Pythia | Threat Assessment Tool

Workspace navigation

Jump to an assessment section

Reach any governed workpaper without tabbing through the entire assessment.

Assessment section

Section navigation

Choose a section, then go directly to its heading. Press Alt+Shift+J to return here.

Engagement-scoping copilot

Define the assessment before requesting evidence

Answer the material scope questions once. Pythia deterministically proposes the method, evidence request, SOW, RACI, schedule, and review depth; nothing becomes binding until lead approval.

No governed scope

Business purpose and service boundary Critical or essential services Deployment model Cloud or SaaS providers Data classifications Users and identities Boundary-crossing interfaces In-scope components Explicitly out-of-scope components Regulatory and organizational criteria Desired assurance Service criticality Internet-facing CII designated High-risk-cloud criteria apply OT or safety impact Assessment period start Assessment period end Decision deadline

Accountable stakeholders Engagement lead Assessor Independent reviewer Risk owner System owner

Save an engagement, complete the scope interview, then prepare a deterministic draft for lead approval.

Engagement-lead approval rationale

Governed assessment contract

Assign accountability for every assessment output

Bind each required deliverable to a named engagement role while Pythia keeps its minimum-evidence rules, workflow state, and acceptance criteria server-owned.

No output contract

Governed evidence workflow

Turn evidence gaps into accountable requests

Assign each approved-scope or readiness gap, record a due date, and close it only with exact current evidence or an authorized waiver.

No request register

Approve a scope or run an assessment to create the governed request register.

No evidence requests are available.

Governed evidence quality

Set and enforce evidence-recency policy

Apply topic-, evidence-class-, or source-specific age limits. Stale, undated, future-dated, draft-policy, and chain-invalid evidence stays visible and can block assessment or approval.

No recency policy

1 · Propose exact policy thresholds A separate reviewer must approve the immutable policy fingerprint.

Policy name Evaluation date Default maximum age (days) Grace period (days) Future-date tolerance (days) Stale evidence Missing evidence date Evaluate preserved governed evidence only

Change reason

Save an engagement to configure its governed recency policy.

No evidence recency evaluation is available.

Immutable policy history

No policy versions recorded.

Governed evidence safety

Scan and quarantine evidence before use

Preserve original bytes without parsing them, require policy-bound clean scanner receipts, and exclude pending, detected, failed, expired, or tampered evidence from AI analysis and approval.

No malware-scan policy

Save an engagement to configure malware scanning and quarantine.

No malware-scan evaluation is available.

Immutable malware-policy history

No policy versions recorded.

Governed evidence connectors

Freeze source-system evidence before assessment use

Define least-privilege read access, obtain lead approval, and convert each collection into an immutable snapshot. A later source change never rewrites evidence already bound to an assessment.

No governed connectors

1 · Define read-only access Store a credential reference only. Secret values are rejected.

Source type Connector key Display name Governed source URI Collection mode Credential reference Approved adapters Select one or more normalized evidence adapters. Exact effective permissions Approved query template (JSON)

2 · Approve the exact fingerprint Only an engagement lead or organization administrator can approve.

Governed connector

Save an engagement and prepare a connector draft.

Approval rationale

3 · Freeze a collection The submitted JSON is normalized by the approved adapter, stripped of secret fields, hashed, and frozen as a distinct observation.

Adapter Evidence class Collected at Source system identity Source instance or tenant Source classification Executed query or filter (JSON) Collection payload (JSON)

Approved read-only permissions are copied into every frozen snapshot.

4 · Bind exact evidence Assessment runs resolve stored snapshot IDs and hashes—not the live source.

No frozen snapshots for the selected connector.

Temporal evidence knowledge graph

Trace what changed and every decision it affects

Freeze a versioned evidence-to-decision graph, keep current and historical truth separate, and test reuse against scope, period, owner, version, and continuing validity.

No graph snapshot

Each version is immutable, hash-chained, and bound to one engagement and assessment run.

