Skip to content
Black Atlas — Powered by KRYOS V6

Evidence interface

How the Cybersecurity RAG Chat Works

Users ask security questions in plain language and get answers grounded in approved internal and external evidence. KRYOS V6 retrieves the relevant material, checks for conflicts or gaps, labels uncertainty, and returns a bounded answer with traceable support.

Definition

Not a generic chatbot

Lifecycle

What happens between the question and the answer

  1. A question is asked

    An analyst, executive or compliance user asks a cybersecurity or threat-intelligence question in plain language.

  2. Authorization and scope are checked

    The request is tested against who is asking, what they may see, and which systems and time windows are in scope.

  3. Approved sources are retrieved

    Hybrid retrieval runs across registered documents, telemetry, policy material and internal knowledge — registered sources only.

  4. Results are reranked

    Retrieved material is ordered by authority, currency and relevance, so a stale note does not outrank a current authoritative record.

  5. Contradictions and gaps are checked

    Conflicting evidence is surfaced rather than resolved silently. Missing coverage is recorded as a gap, not filled by assumption.

  6. A bounded answer is generated

    The answer carries citations, claim status, uncertainty and limitations, with inference kept visibly separate from supported fact.

  7. Weak support escalates or abstains

    Where support is thin, contradictory, stale or out of scope, the answer narrows, escalates for review, or is withheld.

Interface

What the user sees

Answer, evidence, uncertainty and release state are shown together. Nothing that weakens a conclusion is hidden behind it.

Question

Which identity paths could reach the payment authorization system?

Answer

Three paths reach payment authorization from registered evidence. Two run through a privileged group whose membership has not been reviewed inside the current window. The third depends on a trust relationship whose configuration record is older than the evidence-currency threshold, so it is carried as inference rather than fact.

Claim status

  • KnownTwo paths traverse an unreviewed privileged group
  • InferredThe third path is reachable in current configuration
  • UnknownWhether compensating controls are enforced at runtime

Contradiction flagged

The access-review policy asserts quarterly review of this group; the entitlement export shows no review recorded in the period. Both are shown; neither is silently preferred.

Illustrative interface. Not live output, and not drawn from any customer environment.

Answer
The bounded response to the question asked, in plain language.
Cited sources
Every source the answer rests on, traceable back to its registration.
Claim status
Known, inferred, simulated or unknown, marked per claim rather than per answer.
Uncertainty and limitations
What weakens the answer, stated rather than averaged away.
Contradictions
Conflicting evidence shown side by side with its origin and age.
Review status
Whether a human has reviewed the answer, and who owns that review.
Release status
Released, released with qualifications, insufficient evidence, out-of-distribution, or blocked.

Use

What the chat is for, and what it is not

Good uses

  • summarise exposure across multiple systems
  • explain likely attack paths from approved evidence
  • compare conflicting findings
  • answer what is known, what is inferred and what is unknown
  • support executive and analyst briefings
  • trace claims back to source material

What it does not do

  • does not replace human judgment
  • does not claim certainty
  • does not act outside authorization
  • does not treat unsupported inference as fact
  • does not release high-risk conclusions without required review

The evidence rules behind every answer are set out on Evidence & Governance, and the connection model on the API overlay page.