Design Partner Program
NECTAR · GOVERNED AI SECURITY VALIDATION ENGINE

Recursive reasoning. Governed execution. Evidence you can act on.

Nectar is Hayrok’s security validation engine and recursive graph reasoning AI in one. It connects security relationships, forms testable attack hypotheses, and executes governed adversarial validation through specialized agents. As evidence arrives, it refines the investigation and determines the next permitted step.

Ask·Hypothesize·Authorize·Observe·Refine
01 · SECURITY VALIDATION ENGINE

Meet Nectar: Reasoning and Validation, Now One Product

Nectar is both Hayrok’s reasoning AI and its security validation engine. Reasoning decides what to test next. The validation engine executes approved scenarios and records what happened. Both run inside the same authorized plan.

REASONING

Decide what is worth proving.

01Investigation over assets, identities, and trust boundaries
02Attack hypothesis formation
03Governed validation planning
04Evidence-guided refinement and reporting
VALIDATION ENGINE

Prove it, within the authority you grant.

01Approved scenario execution under configured identities
02Outcome validation: reproduced, observed, or not confirmed
03Control and detection correlation
04Replayable evidence and remediation verification
02 · PLAIN LANGUAGE TO PLAN

Natural-Language Validation: Ask Plainly, Get a Governed Plan

Describe the security question the way your team would say it. Nectar identifies the intent, targets, identities, and environment, maps them to approved scenarios, and checks every step against your policies before anything is proposed for approval.

Ask NectarPlain text in. Structured, governed plan out.
0 / 280
TRY AN EXAMPLE
WHAT NECTAR UNDERSTOODclick environment to switch
GOVERNED VALIDATION PLANplan_4799 · staging Waiting for input

Describe what you want to validate

PROPOSED STEPSclick a step to include or exclude
POLICY CHECKS
✓Target in approved scope✓Published scenario version✓Read-only methods✓Synthetic data only✓Staging environment
APPROVALGenerate a plan to see its approval requirements.
03 · RECURSIVE GRAPH REASONING

Adaptive Investigation: It Changes as the Evidence Changes

Nectar reasons over the relationships available to the investigation: assets, identities, permissions, trust boundaries, weaknesses, attack paths, controls, and evidence. That is how Nectar validates attack paths instead of listing findings. New evidence can confirm a relationship, challenge an assumption, or reveal that more context is required.

customer_a cross-user access ord_B-1042
Recorded caller identitycustomer_a session configured for the testSource assertion
Resource ownershipord_B-1042 owned by customer_bSource assertion
Returned test dataNo authorized request executed yetUnresolved

A generated path or visual proximity does not establish that the attack step succeeded. The edge stays hypothesized until evidence supports it.

WHAT THE GRAPH HELPS CONNECT
01Which identity is acting on which resource.
02Which permission or business rule should constrain the action.
03Which operation or path is relevant to the hypothesis.
04Which observation supports or contradicts the expected behavior.
05Which relationships remain inferred or untested.
06Which next step is compatible with the approved plan.

Confirmed observations, source assertions, inferred relationships, and unknowns remain distinguishable.

04 · GOVERNED AUTONOMOUS SECURITY TESTING

Nectar Agents: One Engine, Specialized Agents in Concert

Governed autonomous security testing, coordinated by one engine. Nectar runs the investigation, planning, execution, validation, and reporting work. Each agent operates inside the same authorized plan, and results flow back into the investigation.

AGENT 01 / 06hands off to Hypothesis → Reconnaissance and investigation Examine authorized targets and gather the context required by the validation question.

Validation results loop back to hypothesis formation, so the investigation refines itself. Your team retains authority over scope and operating conditions.

NECTARRecon
05 · WORKFLOW STAGES

How Nectar Reasons: Hypothesis, Observation, Next Step

STAGE 01 OF 06 Set the objective Define the authorized target, security question, identities, and expected boundary.
ILLUSTRATIVE INVESTIGATIONCross-user order access Planning
OBJECTIVEDetermine whether Customer A can retrieve Customer B's synthetic order in staging.
06 · EVIDENCE RECORDS

Replayable Evidence: A Record Engineers Can Inspect

Follow a finding from the approved objective to the observed result and the verification after remediation. Each event keeps its own scope, timestamp, and artifacts.

EVIDENCE RECORD · EV-2291Cross-user order disclosureSYNTHETIC
ORIGINAL RESULTObserved Cross-user order disclosure
expected403
observed200 · order data returned
scenariov3.2
The finding is scoped to orders-api in staging for the tested identities.
identitiesownershipchronologyredacted artifacts

Evidence Fabric preserves the connected records and artifacts. Replayable evidence lets authorized users inspect what happened; a new test follows current readiness and authorization requirements.

