Infosec
Corp
Request a demo

Home / Platform

R-O-D-E-O platform

The platform

Offense and defense on one platform, driven by a suite of proprietary AI models, with every high-impact action gated by a human.

On this page
CapabilitiesProprietary modelsIntelligence modesPlatform architectureUnder the hood
01Core capabilities

Detect, rank, and act in one pass

RODEO pairs proprietary ML models for prioritization with generative offensive tooling, so your team spends time on the findings that actually matter — not triage spreadsheets.

285M-param exploit model 150k+ CVE training set 138 cross-mapped controls
Vulnerability prioritization
Purpose-trained classifiers such as severity_net.pt, trained on 150,000+ CVE records, rank risk so the critical items surface first.
Exploit generation
A 285M-parameter transformer trained for exploit generation, reasoning inside the perimeter — part of the offensive edition.
Plugin ecosystem
157 signed, sandboxed plugin modules (RSA-2048 signing enforced in production), plus Nuclei-based scanning for CVEs, misconfigurations, and exposures.
Real-time dashboard
Grafana dashboards covering CVSS scores and risk analysis.
Request a demo See the controls
Proprietary AI

A suite of proprietary models

R-O-D-E-O is not a wrapper around someone else's chatbot. It runs multiple purpose-trained models of its own, one per job, on local weights inside your perimeter, covering both the offensive and defensive sides of the platform.

Severity classifiersDefense

Rank vulnerability risk so critical items surface first. Trained on 150,000+ CVE records.

Exploit generatorOffense

A 285M-parameter transformer for exploit drafting that validates real-world risk.

Code reasonerOffense + defense

Purpose-trained code reasoning for analysis work inside the perimeter.

Incident response modelDefense

Purpose-trained for incident response, alongside triage and playbooks.

Forensics modelDefense

Purpose-trained for digital forensics investigations. In development

ICS modelOT

Purpose-trained for industrial and OT environments, alongside safety-pinned autonomy.

Defense modelDefense

Purpose-trained for defensive security operations.

All models run on local weights, so R-O-D-E-O reasons with no internet connection and no data leaving your perimeter. Remote models are optional (see Extended mode).

03Dual intelligence

Two modes, one platform

Run RODEO entirely air-gapped, or extend it to remote models when you need extra reach. Switch per deployment, per tenant.

Self-contained

Air-gapped · no egress

Fully offline operation with on-prem model weights and a local CVE cache. Usage telemetry is forced off in production and network egress is enforced at the socket layer — nothing leaves your perimeter.

Extended

Connected · policy-gated

Leverages remote APIs such as OpenAI and HuggingFace for advanced capabilities when connectivity and policy allow.

05The arena

Platform architecture

Every module is a gate into one arena. The R-O-D-E-O core and its proprietary models sit at the centre, an event bus wires every gate together, and nothing high-impact gets out without passing the human approval gate.

R-O-D-E-O platform architecture, drawn as a rodeo arena A corral fence with one gate per module: Compliance, Offense, Reverse engineering, Forensics, Incident response, Defense, ICS/SCADA and Purple team. A human approval gate sits at the top. At the centre is the R-O-D-E-O core, drawn as a revolver cylinder whose seven chambers are its proprietary models (severity, exploit, code, incident response, forensics, ICS and defense), ringed by the event bus that connects every gate. A rope thrown from the Offense gate arcs over the top of the arena and loops around the Defense gate: offensive findings become defensive detections. Its tail runs out through the Offense gate and wraps under the R-O-D-E-O name. R-O-D-E-O SEV EXPL CODE IR FOR ICS DEF PROPRIETARY MODELS EVENT BUS OFFENSE → DEFENSE HUMAN APPROVAL GATE COMPLIANCE OFFENSE RE FORENSICS IR DEFENSE ICS / SCADA PURPLE TEAM
  1. [ GATE 00 ]Governance
    Human approval gate

    Low severity auto-approves; medium and above waits for an analyst before anything high-impact runs.

  2. [ GATE 01 ]Regulatory
    Compliance

    Control-level mapping across ten frameworks, with evidence for every action.

  3. [ GATE 02 ]Red team
    Offense

    Scanning and exploit validation that proves which risks are real.

  4. [ GATE 03 ]Malware analysis
    Reverse engineering

    Takes binaries and malware apart inside the perimeter.

  5. [ GATE 04 ]Investigations
    Digital forensics

    Forensic investigations on the same data model as detection.

  6. [ GATE 05 ]DFIR
    Incident response

    Approval-gated playbooks that contain and recover.

  7. [ GATE 06 ]Blue team
    Defense

    EDR/XDR, threat hunting with Sigma, SIEM and alert triage.

  8. [ GATE 07 ]Industrial control
    ICS / SCADA

    Safety-pinned autonomy for plants and OT networks.

  9. [ GATE 08 ]Red + blue
    Purple team

    Offensive findings become Sigma / Suricata / YARA detections.

06Under the hood

Built on a modern, auditable stack

A FastAPI backend and React/Vite dashboard, backed by a single relational database. Detection events flow through an event bus to triage and approval-gated playbooks. Editions extend the same core over shared core. / api.routers namespaces, with a capability policy gating what mounts.

FastAPI backend

Routers, lifecycle, and request/tenant binding with response gating on every call.

React / Vite dashboard

A fast operator console with a live event feed and Grafana panels.

PostgreSQL

Tenant-scoped storage with optional row-level security for strict isolation.

data_flowLive
React / Vite dashboard FastAPI backend Watchers / EDR / SIEM Event Bus Alert triage Playbook engineapproval-gated PostgreSQL tenant-scoped + optional RLS

Watchers (EDR / SIEM) and the API publish to the event bus, which fans out to alert triage and the approval-gated playbook engine · the API, triage, and playbooks all persist to tenant-scoped PostgreSQL with optional row-level security.