NECTAR · GOVERNED REASONING

The security assistant that answers from evidence .

Ask about findings, evidence, controls, detections, attack paths, remediation, and risk — and see the records behind every answer.

NECTAR · SECURITY INTELLIGENCENECTAR
◆
Grounded in evidence
Never invents validation
§
Citations everywhere
Traceable to records
🛡
Permission aware
Tenant & role enforced
✋
Human controlled
Nectar advises, never acts
01 · WHAT NECTAR IS

Security intelligence grounded in the validated record

Nectar sits on top of Hayrok's findings, Evidence Fabric, Attack Graph Intelligence, runtime context, control and detection responses, and validation history — turning the platform's record into understandable, actionable intelligence.

Nectar can help answer
→Why does this finding matter?
→What evidence proves exploitability?
→Which control failed? Was this detected?
→Is the vulnerable component actually running?
→Can an attacker reach the affected asset?
→What should we remediate first?
→How should we revalidate the fix?
→How do I explain this to the CISO?
02 · TWO ENGINES, ONE PLATFORM

Nectar reasons. Genesis executes.

Hayrok deliberately separates intelligence from adversarial execution. Nectar can recommend that a validation or revalidation should be performed — it does not independently launch it.

NECTAR
Intelligence + reasoning
Understands · explains
Summarizes · correlates
Recommends · guides
GENESIS
Governed orchestration
Plans · orchestrates
Policy · approval
Executes validation
Nectar → User decision → Genesis
03 · ANSWERS FROM EVIDENCE, NOT GUESSWORK

Nectar labels confidence honestly

Every answer distinguishes what the record proves from what it merely suggests — and Nectar is comfortable saying it doesn't know.

CONFIRMED
The record proves it
Validated evidence directly supports the conclusion.
OBSERVED
Relevant, not decisive
Evidence exists but doesn't fully establish the claim.
INFERRED
Contextual reasoning
Based on available context rather than direct validation.
UNKNOWN
Not enough evidence
Nectar will say so and recommend what to run next.
"
The available evidence does not establish that conclusion.
A sentence Nectar is designed to say. Evidence before assertion.
04 · THE NECTAR EXPERIENCE

Ask. Understand. Inspect the proof.

Try Nectar against a representative finding. Every answer is grounded in Hayrok's evidence and cites the specific records behind it.

◆ Nectar FINDING · HAY-2026-1041 · Object-level authorization failure REPRESENTATIVE DATA
EXPLAIN AS ·
CONVERSATION
You
Why does this finding matter?
◆
CONFIRMED answer confidence
This finding is critical because an authenticated user retrieved records outside their tenant boundary. Exploitation is confirmed in production, the API is publicly reachable, existing preventive controls allowed the request, and no detection fired. The validated path reaches the customer database directly.
CITED EVIDENCE
[2] Authorization validation exploit
[3] WAF control response control
[4] Detection expectation detection
[5] Attack path AGP-104 graph
[7] Crown-jewel classification business
Recommended next step: Enforce object-level authorization in the customer-api service. Prepare Revalidation →
SUGGESTED QUESTIONS
Why does this finding matter? What evidence proves exploitability? Which control failed? Was the activity detected? Can an attacker reach the crown jewel? What should we fix first? How should we revalidate the fix? Summarize this for the CISO. Could this exfiltrate the entire database?
Ask about this finding, evidence, or validation… Enter
EVIDENCE INSPECTOR
[2] Authorization validation exploit
RUN
RUN-2411
CAPTURED
10:04:22
AGENT
Exploit Agent
CONFIDENCE
CONFIRMED
GET /api/v1/customers/94821
Authorization: Bearer [REDACTED]
X-Tenant: tenant-a
→ HTTP 200 · record owner: tenant-b
chain of custody sanitized retained 365d
Nectar respects the same tenant, role, and asset permissions as the rest of Hayrok. Users cannot retrieve evidence through Nectar they aren't otherwise permitted to access.
05 · WHAT NECTAR CAN ANSWER

Nine areas of security intelligence

Ask about individual findings or the whole program. Nectar draws on the same record either way.

FINDINGS 10+ prompts
Ask about findings
Summarize risk, understand exploitability, identify affected assets, spot regressions.
EXAMPLE ASK
"Why is this exploitable? What changed since the last run?"
EVIDENCE 12 artifacts
Explain evidence
Translate raw request/response, runtime, and control artifacts into clear conclusions.
EXAMPLE ASK
"What does this response actually prove?"
DEFENSE WAF · GW · APP
Explain defensive response
What blocked, what allowed, what should have prevented — and what a compensating control would look like.
EXAMPLE ASK
"Why did the API gateway allow this request?"
DETECTION SIEM · EDR · CLOUD
Detection intelligence
Expected vs observed events, missing detections, alert latency, telemetry gaps.
EXAMPLE ASK
"Which missing detections affect our critical paths?"
ATTACK PATH AGP · CHOKE
Attack path intelligence
How exposures connect. Which relationships are confirmed vs modeled. Which fix breaks the most paths.
EXAMPLE ASK
"What is the shortest validated path to this crown jewel?"
REMEDIATION PRIORITY
Prioritize remediation
Ranked by confirmed exploitability, reachability, control failure, path position, and business context.
EXAMPLE ASK
"What should we fix first — and why?"
REVALIDATION SAME SCENARIO
Guide revalidation
Which scenario to rerun, what evidence proves the fix worked, which paths should disappear.
EXAMPLE ASK
"What would prove this is resolved?"
EXECUTIVE CISO · BOARD
Executive intelligence
Translate technical validation into leadership-ready narratives without losing the facts.
EXAMPLE ASK
"What does the board need to know this month?"
PROGRAM TRENDS
Validation intelligence
Cross-run patterns: repeat failures, telemetry gaps, regressions, crown-jewel movement.
EXAMPLE ASK
"Which controls repeatedly fail across our runs?"
06 · EVIDENCE BOUNDARIES

When Nectar can't answer, it says so

Nectar won't force a conclusion the record can't support. Instead, it shows what evidence exists, what's missing, and recommends the validation that would close the gap.

