Cut risk documentation time by 70%. Never miss a threat again.
From Terraform to threat model in 30 seconds.
A unified platform that replaces spreadsheets and ad-hoc processes with structured, AI-augmented workflows — producing consistent, auditable, board-ready risk records.
AI-powered threat enumeration, executive summaries, and risk scoring — in under 3 seconds.
STRIDE analysis with auto-generated Data Flow Diagrams from Terraform, YAML, or plain text in seconds.
Visual AI-populated attack trees with probability scoring and MITRE ATT&CK technique mapping.
Configurable risk matrix, inherent vs. residual scoring, ownership tracking, and full immutable audit trails.
Multi-framework posture tracking with evidence management, control mapping, and audit-ready reports.
Full inventory with CIA ratings, data classification, exposure type, and AI-generated risk summaries.
Executive risk heatmaps, residual score trends, and shareable customisable dashboards.
Step-by-step workflows let junior analysts document risks independently within 2–3 days of onboarding.
Citadel replaces weeks of manual spreadsheet work with a guided, AI-augmented workflow any analyst can follow from day one.
Connect your Terraform, Kubernetes, or CloudFormation code — or describe your asset in plain text. Citadel automatically discovers components, data flows, and exposure types.
In under 3 seconds, Citadel's AI engine runs full STRIDE and PASTA analysis, generates a Data Flow Diagram, maps MITRE ATT&CK techniques, and writes an executive summary — automatically.
Risks flow into the live register with ownership, scoring, and remediation tracking. Compliance posture updates in real time. One click exports a board-ready PDF or auditor package.
Citadel ships four core AI modules that work together across your entire risk workflow — from first draft to final audit.
Select assets affected by this risk
6-step guided wizard — AI auto-generates threats, scores, and descriptions the moment you link an asset.
| RISK NAME | ASSET | SCORE | STATUS | OWNER | LIKELIHOOD | IMPACT | |
|---|---|---|---|---|---|---|---|
|
SQL Injection via Payment API ID: #1042 |
Payment Gateway API |
20
|
In Review | JM |
High (4) | Critical (5) | |
|
Hardcoded JWT Secret in Env Vars ID: #1041 |
Payment Gateway API |
20
|
Open | SC |
High (4) | Critical (5) | |
|
Over-Privileged IAM Lambda Role ID: #1038 |
S3 — prod-app-assets |
15
|
In Review | AP |
High (4) | High (4) | |
|
PII Leaked in API Error Responses ID: #1035 |
Payment Gateway API |
12
|
Mitigated | SC |
Med (3) | High (4) | |
|
No Rate Limiting on /api/v2/charge ID: #1031 |
Payment Gateway API |
9
|
Accepted | JM |
Med (3) | Med (3) | |
| Showing 5 of 47 risks · View all → | |||||||
The Risk Register gives your team a single source of truth — score, status, ownership, and mitigation in one view.
| PLAN NAME | LINKED RISK | EFFECTIVENESS | STATUS | OWNER | DUE DATE | RESIDUAL ↓ | |
|---|---|---|---|---|---|---|---|
Parameterised Query Refactor MP-2024-001 |
#1042 SQL Injection |
High
|
In Progress | SC |
10 Jun 2026 | ↓ 95% | |
JWT Secret Rotation to AWS Secrets Manager MP-2024-002 |
#1041 Hardcoded JWT |
High
|
Not Started | JM |
03 Jun 2026 ! | ↓ 85% | |
IAM Least-Privilege Policy Review MP-2024-003 |
#1038 IAM Over-Priv |
Med
|
In Progress | AP |
20 Jun 2026 | ↓ 60% | |
Error Response Sanitisation MP-2024-004 |
#1035 PII Leak |
High
|
Completed | SC |
22 May 2026 | ↓ 100% |
Each mitigation plan links directly to its risk, tracks effectiveness, and updates the residual score automatically when marked complete.
This risk presents a Critical inherent score driven by an unmitigated SQL injection in the transaction endpoint. PCI-DSS cardholder data is in scope. 3 of 4 priority controls pending — residual will drop to 8 on completion. Immediate action required on P1 and P2.
The Payment Gateway API accepts user-supplied input in the transaction_id and account_ref parameters without adequate parameterisation. An attacker could craft malicious SQL payloads to read, modify, or delete records in the PostgreSQL backend, potentially exposing PCI-scoped cardholder data.
The AI Risk Review runs on a configurable schedule and writes a versioned, immutable summary to the audit trail every time.
Citadel pulls context from your connected assets, feeds it through the AI engine, and surfaces ranked, ready-to-create risks — in seconds.
Every workflow in Citadel is AI-augmented. From the moment you register an asset, the engine is generating threat scenarios, mapping controls, and writing board-ready summaries — in under 3 seconds.
Citadel integrates directly with your IaC and FaC pipelines — Terraform, CloudFormation, Kubernetes, Bicep, and more. Every infrastructure change triggers a fresh STRIDE analysis and an updated Data Flow Diagram, automatically. Confluence pages and Jira tickets are pulled in as context to make threat models specific to each asset.
resource "aws_instance" "web_server" {
ami = "ami-0c55b159cbfafe1f0"
instance_type = "t3.medium"
vpc_security_group_ids = [
aws_security_group.web.id
]
subnet_id = aws_subnet.public.id
tags = { Name = "WebServer", Env = "Prod" }
}
resource "aws_db_instance" "database" {
engine = "postgres"
instance_class = "db.t3.small"
db_name = "appdb"
multi_az = true
storage_encrypted = true
}
resource "aws_s3_bucket" "assets" {
bucket = "prod-app-assets"
tags = { Classification = "Confidential" }
}Full STRIDE coverage — all 6 categories analysed systematically (vs. 40–60% coverage from memory)
Citadel plugs directly into your IaC pipelines, vulnerability scanners, and issue trackers. No rip-and-replace. Plug in and go.
Map your controls once, comply with multiple frameworks simultaneously. Evidence management, assessment tracking, and posture scoring — always audit-ready.
Upload PDFs, images, and documents as compliance evidence. URL references and text notes supported. Full audit trail with uploader identity and timestamp — ready for external auditors.
Link your existing controls to framework controls with coverage percentages. Map once to NIST — see your ISO 27001 and PCI-DSS gaps automatically. 20+ NIST control families supported.
Weighted compliance scores per framework, per asset, and organisation-wide. Real-time posture from assessment status: Compliant, Partial, Non-Compliant, N/A.
From analyst workbench to boardroom slide — Citadel surfaces the right risk data at every level, live.
SQL Injection — Payment API #1042 · J. Moreau |
Critical | 20 | In Review |
Hardcoded JWT Secret #1041 · S. Chen |
Critical | 20 | Open |
Over-Privileged IAM Role #1038 · A. Patel |
High | 15 | In Review |
Unencrypted S3 Bucket #1036 · A. Patel |
High | 12 | Open |
Tell us about your security requirements and we'll get back to you.
Or email us directly at info@antumsecure.com