Generate or load an assessment before materializing its temporal graph.

Impact query Ask which claims, scores, workpapers, reports, and approvals depend on an exact entity.

Select an entity to trace its governed downstream dependencies.

Governed fact reuse Reuse is blocked unless every source and continuing-validity check passes.

No fact-reuse decision recorded for this engagement.

Immutable graph history

No graph versions recorded.

Reusable engagement accelerators

Start from governed knowledge, not prior conclusions

Apply an approved archetype or clone the current engagement with an explicit evidence period and continuing-validity decisions.

Loading approved accelerators

Approved accelerator

Choose a preset to inspect its archetype, evidence requests, control bundles, risk criteria, workpaper program, and report template.

Reusable organization facts I confirm this preset is applicable as a planning starting point; every fact and conclusion still requires current evidence. Applicability rationale

Create a governed recurring version The current saved engagement is the source. Prior evidence, conclusions, decisions, and approvals are always invalidated.

New engagement title

Evidence period start Evidence period end

Continuing-validity decisions

Organization facts

Scope and architecture

Risk criteria

Workpaper program

Report template

Prior evidenceInvalidated · acquire and preserve evidence for the new period

Prior conclusions and approvalsInvalidated · reassess and obtain fresh human decisions

Save or load an engagement, then preview what will be inherited, refreshed, invalidated, or newly generated.

AI-assisted workflow

Generate complete assessment

Index evidence, test sufficiency, derive architecture, identify STRIDE risk scenarios, prepare workpapers, and create a reviewable draft.

01EvidenceAwaiting run
02ArchitectureAwaiting run
03Risk identificationAwaiting run
04Risk assessmentAwaiting run
05WorkpapersAwaiting run
06ReportAwaiting run

Add evidence, select an assessment model, then generate a complete draft.

Evidence analyst

Review normalized facts

Compare normalized facts with exact source wording. Suspicious document instructions are isolated as untrusted evidence and never executed.

Awaiting assessment

Independent reviewer name Enterprise identity overrides this field. The reviewer must be independent from the assessor.

Batch current view Filters and the current page define the batch. Valid facts are accepted and hostile instructions are acknowledged and quarantined; edits and rejections remain individual decisions.

No eligible decisions in the current view

Batch assessor rationale Batch independent review note

0 facts

Client report and supporting records Client PDF and DOCX exports are limited to 20 rendered pages. Material findings remain traceable to the complete supporting records.

The package includes the editable report, its PDF, and complete supporting records from one snapshot. Edited DOCX files require a new page check.

Supporting workpapers and data

Generate a complete assessment before exporting.

Review narrative and structured tables from the same immutable snapshot before export.

Governed report workspace

One-source reporting

Preview, trace, and govern the report

Every narrative block and table links back to its claims, workpapers, risks, or exact evidence passages. Narrative edits create a new immutable version and cannot change structured facts.

Load a completed assessment

Organization report style

Choose an approved versioned profile for formatting, confidentiality, distribution, and signatories.

Approved style profile

Create a new organization style version

Profile key Profile name Organization name Organization logo (PNG or JPEG, maximum 1 MB) Use only a logo that your organization is authorized to reproduce. Pythia does not bundle third-party branding. Logo alternative text Remove existing organization logo Font family Primary color Accent color Confidentiality label Distribution Signatory roles Version reason

Open the source-linked preview after a complete assessment is available.

Independent review

Change-first reviewer workspace

Start with new, changed, high-risk, uncertain, and exception items. Inspect-all mode remains available for independent judgement.

Review mode

Saved reviewer views

Reuse a personal, engagement-scoped queue view without changing assessment decisions or hiding the inspect-all option.

No saved view selected.

Generate or load an assessment to build the reviewer queue.

Reviewer-efficiency evidence

Changes-first benchmark

Modeled work units compare queue scope; seeded material errors verify that prioritization does not reduce detection.

