ThreatVec Help

Posture Score

The posture score (0–100) is a weighted composite of three dimensions measured continuously across your AI fleet.

Weights are adjustable in Settings → Score Weights. The AI advisor suggests optimal weights based on your deployment profile.

Week-1 Value Path

Three steps — no infrastructure changes required on day one.

pip install threatvec
ThreatVec.auto()

Agent Fleet

Every registered AI agent has a posture card showing its score, rule count, trust score, and status.

AgentBench

Probes your agents with adversarial inputs — prompt injections, data exfiltration attempts, jailbreaks — to test whether safety controls work. Results map to MITRE ATLAS techniques and feed back into the posture score.

Run it from the dashboard (Run AgentBench) or via the API:

POST /api/v1/agentbench/run
{"agent_id": "your-agent-id", "mode": "quick"}

Lethal Trifecta Analysis

Each agent is assessed against Simon Willison's lethal trifecta framework: does it have access to private data, does it process untrusted content, and can it communicate externally? All three together = maximum risk. Assessed via the agent risk profile card.

Shadow AI Discovery

ThreatVec discovers every AI service your employees use — including services IT hasn't approved — via the Chrome extension and M365 Copilot logs.

Services marked with ! are unregistered. Review them in the Shadow AI panel and either add an alert rule or register them as approved via Settings → Assets.

Vulnerability Exposure

ThreatVec ingests CVEs from NVD (free) and optionally Vulners (paid), filters them for AI-relevant libraries, and scores them by priority for your specific tech stack.

Priority Score (0–100)

SLA Windows

Mark CVEs as fixed, deployed, investigating, or wont_fix directly from the table or the CVE detail page.

AI Patch Query

The ✨ query bar on the Vulnerability Exposure page lets you ask natural-language questions about your CVE exposure.

Example questions

ThreatVec extracts the filter intent, queries the database, and returns a 2–4 sentence answer with specific CVE IDs cited. Works without an API key via keyword fallback.

API

POST /api/v1/patches/ask
{"question": "what linux patches matter most right now?"}

Red Team

ThreatVec's red team engine continuously generates adversarial scenarios from real CVEs and tests them against your agents.

Learning Cycle

1. Ingests recent AI-relevant CVEs
2. Generates adversarial scenarios mapped to MITRE ATLAS techniques
3. Runs scenarios against registered agents
4. Records pass/fail results → feeds back into posture score

Runs weekly by default. Trigger manually: Red Team → Run cycle or POST /api/v1/red-team/learn/run-cycle.

ATLAS Coverage Heatmap

Shows test coverage across MITRE ATLAS technique families. Green cells (≥80% pass) are holding. Amber cells (50–79%) have bypasses. Gray cells are untested — run a cycle to generate scenarios.

Compliance Evidence

ThreatVec generates structured evidence packages for six governance frameworks from your live posture data.

Control Statuses

Export

GET /api/v1/compliance/owasp-llm/evidence-export
GET /api/v1/compliance/nist-ai-rmf/evidence-export
GET /api/v1/compliance/eu-ai-act/evidence-export
GET /api/v1/compliance/summary   ← dashboard pill strip data

Alert Rules

Alert rules fire when specific conditions are met. Configure in Settings → Alert Rules or via API.

Notifications: Slack webhook · PagerDuty · SOAR webhook (HMAC-signed) · email digest.

Python SDK

pip install threatvec

Quickstart

from threatvec import ThreatVec

# Auto-detect: reads THREATVEC_URL and THREATVEC_AGENT_NAME from env
ThreatVec.auto()

# Or: explicit
tv = ThreatVec(
    server_url="https://app.threatvec.com",
    agent_name="MyAgent",
    org_key="myorg",     # optional
)
tv.start()
# ... your agent runs here ...
tv.stop()

Environment variables

Chrome Extension

The Chrome extension detects AI service visits and PII uploads without reading page content.

1. Go to /extension → download the package
2. Open Chrome → chrome://extensions → enable Developer Mode
3. Click "Load unpacked" → select the downloaded folder
4. Click the ThreatVec icon → enter your server URL and org key

Events appear in the Shadow AI Monitor within minutes. No page content is transmitted — only domain name, event type, and detected PII categories (never the actual PII values).

Tech Stack Import

Import your software inventory as a CSV to enable "my stack" CVE correlation. Patches matching your stack get a 30-point priority boost.

CSV format

technology,version,vendor,asset_count
postgresql,16.2,PostgreSQL Global Development Group,3
redis,7.2.4,Redis Ltd,2
langchain,0.2.1,LangChain Inc,2

Only technology is required. Download a pre-filled template: tech-stack-template.csv

POST /api/v1/tech-stack/import   (multipart/form-data)
GET  /api/v1/tech-stack           (list entries)
DELETE /api/v1/tech-stack/{id}    (remove entry)

Integrations

API Reference

Full interactive API docs are available at /docs (OpenAPI / Swagger UI).

Key endpoints

Authentication

Pass your org key in the X-Org-Key header for all API calls when ORG_KEY is configured.

Enforcement Layer

ThreatVec provides visibility. Once you can see the risk, the natural next step is active enforcement — blocking prompt injections, enforcing tool-call policies, filtering sensitive data.

ThreatVec's attack surface map, gap scan, and posture scores are designed to feed directly into enforcement policy decisions. The Policy Enforcement card on the dashboard shows your enforcement coverage and highlights uncovered high-risk agent-tool pairs.

ThreatVec integrates with enforcement layers via:

• Webhook receiver at POST /api/v1/enforcement/webhook (HMAC-signed)
• Enforcement event feed displayed in the Live AI Traffic panel
• Blocked call counts feeding back into posture score
• Gap scan at GET /api/v1/enforcement/gap-scan

Security Frameworks