View Example Evidence →
07 · CONTROL AND DETECTION VALIDATION

Control Effectiveness: Nectar Reads What Your Controls Saw

Correlate each executed step with supported telemetry from your security stack. Nectar reviews whether a control blocked the activity, whether a detection fired, and whether an alert reached the owning team.

SOURCE 01 / 12EDR
✓PreventionWas the executed activity blocked or contained on the host?
✓DetectionDid a host detection record the step?

An absence of telemetry does not by itself establish that a detection failed. Missing or delayed sources stay visible as unresolved.

NECTAR · TELEMETRYCrowdStrikeEDRRead-only
08 · VALIDATION USE CASES

Business-Aware Reasoning: The Boundaries That Matter to You

Each scenario uses compatible configured identities, resources, and operating requirements.

01Web application exposure Investigate supported technical weaknesses and authenticated application behavior in the relevant access context.
02API authorization and operations Assess object access, restricted functions, service permissions, and sensitive operations.
03Business logic and commerce Validate defined promotion, approval, transaction, order, refund, and entitlement rules using approved resources.
04Identity and lifecycle Compare expected access with observed permissions, sessions, and supported identity changes.
05Tenant and organization isolation Assess whether configured identities can cross approved user or organization boundaries.
06AI-enabled applications and APIs Assess supported prompt-injection, data-exposure, retrieval, and action boundaries.
07Remediation verification Retest the affected condition and preserve the evidence of what changed.
09 · BOUNDED AUTONOMY

Governed Autonomy: Adaptive Reasoning, Explicit Boundaries

Nectar can refine an investigation as evidence arrives. Before any next step runs, it is checked against the authority, scope, and conditions your organization grants.

New evidence does not grant new authority. Approval-sensitive plan changes return to review.

PROPOSED NEXT STEPGET /invoices/{id} on orders-api
·Target in approved scopeorders-api · staging
·Published scenario versionownership.invoices v1.4
·Identities unchangedcustomer_a, customer_b
·Actions within planread-only GET
·Budget remaining14 of 20 requests
·Approval still validapproved 07:12 · expires 18:00
Checking against VP-0418…Six checks before any step runs
01

Target and identity scope

Restrict activity to authorized assets, environments, users, services, and resources.

02

Published coverage

Use approved, versioned scenarios compatible with the selected objective and target.

03

Plans and approvals

Review permitted activity and satisfy required approvals before execution.

04

Budgets and stop conditions

Apply supported operating windows, request and resource limits, and stop controls.

05

Changes and recovery

Define permitted state changes, test fixtures, cleanup, and recovery conditions.

06

Access and auditability

Keep credential use, evidence access, actions, and authorization records appropriately controlled.

10 · GOVERNED AI

Governed AI: Reasons Freely, Acts Only on Your Authority

Nectar is an AI that plans and adapts, but it never grants itself permission. Every action it takes is tied to a named human approval, a defined scope, and a reasoning record your team can inspect.

AI AUTHORITY MATRIXscope: prod-web · tenant_a
ROLEPROPOSEAPPROVEEXECUTEEXPORT
Nectar✓–✓✓
Approver✓✓–✓
Analyst✓––✓
MCP assistant✓–––
Nectar executes only plans a named human approver has authorized.
01

Human approval, always

Nectar proposes. People approve. No AI agent, including assistants connected through MCP, can approve its own plan.

02

Explainable reasoning

Each proposed step shows the evidence and the reasoning behind it, so approvers know why before they authorize.

03

Bounded by scope

Targets, time windows, rate limits, and exclusions are set by your team and enforced on every AI action.

04

Every AI decision recorded

Prompts, plans, approvals, executions, and results are logged with actor, time, and scope, and can be exported.

11 · TENANT ISOLATION

Tenant Isolation: Every Tenant Is Its Own Hive

Nectar runs inside a dedicated boundary for each organization. Findings, evidence, credentials, and agent activity stay partitioned from every other customer.

Isolation is enforced by the platform, not by policy alone.

ISOLATION BOUNDARY Enforced
Your organizationtenant_aCALLER
Data partitionpart_a
Encryption keyskms_a
Agent runtimert_a
Credentials vaultvault_a
Evidence storeevd_a
Audit loglog_a
ISOLATION WALL
Another organizationtenant_bSEALED
Data partitionpart_b
Encryption keyskms_b
Agent runtimert_b
Credentials vaultvault_b
Evidence storeevd_b
Audit loglog_b
BOUNDARY LOG
09:43:20ALLOWtenant_a → part_a · read
09:43:20ALLOWtenant_a → evd_a · write
01

Tenant-scoped resources

Data, keys, credentials, agent runtimes, and evidence are provisioned per tenant.

