Sola Lumina - Enterprise Security Brain

Sola Lumina is the Enterprise Security Brain: the shared context layer your analysts and AI agents both reason from. It continuously resolves how your identities, cloud, SaaS, and business systems connect, including permissions, reachability, blast radius, and ownership, so every question is answered from evidence already in place.

THE PROBLEM IS UNDERSTANDING, NOT DATA Security data lives in your security tools, AWS accounts, SaaS apps, AI tools, and internal docs, and none of it naturally talks to each other. An analyst can spend close to an hour on one alert working out what it touches, who owns it, and whether it matters. Two-thirds of SOC teams lose about a fifth of their week to manual cross-tool correlation. AI agents don't close the gap: they rebuild the same picture of your environment on every question, burning tokens and often stopping at a sample.

Sola Lumina does that work ahead of time. For example, on AWS, it resolves IAM policies, wildcard expansions, assume-role chains, and cross-account exposure across multi-account environments, then connects them to identity providers (Okta, Entra ID), GitHub, SaaS apps, and business systems. An answer becomes a lookup against resolved context, not a reconstruction through thousands of rate-limited API calls.

ONE BRAIN, THREE WAYS TO USE IT

1. For security teams: ask Sola in the Sola Assistant or Slack to investigate exposure, ownership, reachability, and business impact.
2. For AI agents: bring your own agent over MCP, build a custom agent inside Sola, or turn on Lumina Signals, a pre-built agent that surfaces risk proactively with nothing to configure. All three reason from the same governed context.
3. For your existing tools: let your SIEM, internal apps, and workflows pull Sola context over API or MCP, replacing nothing.

WHAT TEAMS USE IT FOR

• SOC alert triage: an EDR flags one process on ten hosts, each with the same severity. Sola shows how far each could spread and which business systems sit in its path, so you contain the worst first.

• CNAPP finding validation: a finding looks the same whether it's dormant or actively exploitable until someone checks identity, ownership, and what it can reach. Sola weighs every cloud and code finding against that context, so validated risk is separated from noise before anyone opens a ticket.

• SaaS risk, without a new tool: SaaS often sits outside your core stack, so visibility is only as current as last year's audit. Sola watches it continuously: admin sprawl and risky OAuth grants, tied to who holds them and what else they reach.

• GRC, grounded in evidence: proving a control is covered usually means stitching together a dozen systems by hand. Sola already has ownership, criticality, and policy resolved, ready whether a person or your own compliance agent asks.

• Detection engineering, without the spreadsheet: your ATT&CK coverage lives in spreadsheets and tribal knowledge, while noisy rules flood the queue. Sola finds the gaps and the noisiest alerts, then suggests fixes based on your SIEM's syntax.

• AI and agent governance: API keys, MCP servers, and AI tools spread faster than anyone can inventory them, and none of your existing tooling was built to watch this surface. Sola extends the same resolved context to cover it, so a stale key shows up next to every other exposure, not in a separate tool.

QUESTIONS YOU CAN ASK ON DAY ONE

• If this IAM role or EC2 instance is compromised, which business systems and SaaS environments can it reach?
• Is this critical misconfiguration actually exploitable, or dormant and isolated?
• Which identities with elevated AWS permissions also have access to our source code repositories?
• Which offboarded employees or OAuth grants still hold admin access across cloud and SaaS?
• Which API keys, MCP servers, and AI tools exist across the company, and what data can they reach?

WHY TEAMS TRUST IT

• Grounded: every answer carries its evidence chain and reasoning trail. When the underlying data is incomplete, Sola says so instead of guessing.
• Governed: Sola connects to your environment read-only. Analysts and agents use one governed layer instead of each holding its own production credentials, and nothing takes action on its own.
• Open: vendor-neutral. Sola works alongside your AWS-native and third-party security tools, with no rip-and-replace.

MEASURED, NOT JUST CLAIMED Sola's published, reproducible benchmarks (arXiv 2606.02674, 2609.30345) found:

• Structured context raised answer correctness by about 34% (relative) and cut exploration queries by about 70% versus a context-free agent.
• Against two leading general-purpose AI coding agents investigating the same live AWS environment across 28 tasks, Sola delivered 1.6x to 1.95x the coverage, at 96-97% lower cost per insight, and 1.4x to 1.5x faster. It led on 24 of 28 tasks.

See Sola on your own environment. Most teams see a concrete result in days, on their own data.