Load an assessment to calculate the modeled benchmark.

Governed system model

Architecture exception review

Confirm cited candidates, approve explicit assumptions, or edit, merge, split, and reject material inferences. Structural changes invalidate dependent analysis.

Load an assessment to inspect its architecture revision.

No governed architecture model loaded.

Apply architecture decision 0 architecture elements selected

Operation Result fields Use field=value lines for edit or merge. For split, enter one resulting name per line. Approved assumption rationale Attributable decision reason

Pure STRIDE completeness

Element/category coverage matrix

Resolve every in-scope element and STRIDE category as a cited threat, a cited not-applicable judgement, or an explicit evidence gap.

Load an assessment to inspect STRIDE coverage.

Show Category Rows per page

0 coverage pairs

No STRIDE coverage matrix loaded.

Review by exception

Lossless threat families

Review related scenarios together while retaining every affected asset, risk, citation, control, and material difference.

Load an assessment to inspect threat families.

Organization wording templates

Use only immutable, organization-approved bilingual wording. Templates change presentation, never threat membership, evidence, mappings, scores, or decisions.

No approved organization templates loaded.

Pythia default wording remains available.

Template key Template name STRIDE category English wording Simplified-Chinese wording Approval reason

Unsafe bulk acceptance is disabled when evidence conflicts, support is missing, or consequences differ.

No threat families loaded.

Downstream context only

ATT&CK, CAPEC, and CWE applicability

Confirm relevant enrichment after threat-family review. These mappings never establish threat discovery, attribution, reachability, likelihood, or business risk.

Load an assessment to inspect mapping candidates.

Framework Search mappings Items per page

0 mappings

No intelligence mappings loaded.

Decision acceleration

ATT&CK assurance coverage

Compare relevant threats, evidenced controls, detection coverage, validation status, and residual gaps without treating ATT&CK as a completion checklist.

Load an assessment to build its assurance layer.

SolidReviewGap / excluded

No coverage layer loaded.

Every cell keeps its Pythia IDs, exact citations, controls, tests, and risks. A colored ATT&CK cell is never proof of complete defense.

Reusable mitigation

Governed control bundles

Apply approved guidance across relevant risk scenarios while retaining every underlying record and evidence link.

Load an assessment to recommend reusable controls.

No control bundles loaded.

Apply bundle lifecycle0 bundles selected

State Control evidence passages Attributable rationale

Suggested, designed, implemented, tested, and effective are separate states. Pythia never reduces residual risk until operating effectiveness is evidenced.

Controlled residual risk

Evidence-bound residual-risk reassessment

Reassess a linked risk only after a complete Effective control test. Pythia calculates the selected factors and preserves the exact test fingerprint; it never reduces risk automatically.

Load an assessment to review eligible residual risks.

No residual-risk reassessments loaded.

A lower score is published only from a human-recorded deterministic calculation bound to current Effective control-test fingerprints and exact evidence.

Explainable prioritization

Deterministic scoring review

Review evidence-proposed factors beside their exact citations, see the formula, and focus on unsupported, disputed, or decision-sensitive judgements.

Load an assessment to review scoring rationale.

No scoring proposals loaded.

Bulk confirmation is permitted only when criteria version, evidence quality, and consequence type match. Scoring confirmation never reduces residual risk.

Decision-grade uncertainty

Calibrated confidence and quantitative risk

Keep evidence, model, and risk uncertainty separate. Empirical bands require reviewed benchmarks; FAIR-style estimates require explicit selection and exact frequency and loss evidence.

Load an assessment to inspect uncertainty.

Reviewed benchmark calibrationExtraction, mapping, scenario, and conclusion are calibrated independently.

No calibration analysis loaded.

Risk uncertainty registerSee the assumptions and factor changes that can alter treatment.

No risk uncertainty records loaded.

Configure reviewed benchmarks and optional quantitative analysis

Add a reviewed benchmark outcomeEach result is attributed and appended to an immutable configuration version.