02

No cross-tenant reach

No query, plan, or agent can address another tenant. Attempts are blocked and logged.

03

Your data stays yours

Tenant data is used to run your validations only. It is not pooled across customers.

12 · AUDIT AND POLICY

Audit and Control: Replay Every Step, Write the Rules

Each Nectar action and decision is recorded as a replayable step, with the inputs, reasoning, and policy checks behind it. Define custom policies for how Nectar is used, and every step is evaluated against them before it runs.

DECISION REPLAYrun_0418 · orders-api
STEP 03 · APPROVALstep_0418_03
actorpriya@ (Approver)
decisionApproved as proposed
policyPOL-approve-03 · named approver · pass
window09:43 to 10:43 UTC
CUSTOM POLICIESHow Nectar may be used in tenant_a 4 of 4 active
# policies/approvals.yaml
rule: require_approval
when:
scope.env: production
require:
approvers: 1
role: approver
self_approval: false
13 · WHERE YOU WORK

Integrations: Ask Nectar From the Tools You Use

Through the Hive MCP server, approved assistants can query findings, read evidence, and propose validations. Proposals land in Hive for review; nothing executes without authorization.

WORKS WITH
ClaudeChatGPTGeminiMicrosoft CopilotCursorVS CodeGitHubSlack
MCPHive MCP serverModel Context Protocol for AI assistants and agents
// available tools
list_findings(scope)read
get_evidence(finding_id)read
explain_finding(finding_id)read
propose_validation(objective)needs approval
Scoped access tokensRead-only by defaultProposals require approvalAudit-logged calls
14 · NECTAR INSIDE HIVE

Nectar and Hive: The Engine, and Your Team in Control

Use Hive to set objectives, configure context, review plans, authorize required actions, inspect evidence, and manage follow-up.

Work through structured validation flows, graphs, findings, evidence views, reports, and supported conversational interaction. Conversation is one feature of the workspace interface.

Explore the Hive Platform →
CONNECTED CONTEXT AND EVIDENCE
01 Scenario LibraryApproved scenario versions, compatibility, prerequisites, and evidence requirements.
02 Forage Exposure IntelligenceResearch-curated threat questions and approved scenario mappings.
03 AGIESupported relationship and attack-path context, with inferred and observed links distinguished.
04 CodeFabricsSupported software findings, artifact context, and code-to-cloud investigation inputs.
05 Runtime PresenceEnvironment-qualified observations, evidence, and freshness.
06 Hayrok Risk EngineSupported risk assessment factors and status alongside technical severity.
07 Evidence FabricRecords and artifacts supporting conclusions and verification history.

Nectar reasons across the available context while preserving what each source establishes. Intelligence, risk scores, inferred paths, and presence observations do not independently prove exploitation.

15 · FAQ

Nectar FAQ: What Evaluators Ask

Have a question we did not cover?Ask us in a walkthrough →

Nectar is Hayrok's governed AI security validation engine. It combines recursive graph reasoning with the validation engine that executes approved scenarios: investigation, planning, agent orchestration, governed adversarial execution, outcome validation, reporting, and evidence-guided refinement.

See Nectar Work: From Hypothesis to Inspectable Proof

Explore the reasoning context, review the governed plan, follow the coordinated execution, and inspect how evidence shapes the next step.

✓A scoped objective on your own applications or APIs✓The governed plan, approval, and execution✓Evidence records and verification after remediation
Book a Demo

NECTAR IN HIVE

See how Nectar reasons, validates and answers

Nectar recursive reasoning engine diagram: the Nectar bee icon at the centre connected to Intelligence, Policy, Validation and Proof, beside four principles: recursive reasoning, policy-bound, validation-first and evidence-driven
Nectar reasons across assets, identities, trust boundaries, weaknesses, attack paths, controls and evidence, then proves what execution establishes.
Nectar coordinating specialized validation agents, with the Validation node highlighted and the validation-first principle selected: plan compatible scenarios and coordinate agents to test each hypothesis
Validation-first: Nectar plans compatible scenarios and coordinates specialized agents to test each attack hypothesis.
Nectar assistant panel open beside the Hive All Findings dashboard, answering that 29 of 1,284 open findings are validated, reachable, revenue-bearing and uncontrolled, with cited sources and suggested follow-up questions
Nectar answers questions about the page you are on and cites the records behind every answer.