Nexus Atlas
Nexus Atlas: sovereign offensive assurance
Nexus Atlas is sovereign offensive assurance: continuous attack surface mapping, consent-gated authorised probing, AI-assisted analysis and a cryptographically signed dossier, all running inside the estate you control.
Attack surface, mapped outward from authorised scope
The domains, ranges and environments you declare and authorise at the start of the engagement. Everything else is measured against this boundary.
Subdomains, hosts, cloud services, edge endpoints and forgotten environments that resolve back to the authorised estate.
Supplier-hosted services, acquired assets and shared infrastructure that carry your name or route to your systems, flagged for a scope decision rather than probed by default.
Discovery expands outward from the estate you authorise. Anything outside the agreed boundary is recorded as out of scope and is not probed.
- mapping, not a point-in-time snapshot
- Continuousmapping, not a point-in-time snapshot
- non-destructive probing, consent-gated
- Authorisednon-destructive probing, consent-gated
- deployed in your estate, air-gap capable
- Sovereigndeployed in your estate, air-gap capable
- evidence dossier with chain of custody
- Signedevidence dossier with chain of custody
The buyer problem
Fragmented visibility, episodic testing and evidence that does not hold up.
Security leaders are asked a simple question by boards, regulators and ministers: what are we exposing, and how do you know? Most answers are assembled from several partial sources, none of which were current at the same moment.
Where the answer breaks down
- External visibility is split across scanners, spreadsheets and supplier reports
- Assessments are point-in-time, and the estate changes the week after
- Findings arrive unvalidated, so remediation owners re-verify before they act
- The evidence trail cannot show who authorised what, or when it ran
- Analysis leaves the organisation to be processed by a third party
What Atlas changes
- One current map of the external estate, maintained continuously
- Exposures confirmed by authorised, non-destructive checks before reporting
- Analyst review and priority applied before anything reaches an owner
- Authority, method, reviewer and timing recorded as chain of custody
- Discovery, analysis and evidence stay inside your boundary
Product definition
Continuous mapping, authorised probing, AI-assisted analysis, signed evidence.
Atlas is not a vulnerability scanner with a report attached. It is an assurance capability: it establishes authority, maps the estate, validates exposure within that authority, analyses what it found, and produces a signed record of the whole exercise.
01
Continuous mapping
02
Authorised probing
03
AI-assisted analysis
04
Signed evidence
How Atlas works
Scope, discover, validate, analyse, review, sign.
Each stage is gated by the one before it. Authority precedes discovery, discovery precedes validation, and human review precedes anything that reaches a remediation owner or an evidence package.
- 01
Define scope and authority
Boundaries, environments, assessment windows and named authorising parties are captured before any work runs. The authorisation record is part of the assessment, not an email attached to it.
Nothing runs without a recorded authorisation
- 02
Discover and map
Passive sources and ordinary external observation build a current map of what your organisation exposes, including infrastructure that was never registered centrally.
- 03
Validate through authorised probing
Where you have authorised it, non-destructive active checks confirm whether a candidate exposure is real, so the finding list reflects confirmed conditions rather than pattern matches.
Consent-gated, non-destructive, in-window only
- 04
Correlate and analyse
AI-assisted analysis groups related findings, links them to the assets and services they affect, and separates noise from conditions that change your exposure.
- 05
Review and prioritise
Analysts review ambiguous and high-impact findings, apply business context, and set the priority order before anything is published to a remediation owner.
Human review before publication
- 06
Produce a signed dossier
The assessment is packaged as a dated evidence dossier and cryptographically signed, so the record you hand to a regulator, board or remediation owner can be checked for integrity.
Signature covers the delivered record
Capabilities
What Atlas does.
A continuous assurance capability from external discovery through signed evidence.
Continuous attack surface discovery and mapping
External assets connected to your estate are discovered and re-discovered on a recurring cycle, so the map reflects the estate as it is now rather than as it was at the last assessment window.
Scoped and authorised active assessment
Active checks are non-destructive, bounded by the authorised scope and window, and recorded with the authority under which they ran. Assessment beyond that boundary requires a new authorisation.
AI-assisted correlation and analysis
Models running inside your boundary correlate findings across assets, cluster related exposures and draft analysis for a human reviewer. The model proposes, the analyst decides.
Evidence, chain of custody and signed reporting
Every finding carries the method that surfaced it, the check that validated it, the reviewer who accepted it and the time it happened, packaged into a signed dossier.
Sovereign deployment and offline operation
Atlas deploys into your on-premises, sovereign cloud or air-gapped environment. Assessment data, analysis and evidence stay inside the boundary you control.
Workflow orchestration and integrations
Approvals, escalations, ticket creation and delivery into your systems of record are inherited from the Nexus execution engine embedded in the product.
Authorisation
Scope and window are explicit
Method
Non-destructive by design
Boundary
Intrusive testing is separate
Deliverables
What you receive at the end of an assessment cycle.
The output is designed to be handed to someone else: a remediation owner, an auditor, a regulator or a board committee, without them having to re-verify the work.
