Tangent Technologies · Solutions
Assessments that cite their evidence.
Tangent builds AI agents that read the raw artifacts of a security assessment — scanner output, packet captures, firewall logs, SBOMs, vendor research — and return findings, risk narratives, and product reviews with every claim traced back to the file it came from. The analyst keeps the judgment.
The premise
The evidence already exists. Reading all of it is the bottleneck.
- One assessment produces scan output, packet captures, firewall logs, and an SBOM, and no two of those tools present a fact the same way.
- Vendor risk and public vulnerability history are researched from scratch for every product that reaches the queue.
- Approvals expire on a cycle, so the same product is assessed again later by someone who was not there the first time.
- An agent can read all of it in one pass and hand the analyst a draft with its sources attached. The judgment stays human.
Capabilities
Agents that do the reading, so analysts can do the assessing.
Two agent patterns Tangent has built and operates: one that composes a vulnerability analysis out of test evidence, and one that researches a product before it is allowed into an environment.
Evidence composer
Ingests the artifacts human-led testing produces — Nessus output, Tripwire data, packet captures, firewall logs, SBOM analysis, and other log data — and correlates them into one case file instead of six disconnected exports.
Scans · PCAPs · Logs · SBOM
Finding-to-source traceability
Every finding in the report links back to the artifact that produced it, so a reviewer opens the capture or the log line behind a claim instead of taking the claim on trust.
Every claim, one click away
Known-exploited screening
Findings are checked against the CISA Known Exploited Vulnerabilities catalog, separating what is theoretically possible from what is actively being used against real targets right now.
KEV catalog
Third-party and vendor risk
The agent researches the vendor behind the product — ownership, security history, publicly reported incidents and advisories — and folds that into the risk picture rather than assessing the software in isolation.
Supply-chain context
Product review research
For a new or expiring product review, the agent researches the product and its public vulnerability history, then searches the existing approved-product catalog for tools already vetted that meet the same requirement.
Prior-art search
Drafts, not decisions
Output is a structured draft: risk to the environment in plain language, compensating controls already in place, and recommended remediation — written for an analyst to challenge, edit, and sign.
Human sign-off
What it hands back
Two deliverables, both built for a reviewer to argue with.
These are the structures the agents produce. Each section carries the sources behind it, and anything the agent cannot evidence is marked as an open question rather than filled in.
- Finding-by-finding analysis, each tied to the artifact that produced it
- Known-exploited status from the CISA KEV catalog
- Third-party risk assessment of the product vendor
- Risk to the environment, in plain language
- Compensating controls already in place
- Recommended remediation, prioritized
Evidence in, analysis out. The agent does not generate the evidence. It reads what testing produced, relates it, and writes the analysis an engineer would otherwise assemble by hand.
- Product and vendor profile
- Third-party risk assessment
- Publicly reported product risks and vulnerabilities
- Already-vetted products that meet the same requirement
- Open questions flagged for the reviewer
- Draft disposition for human analysis and decision
Research once, reuse forever. The prior-art search is the part teams skip under load — and the part that most often finds an approved tool that already does the job.
How it works
Point an agent at work your team already does.
Collect
Human-led testing produces the evidence: scans, captures, logs, SBOM output, and the product submission itself. The agent generates none of it.
Correlate
Skill files and scripts normalize the artifacts and resolve the same host, product, or CVE across tools into a single record the agent can reason over.
Research
Vendor history, public advisories, KEV status, and the existing approved-product catalog are searched and attached to the case as cited sources.
Draft for review
The agent writes the report or review with its sources linked and routes it to an analyst, who challenges it, edits it, and signs it.
Where it runs
Already in production on a federal cybersecurity program.
Tangent operates these agents today in support of vulnerability analysis and technology product review for a federal customer. The implementation is ours, built from skill files and scripts our engineers maintain, so it moves with the AI platform an environment has already authorized instead of locking the work to one vendor.
Authorized AI services
Deployed on multiple federally approved large language models, so the work stays inside a boundary the customer has already accredited and is never tied to one provider.
Inside the boundary
Skill files and scripts
The behaviour lives in version-controlled skill files and scripts rather than a vendor black box, which is what makes an agent reviewable, portable, and correctable.
Engineer-maintained
Standard developer tooling
Built and maintained in Visual Studio Code with ordinary engineering practice: review, iteration, and change history, applied to agent behaviour the same way it is applied to code.
Reviewable change history
Principles
The rules these agents refuse to break.
01Evidence over assertion
If the agent cannot point at a source, it says so. A gap is reported as an open question, never filled with a plausible sentence.
02Human-led, agent-assisted
The agent organizes, researches, and drafts. Assessment, acceptance, and sign-off stay with the analyst who is accountable for them.
03Source-linked by default
Every finding carries the artifact behind it, so a reviewer, an auditor, or the next analyst on the file can retrace the reasoning instead of rebuilding it.
04Portable by design
Skill files and scripts, not a single vendor agent. The same capability runs on whichever authorized AI platform an environment already has.
Get started
Point the agents at an assessment you already run.
Give us one real slice of the workload — a single product review, or one set of test evidence — and we will show you the draft an agent produces, with its sources attached, next to what that work costs your team today.