Confidence stage Predicted confidence (0–1) Reviewed outcome Benchmark ID Reviewed benchmark source Attributable change rationale

Optional FAIR-style scenarioNo value is inferred. Leave incomplete inputs visible and Pythia will return “insufficient evidence” without an estimate.

Explicitly select quantitative supplement Risk scenario

Annual event frequency Minimum Most likely Maximum

Frequency rationale Frequency evidence passages

Loss per event Minimum Most likely Maximum

Currency Loss rationale Loss evidence passages Attributable change rationale

Quantitative analysis is not selected.

Uncalibrated confidence is never presented as probability. Quantitative output is supplementary and never replaces the authoritative Pure STRIDE or CSA-Informed CII rating.

Governed investment planning

Remediation portfolios

Rank shared risk treatments, compare constrained delivery options, approve a fingerprint-bound portfolio, and retain ticketing or GRC receipts.

Load an assessment to plan remediation.

Review constraints, estimates, ownership, and validation

Version the planning basisDefaults are planning estimates. Confirm them or record an action-specific override before approval.

Currency First-year budget Delivery window (days) Maximum disruption Minimum risk score Target due date Constraints confirmed with the accountable delivery owner Cost, effort, dependencies, and validation estimates reviewed

Optional action-specific override

Action Accountable owner Due date Implementation days Implementation cost Annual operating cost Validation cost Operational disruption Dependency bundle keys Validation plan Planning assumptions

Attributable change rationale

Ranked investment actionsShared controls and highest supported risk scores appear first.

No remediation actions loaded.

Constrained portfoliosCompare budget, delivery, disruption, exclusions, and modeled benefit.

No remediation portfolios loaded.

Synchronize approved actions with ticketing or GRC

No synchronization receipts recorded.

Modeled benefit is planning support, not validated control effectiveness. Current residual risk is retained until operating effectiveness is evidenced and the affected risks are reassessed.

Independent machine challenge

Adversarial verification

Six separated roles challenge generated conclusions. Deterministic validators—not model agreement—decide whether the draft may become Assessor Reviewed.

Load an assessment to run adversarial verification.

Disagreements and critic findingsBlocking findings appear first with exact evidence and a concise resolution path.

Focus

No adversarial review loaded.

Rejected candidates and quality telemetry

Rejected candidates

No rejected candidates.

Method and prompt quality

No telemetry loaded.

Governed evidence contradiction resolutions

Load an assessment to inspect evidence conflicts.

No contradiction workflow loaded.

A model cannot approve another model. Unsupported conclusions and contradictory evidence must be detected before Assessor Reviewed, then rejected or resolved through an attributable, evidence-bound workflow.

Full independent decision history

Prioritized review queue

No assessment run loaded.

Accountable ownership

Residual-risk acceptance

An assigned risk owner must explicitly accept every assessor-confirmed residual risk. Acceptances are time-bound, evidence-linked, versioned, and invalidated by reassessment.

No assessment loaded

Risk tolerance and treatment policy

No governed policy configured.

Policy name Tolerance ceiling Low due days Moderate due days Medium due days Medium High due days High due days Very High due days Low acceptance days Moderate acceptance days Medium acceptance days Medium High acceptance days High acceptance days Very High acceptance days Authority roles by level Authoritative policy references Change rationale

Select all outstanding risks 0 risks selected

Treatment Acceptance expires Treatment status Treatment due Authority basis Risk-owner rationale Conditions Evidence references

Risks per page 0 risks

Generate and review an assessment before recording risk ownership.

Recurring assessment

Prepare the next assessment

Compare updated evidence with the current assessment. Review what needs fresh work and which prior tests may remain useful before creating the next draft.

Load a completed assessment, then update the evidence intake to preview the impact.

Continuous assurance

Scheduled change monitoring

Bind repository, system, policy, or methodology observations to an approved baseline. Editorial changes stay quiet; material changes open an accountable reassessment route and withdraw stale approval when required.

