RiskProfiler Launches KnyX Autonomous Investigations to Take Digital-Risk Alerts From Detection to Remediation

RiskProfiler, the digital risk protection and external threat intelligence platform, today launched KnyX Autonomous Investigations, a new capability that turns the alerts security teams already receive into fully investigated, verdict-backed, and automatically remediated cases. Debuting at Black Hat USA and DEF CON 34 in Las Vegas, KnyX Autonomous Investigations deploys an ensemble of AI agents that detect threat signals, gather the same evidence a human analyst would with better efficiency, prioritize risks with a calibrated confidence score, and hand off or execute the remediation within minutes, accelerating the SecOps workflow.

In current security teams, analysts no longer have a detection problem. With the variety of security platforms and detection tools available, they face a triage problem. External-threat tooling generates a relentless stream of alerts that includes but is not limited to typosquatted domains, leaked credentials, vendor-breach signals, live phishing pages, threat intel, and vulnerabilities. Each of these flagged alerts still lands in a human queue. Analysts spend their days repeating the same manual evidence-gathering: pulling WHOIS, screenshotting a suspicious page, comparing a logo, checking whether a leaked password still works, finding a log of integrations that justifies the newly minted list of cloud assets. The alert collection is the easy part. The investigation is the bottleneck, and the remediation waits behind it.

KnyX Autonomous Investigations runs a continuous loop:
Alert → Investigate → Verdict → Remediate. 

Autonomous investigations built from deterministic skills

KnyX deploys specialized AI agents for end-to-end threat signal investigation. Each agent is composed of their own set of deterministic skills, such as atomic, typed operations such as DNS lookups, proxied webpage captures, perceptual-hash comparisons, identity-provider checks, infrastructure analysis, and threat-intelligence correlation.

These skills return structured, schema-validated results rather than relying solely on free-form model output. The evidence is evaluated collectively to produce a calibrated, confidence-scored verdict that can be reviewed, approved, or used to initiate remediation, producing completely traceable reports suitable for executive reporting and compliance workflows.

Every agent’s skill execution becomes a unified investigation with:

• A defined lifecycle and investigation status

• Structured evidence collected by each skill

• A verdict with confidence score

• Recommended or automated remediation actions

• A complete audit trail

• An executive-ready investigation report

This architecture makes investigations reproducible, explainable, and operationally defensible, regardless of the alert type that initiated them.

Policy-Driven Automation for Defensible Action 

KnyX Autonomous Investigations is designed to give security teams the advantages of autonomous response while preserving policy control, accountability, and legal safeguards.

Policy-governed response

Every remediation action is controlled by an Autonomous Defence policy configured by the customer for the relevant action type and scope. Each action can be assigned one of three modes:

• Auto: The action is executed automatically when the required conditions and confidence thresholds are met.

• Approve: The action is prepared and routed to an authorized user for approval.

• Off: The platform does not initiate the action.

Legal safeguards by design

Domain ownership is revalidated during every investigation rather than being treated as a one-time setup check. Credential checks are performed exclusively through the customer’s authorized identity provider. KnyX does not attempt to validate credentials against public login forms.

Investigations involving high-consequence determinations, such as copyright infringement, counterfeit activity, or coordinated reputation attacks, are also subject to stricter confidence thresholds. These safeguards help prevent automated action against legitimate sellers, fair-use content, or insufficiently verified targets.

Evidence behind every decision

Every deterministic skill records its inputs, outputs, execution time, and supporting evidence in the investigation audit log. KnyX also preserves the exact versions of the agents, skills, and prompts used during each investigation. This allows security teams to understand how a verdict was reached and why the result may change as new intelligence becomes available or investigation logic evolves. Instead of presenting an unexplained model conclusion, KnyX provides a traceable record of the evidence, reasoning process, policy decision, and resulting action.

Independent validation before action

KnyX does not convert an unverified claim into a confirmed threat. Vendor-breach investigations, for example, corroborate claims across multiple independent sources, including breach corpora, dark web intelligence, SEC filings, vendor advisories, and credible security news. A single-source report cannot independently produce a confirmed verdict or trigger remediation.

This evidence-first approach reduces the risk of acting on rumors, recycled reporting, or unsubstantiated claims.

