Skip to content
HANU
Deploy Hanu
Menu

By role

CISOs and security leaders

A backlog of individual findings is not a risk register. A chain — a poisoned release, a validate-then-enumerate sequence against a model API, a certificate issued by a key that should not have existed — is.

security platform for CISOsrisk based vulnerability prioritisationsecurity metrics for the board

What changes

Risk arrives as ranked chains with the score, the rule and every contributing signal attached. Coverage is a set of numbers with the command that counts them, so you can re-derive a slide a year later.

Prioritisation must be defensible, not vibes

Score is deterministic: a severity base, a bounded per-signal increment, and multipliers for public exposure, crown-jewel reach and known-exploited status. Two analysts reading the same chain arrive at the same number, and you can show the arithmetic.

Coverage you can re-derive

Every figure on this site resolves to a command in the repository — 609 behavioural detections, 75 correlation rules, 96 ATT&CK techniques. When an auditor or a board member asks how you know, the answer is a command, not a vendor's marketing page.

Evidence should come from live findings

Compliance engines for SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR, NIST 800 and the EU AI Act read the same findings your team works from. Evidence gathered by hand is evidence that is stale the day it is presented.

A reasonable first fortnight

Not a migration plan — the first two weeks, in the order that produces something useful fastest.

  1. Decide the risk appetite thresholds and map them to score bands, so CRITICAL means something specific in your organisation.
  2. Review the correlation rules that are on by default and record why each is acceptable — that list is your tuning rationale.
  3. Run the framework evidence engines for your two largest obligations and diff them against last quarter's manual evidence.
  4. Set the per-tenant audit log retention and confirm the hash chain covers the period your auditors will ask about.

Questions this role tends to ask

How is this different from the CSPM we already run?
It includes cloud posture — 368 AWS service checks, 77 each for Azure and GCP — but its purpose is the join a per-cloud scanner cannot make. A GitHub workflow change, a certificate issued by a compromised hierarchy and a first-ever model invocation from your account land in one risk instead of three disconnected findings.
Can I defend the prioritisation to an auditor?
Yes, because nothing in the path is a model. Detection, correlation and scoring are deterministic rules over typed signals with fixed thresholds. The same inputs produce the same score, and the rule id plus every contributing signal is attached to the risk for review.
What compliance evidence can it produce today?
Evidence engines exist for SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR, NIST 800 and the EU AI Act, reading the same live findings your team works from. Be precise about attestation: SOC 2 Type II is not a current attestation for the self-hosted product — that is a control set you satisfy yourself, using this platform's audit trail.
How does this reduce the backlog rather than add to it?
By ranking chains instead of counting findings. A configuration drift with no reachable path to an asset that matters stays low; a compromised release feeding a credential that is being used against a model API is CRITICAL. The work you have is finite because it is ordered by consequence.

What it is not

Hanu is not a SIEM and does not try to be one — it correlates and hands the result to the response process you already run. It is not a certified SOC 2 Type II service for self-hosted customers; the evidence engines and audit trail support your own controls. And it does not cover Oracle Cloud, which exists in the codebase as stubs only.

Run it in your own account

One Docker Compose stack, your datastores, read-only credentials into your clouds. The Community edition is free to run in production.

Deploy HanuSee what is paid