Load a completed assessment to configure monitoring.

Configure a governed monitor

Monitor key Monitor name Source type Source reference Cadence Starts at Accountable owner Independent reviewer Purpose

Approval rationale

Approval binds the exact monitor fingerprint. A different authorized lead must approve in enterprise mode.

No continuous-assurance monitors configured.

Record a normalized change observation

Approved monitor Change category Severity Changed object Frozen snapshot ID Change summary Repository and system monitors derive changes from the frozen baseline and current snapshot; manual change claims are disabled.

Third-party assurance

Supplier and software supply chain

Model services, software, build and support dependencies; keep inherited controls separate from customer-operated controls; and expose concentration, expiry, transitive path, and contingency gaps.

Load a completed assessment to review supply-chain assurance.

No governed supplier profile.

Add supplier or service

Entity key Name Provider Entity type Criticality Owner Review cadence Assurance expires Incident notification hours Description Business services Access and shared-responsibility scope Data scope Contract reference Assurance report SBOM reference VEX status Attestation reference Exceptions Evidence references Incident obligations Exit plan Substitute Isolation or failover

Link a dependency

Record inherited-control reliance

Add supplier records, dependencies, and inherited controls to the draft.

Version reason Independent approval rationale

Save a profile to generate transitive paths, concentration risks, expiry, and contingency analysis.

Enterprise intelligence

Cross-framework and portfolio intelligence

Map exact evidence-backed records to versioned criteria without copying conclusions, then view tenant-safe portfolios whose metrics drill down to assessment versions. Unknown or stale coverage never appears as low risk.

Load a completed assessment to configure framework mappings.

No portfolio intelligence loaded.

Add a versioned criteria mapping

Review enterprise portfolio

Portfolio dimension

Refresh to load governed portfolio metrics.

No draft framework mappings.

Version reason Independent approval rationale

Governed improvement

AI assurance evaluation and change control

Turn assessor outcomes into bounded proposals, measure them against golden and adversarial cases, and require regression, security, privacy, approval, version, and rollback evidence before a separate manual deployment record.

Save an engagement to govern an improvement evaluation.

No governed improvement scorecard.

Configure benchmark and candidate evaluation

Proposal key Change type Title Owner Candidate version Rollback reference Description Source assessor/reviewer decisions Benchmark casesOne per line: case ID | type | governed dataset reference | expected assertion. Baseline metrics Candidate metricsUse one metric=value per line. All quality, bias, drift, data handling, cost, latency, override, and incident metrics are required.

Required invariants Evidence traceability Methodology isolation Approval integrity Privacy Security Reproducibility Rollback verified

Security review Security reviewer Change approval Change approver Evaluation evidence Evaluation notes Version reason

No assurance-improvement versions.

Independent approval rationale Release reference Deployment environment Manual deployment rationale Incident or decision reference Rollback rationale

Efficiency benchmark and release scorecard

Historical measurement definitions are retained here. Handler runtime and the earlier 60% touch-time target do not establish the new 50% total human-effort target. Use Human work time for that comparison.

No template loaded. Measurements remain empty until people perform the study.

No privacy-safe workflow timing has been recorded.

Measured evidence

Manual benchmark baseline

Register at least three privacy-safe representative cases. A reviewer must approve the immutable baseline before it can support a comparison.

Baseline label Measurement date Measured cases Representative cases One case per line: reference | assessment type | evidence size | analyst experience | deployment profile.

Manual average per case Touch time (minutes) Interactions Defects Overrides Reviewer findings Report corrections Evidence lookup (minutes) Duplicate rework Reviewer rationale time (minutes) Isolated reassessment (minutes)

Manual quality baseline (%) Citation accuracy Threat coverage Issue detection Approval integrity Accessibility pass rate User trust

Benchmark workpaper references

Independent approval reason

No manual baseline versions recorded.