“Detection was solved a long time ago. What security teams are drowning in is triage—the same manual investigation, run by hand, thousands of times a week. KnyX Autonomous Investigations does that work the way a senior analyst would, and then it does the part everyone actually wants: it acts. The difference is that every step is governed by policy and backed by evidence, so this is autonomy a CISO can switch on without losing control.”

— Setu Parimi, Co-Founder and CTO, RiskProfiler

Five autonomous investigation agents available at launch

RiskProfiler is launching five dedicated KnyX agents that address high-volume and high-impact external threat scenarios.

Leaked Credential Investigation

When an exposed credential associated with an employee or executive is discovered in deep- or dark-web data, the agent first verifies that the affected domain is owned by or associated with the customer. It then performs a controlled validation through the customer’s authorized identity-provider environment. The investigation determines whether the credential remains valid, identifies the access and privilege associated with the identity, and evaluates the potential organizational impact.

Based on the customer’s Autonomous Defence policy, KnyX can enable response actions such as:

• Revoking active sessions

• Forcing a password reset

• Marking the identity as compromised

• Resetting authentication methods

• Disabling the affected account

The complete investigation, from initial alert through validation and response, can be completed within minutes, with every step recorded in the audit trail.

Domain Impersonation Investigation

When a suspected typosquatted or impersonating domain is detected, the domain agent investigates its registration history, infrastructure, content, and visual similarity to the protected brand. The agent retrieves WHOIS and DNS information, captures the live webpage through a residential proxy, and analyzes brand elements using perceptual-hash comparison. The proxy-based capture helps investigate pages protected by anti-bot services such as Cloudflare or DataDome, where conventional automated scanners may be unable to access the content displayed to real visitors. If the domain is confirmed as impersonating the organization, the case can move directly into the takedown workflow according to the customer’s response policy.

Adaptive Phishing Investigation

If the domain agent identifies a credential-collection form or other phishing behavior, it can delegate the case to the dedicated phishing agent. The phishing agent examines the page, extracts the suspected exfiltration endpoint, fingerprints the phishing kit, and collects the technical evidence required for response. This includes:

• Page screenshots

• DOM content

• Hosting and infrastructure details

• Exfiltration endpoints

• Phishing-kit indicators

• Associated indicators of compromise

The resulting evidence is consolidated into a single takedown-ready package, allowing the case to move from detection to an actionable handoff without requiring analysts to manually assemble evidence across multiple tools.

Vendor Breach Investigation

The vendor agent investigates potential third-party breaches without relying on a single article, dark-web post, or unverified claim. It cross-checks the reported event across independent sources, including breach corpora, dark-web intelligence, SEC 8-K filings, vendor advisories, and security news. The agent then determines which data types have been credibly confirmed and maps those exposures to the customer’s actual relationship and integrations with the affected vendor.

When the investigation establishes a relevant exposure, KnyX can automatically prepare or send a follow-up security questionnaire, depending on the customer’s configured policy. This allows third-party risk teams to respond to substantiated exposure rather than treating every breach mention as equally credible or equally relevant.

Threat Intelligence Prioritization

Security teams may receive thousands of threat-intelligence items during a single reporting period. The challenge is not collecting more intelligence, but identifying which developments require action in the context of the organization’s environment. The KnyX threat-intelligence agent can reduce approximately 5,000 raw intelligence items to the 30–50 most relevant to a specific customer. It correlates CVEs with the organization’s actual technology stack, monitors threat-actor and ransomware activity affecting vendors in its portfolio, and maps the resulting intelligence to the customer’s external attack surface.

The result is a prioritized view of the threats and vulnerabilities most relevant to the organization’s security posture, not a generic digest of everything reported during the period.

Built for accountable autonomous defence

KnyX Autonomous Investigations is designed to make autonomous security operations practical for organizations that require both speed and governance. It does not treat autonomy as unrestricted execution. Instead, it combines deterministic investigation skills, confidence-scored verdicts, customer-defined policies, verified scope, independent corroboration, and complete auditability.

This gives CISOs and security teams control over:

• Which actions may run autonomously

• Which actions require approval

• Which actions must remain disabled

• What evidence is required before an action can proceed

• How every verdict and remediation decision can be explained

“We’ve held back on autonomous response for years because ‘let the tool act on its own’ was never a sentence I could say to my board. KnyX is the first thing that let me turn it on one action at a time, with a policy and an audit trail behind every move. It’s automation I can actually defend.”

— Kamran Siddique, CISO, Steve Madden