"Evidence before assertion."
QUESTION
Could this attacker exfiltrate the entire customer database?
NECTAR · UNKNOWN
The current record confirms unauthorized access to individual customer records but does not establish bulk database extraction. Additional validation would be required to support that conclusion.
✓ EVIDENCE AVAILABLE
Object-level authz failure · API reachability · Customer-record access
! EVIDENCE MISSING
Bulk access validation · Rate-control behavior · Database extraction path
Review Recommended Validation →
07 · GOVERNANCE BY DESIGN

AI assistance without bypassing control

Nectar inherits Hayrok's authorization boundaries. It can suggest — the platform still requires the appropriate identity, approval, and policy for anything real.

NECTAR RESPECTS
✓Tenant
✓Organization
✓User identity
✓Role & permissions
✓Environment
✓Asset access
✓Evidence access
✓Audit trail
NECTAR NEVER AUTONOMOUSLY
×Launches adversarial validation
×Expands scope or accepts risk
×Approves workflows or changes policy
×Modifies production systems
×Closes findings or edits evidence
×Executes remediation
08 · HOW NECTAR FITS

Reasoning before governed action

Nectar reads what Hayrok has validated, translates it, and hands users the reasoning to make a decision — Genesis takes it from there.

FOUNDATION
Assets · Telemetry · Findings
The raw record from integrations and Hayrok agents.
VALIDATION
Genesis + Evidence Fabric
Governed execution; every artifact linked to its run.
RELATIONSHIPS
Attack Graph Intelligence
Paths, choke points, crown-jewel proximity.
INTELLIGENCE
Nectar
Explain, correlate, recommend — with citations.
Nectar recommends → Human decides → Genesis executes under policy
09 · EMBEDDED WHERE YOU WORK

Nectar across the Hayrok experience

Not a separate chat page — context-aware wherever a security team already spends time.

HOME
Posture & run summaries
Explain the state of the program on the home page.
RUN
Run Validation
Scenario and readiness explanations, gate rationale.
ACTIVE
Active Validation
Live blockers, unexpected control response, agent status.
FINDINGS
Findings
Per-finding analysis, remediation guidance, revalidation preview.
EVIDENCE
Evidence
Interpret individual artifacts and evidence packages.
ATTACK MAP
Attack Paths
Explain paths, choke points, and modeled vs validated edges.
RISK
Risk Center
Business-risk summaries linked to validated evidence.
REPORTS
Reports & Assurance
Narrative generation, audit-friendly explanations.
10 · NOT ANOTHER SECURITY CHATBOT

Why Nectar is different

Generic assistants summarize whatever they're handed. Nectar is designed around the Hayrok validated record.

DIMENSION
GENERIC AI ASSISTANT
NECTAR
Grounding
Answers from supplied context
Answers from authorized Hayrok security context
Sources
May summarize unverified findings
Prioritizes validated records and evidence
Workflow fit
Often disconnected from workflows
Embedded throughout validation workflows
Provenance
Limited evidence provenance
Links answers to specific evidence records
Fact vs guess
May blur fact and inference
Distinguishes confirmed, observed, inferred, unknown
Recommendations
Generic recommendations
Recommendations informed by validation context
Graph awareness
Separate from attack graphs
Understands Hayrok attack-path context
Governance
Generic enterprise permissions
Enforces Hayrok tenant & authorization boundaries
11 · EVIDENCE-FIRST AI PRINCIPLES

Seven commitments behind every answer

01
Grounded
Responses derive from Hayrok evidence and authorized platform context.
02
Traceable
Important statements link back to their supporting records.
03
Explicit about uncertainty
Nectar distinguishes confirmed evidence from inference and unknowns.
04
Governed
Permissions and tenant boundaries determine what Nectar can access.
05
Advisory
Nectar recommends. It does not independently perform high-impact actions.
06
Human-controlled
Users remain responsible for decisions, approvals, and governed execution.
07
Auditable
Meaningful interactions and resulting actions can be recorded.
FAQ

Nectar · FAQ

What replaces Hay Assist?+
Nectar is the canonical name for Hayrok's evidence-grounded assistant. The /product/hay-assist URL redirects to /product/nectar.
Can Nectar take actions?+
No. Nectar explains and recommends. All governed actions — starting validations, changing policies, running remediation — go through Genesis and existing approval workflows.
What data does Nectar use?+
Only Hayrok evidence and platform context the user is authorized to see: findings, evidence artifacts, control/detection responses, attack paths, runtime and asset context, remediation and revalidation history.
Is Nectar audited?+
Meaningful interactions can be recorded with user, tenant, question, cited evidence, generated recommendation, and any resulting user action — subject to Hayrok's retention and privacy policies.

Ask better security questions. Get answers grounded in evidence.

Stop reconstructing findings from disconnected tools, logs, screenshots, and spreadsheets. Nectar shows what Hayrok validated, why it matters, how defenses responded, and what should happen next.