outright. Other internal networks get four checks: DNS, TLS, TLS versions and HTTP.

  • Quote it or get flagged

    Every quoted piece of evidence of 16 characters or more must appear in what the tools returned. If not, it's flagged, and for vulnerability findings the verdict is downgraded.

  • A confidence floor

    A verified verdict below 0.60 becomes Needs review. No evidence, a contradiction or a bare TCP handshake gets a verdict downgraded too.

  • Closing takes contact and review

    Nothing is closed as a false positive without contact with the target and a separate, independent review. If the review can't run, nothing closes.

  • Retries, with limits

    Target unreachable? ARIA tries again after 24 hours, at most three times per finding.

  • Your results stay yours

    Tool results are cached per customer for 60 minutes and never shared between customers.

The toolkit

46 tools.Picked per finding

ARIA picks the tools that can settle that particular finding. The sensor runs them against the target.

TLS

2

certificates and protocol versions

DNS & domain

6

records, reverse lookups, zone transfers, certificate logs, takeover checks and IP location

Web

7

responses, methods, exposed files, CORS, cookies, admin pages and script bundles

A real browser

6

paths, scripts, forms, cookies, storage and page metadata, as a browser sees them

Remote access & directory

6

SSH, RDP, SMB and LDAP, including OS fingerprinting

Databases & data stores

6

SQL databases, key-value stores, document and search engines

Mail

2

mail servers and relay tests that never send mail

FTP, SNMP, cameras, printers

4

file transfer, network management, camera streams and printers

Containers

2

container engines and cluster APIs

VPN & UDP

3

VPN gateways and UDP services

Network

1

reachability

Leaked keys

1

whether a leaked key still works

off by default

46

tools on the sensor, plus a CVE lookup on the server. ARIA picks the few that settle the finding, the sensor runs them, and the run stops by itself. Never a flood.

The verdict

A word youcan act on

Every verdict is recorded in the CycloneDX VEX vocabulary, so it means the same thing in your console as in the rest of your vulnerability work.

exploitable
The threat is real and applies to this asset. Action needed.
not_affected
Right component, but the precondition for the attack is missing. Always with a justification.
false_positive
The finding pointed at the wrong component or product.
in_triage
The evidence doesn't support a confident verdict. A person takes a look.
resolved
The issue is no longer there, for example the port has closed.

What you see on the finding

  • The verdict in words: Verified, Likely false positive, Cannot reach target, Needs review, Auto-closed or Could not finish.
  • The confidence, for verified outcomes.
  • Every check in order, with its duration and the raw output to expand.
  • Which checks were cited as evidence.
  • The conclusion, with integrity notes.
  • Whether the checks ran from outside or inside the network.
What ARIA takes on

Where a testsettles it

High and Critical

High and Critical findings, where a live test settles the question. The threshold is set by PollySec. ARIA comes with the larger packages, with no per-use charges.

Already settled

Anything a deterministic check already settles skips the AI: CVE version matches, end-of-life, breach exposure, DNS and email security, and findings from local-network scanners.

Learns

Dismiss a false positive and it becomes a rule for that asset. An auto-close becomes a pattern rule that expires after 30 days. Every rule is listed and can be revoked.

AI in the pipeline

Six jobs for the AI.All of them on facts

ARIA is one of six jobs the AI does in PollySec. Here is what each one gets to read, and the rule it works under.

  1. 01

    Verify

    ARIA re-tests High and Critical findings on the live target with 46 tools and quotes the output in its verdict. A quote that isn't in what the tools returned gets flagged.

  2. 02

    Brief

    Before a test, a separate model reads what's already known about the asset: its other open findings and the tags your team has set. ARIA gets a short briefing and spends fewer tool calls on what's already established. If the briefing can't be made, ARIA tests without it.

  3. 03

    Second opinion

    Before ARIA closes a finding as a false positive, a separate AI reviewer reads the whole run: the finding, every tool call and the verdict. If the reviewer disagrees, the finding stays open for a person. No answer, no close.

  4. 04

    Explain

    Every CVE match gets four short cards: what the software is, what the flaw allows, how bad it gets and how to fix it. The model may only use the official record: the description, the CVSS vector, the fixed version and whether the flaw is known to be exploited. It names a version number only when one is published.

  5. 05

    Read the trap

    A decoy hit gets a short analysis. The AI sees the shape of a credential, never the value: whether a username and a password were tried, how long the username was and whether it carried a domain.

  6. 06

    Tell your story

    When we run a free scan for you, the report includes two short paragraphs on your company. Every name and number is checked against the data before it's printed. A story that fails the check is left out.

Stop triaging.Start fixing

Watch ARIA test findings on your own surface, live, in a 30-minute demo.

Book a demo