Atlas assessment dossier
Cryptographically signed
Scope and authority record
The boundary that was assessed, the window it ran in, and the authorisation it ran under.
Mapped asset inventory
The external assets discovered within scope, with how each one was found.
Validated exposures
Confirmed conditions, with the non-destructive check performed and the observed response.
Prioritised findings
Analyst-reviewed priority order with the business context that informed it.
Evidence trail
The chain of custody from discovery through validation, review and publication.
Integrity signature
A cryptographic signature over the delivered dossier so recipients can verify it has not been altered.
The dossier is dated and versioned, so successive cycles can be compared to show whether exposure is reducing over time.
Illustrative finding summary
Representative structure, not a live customer assessment
- vpn.example-gov.ukRemote access gateway, authorised probeValidated, priority 1
- api-staging.example-gov.ukUnauthenticated API reachable externallyValidated, priority 1
- portal.example-gov.ukLegacy TLS configurationValidated, priority 2
- supplier-hosted.example.netAdjacent exposure, outside authorised scopeRecorded, not probed
- cdn-assets.example-gov.ukStatic asset hostReviewed, informational
Priority reflects the asset's role and the confirmed condition, not a generic scanner score. Assets outside the authorised boundary are recorded for a scope decision and are not probed.
Use cases
Who runs Atlas, and the question they are answering.
Atlas is usually bought to answer a specific accountability question rather than as a general-purpose tool.
Public sector
National CERT and government
Establishing an accurate, current picture of what a national or departmental estate exposes, with an evidence record that survives scrutiny.
Defence
Defence and national security
Assurance work that must run inside a controlled or air-gapped boundary, with authority, custody and integrity recorded end to end.
Financial services, healthcare, utilities
Regulated enterprise
Continuous exposure validation that produces evidence a regulator, auditor or board committee can rely on without re-verification.
Supply chain
Third-party and supplier exposure review
Applying the same scoped, authorised process to supplier and subsidiary estates whose exposure carries through to you.
CTEM
Continuous validation between assessments
Keeping exposure current in the months between formal penetration tests and annual assurance exercises.
Corporate
Merger, acquisition and divestment
Confirming what an incoming estate exposes, or that a divested estate no longer routes through infrastructure you retain.
Why Atlas
Sovereign by design, continuous by default, evidenced for regulated decisions.
The difference is not the number of checks. It is where the work runs, what authority it runs under, and whether the output can be relied on by someone who was not in the room.
Sovereign by design
Atlas is deployed into your estate rather than consumed as an external service. Discovery data, analysis and evidence remain inside your boundary and under your data residency requirements, including in air-gapped environments.
Continuous, not episodic
External estates change without a change ticket. Atlas re-runs discovery on a cycle so the map does not silently age between formal assessment windows.
Authorised validation, not passive-only discovery
Passive discovery tells you what might be exposed. Atlas confirms it with non-destructive checks that run only inside a recorded authorisation, so findings arrive as confirmed conditions rather than candidates.
Evidence built for regulated decision-making
Authority, method, reviewer and timing are captured as the work happens and packaged into a signed dossier, so the record can be checked for integrity rather than taken on trust.
Powered by Nexus
Orchestration, approvals, integrations, secret handling and audit come from the Nexus execution engine embedded in the product. Atlas is sold standalone; the engine is included, not a separate purchase.
Powered by Nexus
Built on the same execution layer we sell as a platform.
Atlas inherits the workflow engine, human approval model and audit trail used across the Nexus product line. That is why authorisation and analyst review sit inside the process rather than alongside it, and why every finding carries a record of how it was produced.
You do not need to buy or implement the Nexus platform to run this product. The shared foundation is why the product deploys into your environment, keeps its data local and produces an audit record you can inspect.
Explore the Nexus platformDeployment and trust
Runs where your assurance work is allowed to run.
Deployment, identity, secrets, audit and observability are inherited platform capabilities rather than product-specific bolt-ons.
- Deployment models
- On-premises, sovereign or customer-controlled cloud, and air-gapped or disconnected environments.
- Identity and access
- SSO with your identity provider, MFA enforcement and role-based access control over scope, findings and evidence.
- Secrets
- Vault-backed secret storage and retrieval for credentials used during authorised assessment.
- Audit
- Audit logging over scope changes, assessment runs, analyst decisions and evidence access.
- Observability
- Run status, execution history and operational telemetry inherited from the embedded Nexus execution engine.
- Data residency
- Assessment data, analysis output and evidence remain in the infrastructure and jurisdiction you deploy into.
Where AI threat modelling is relevant to an engagement, Atlas analysis can be framed against external frameworks such as MITRE ATLAS, which is an adversarial threat framework for AI systems and is unrelated to this product beyond the shared name.
Questions
Scope, authority, residency and availability.
Atlas briefing
Find out what your external estate actually exposes, and be able to prove it.
An Atlas briefing walks through scope definition, the authorised assessment model, the evidence dossier and the deployment options available for your environment.