Governed outcome

Release efficiency scorecard

Publish observed results against an approved baseline. Missing measurements produce an insufficient-evidence scorecard, never an inferred saving.

Approved manual baseline Release label Observed study cases Observed representative cases The release gate requires novice, experienced, and reviewer coverage and an exact paired match with the approved manual cases.

Observed study average per case

Interactions come only from Pythia telemetry. Touch time adds only eligible, run-bound offline diary observations and labels that combined basis explicitly.

Defects Overrides Reviewer findings Report corrections Evidence lookup (minutes) Duplicate rework Reviewer rationale time (minutes) Isolated reassessment (minutes) Time to review queue (minutes) Material claims cited (%) Bulk/exception review (%)

Observed quality study (%) Citation accuracy Threat coverage Issue detection Approval integrity Accessibility pass rate User trust

Observed study references Unresolved risks I reviewed and accurately recorded the unresolved risks. Next improvements

No release scorecard has been published.

Optional observed work

Offline analyst time diary

Record stakeholder follow-up and other work performed outside Pythia. Entries are immutable, hash-chained, and kept separate from application telemetry and modeled estimates.

Activity date Duration (minutes) Assessment stage Activity type Privacy-safe case reference Non-sensitive noteMaximum 240 characters. Evidence content belongs in the governed evidence workspace, not this diary. I confirm the note contains no evidence, personal data, credentials, or secrets.

No diary entries recorded.

No offline work recorded.

Workpaper

Generated assessor checklist

Record evidence, test result, assessor conclusion, and reviewer note for each procedure.

Not generated

Filter

Generate a checklist after selecting an assessment model.

Finding workbench

Auditor-grade draft findings

Review condition, criteria, cause, consequence, rating, evidence, and recommendation as one governed record.

No findings generated

Complete an assessment to generate draft findings.

Immutable history

Audit trail

Append-only events are linked by SHA-256 hashes and verified whenever this timeline loads.

No saved engagement

Save the engagement to begin the audit trail.

Start a focused assessment

Choose evidence, select a surface, and run Pythia.

Top Residual Risks

Evidence Health

Security Next Actions

Mitigation Timeline

Evidence-gated assessment

Jump to an assessment section

Define the assessment before requesting evidence

Assign accountability for every assessment output

Turn evidence gaps into accountable requests

Set and enforce evidence-recency policy

Scan and quarantine evidence before use

Freeze source-system evidence before assessment use

Trace what changed and every decision it affects

Start from governed knowledge, not prior conclusions

Generate complete assessment

Preview, trace, and govern the report

Organization report style

Change-first reviewer workspace

Changes-first benchmark

Architecture exception review

Element/category coverage matrix

Lossless threat families

ATT&CK, CAPEC, and CWE applicability

ATT&CK assurance coverage

Governed control bundles

Evidence-bound residual-risk reassessment

Deterministic scoring review

Calibrated confidence and quantitative risk

Remediation portfolios

Adversarial verification

Prioritized review queue

Residual-risk acceptance

Prepare the next assessment

Scheduled change monitoring

Supplier and software supply chain

Cross-framework and portfolio intelligence

AI assurance evaluation and change control

Manual benchmark baseline

Release efficiency scorecard

Offline analyst time diary

Evidence readiness

Evidence request list

Generated assessor checklist

Auditor-grade draft findings

Evidence-gated 5×5 calculator

Assessor conclusion

Audit trail

Evidence to Security Decision

Stage Evidence Trace

Checkpoint Ledger

Assessment Case

Evidence Intake

Clear the loaded evidence selection?

Governed source metadata

Scheduled evidence disposition

Immutable records archive

Audit and SIEM forwarding

Governed GRC and ticket handoff

Advanced Optional Context

Evidence to Architecture Draft

Analysis Results

Security Findings Register

Challenge Every Finding

Guided Risk Triage

Security Decision Pack

Governed Evidence Search

Evidence passages

Evidence-grounded answer