— Product Roadmap
The Hounds is an open-source pack of human-in-the-loop AI security agents for Tenable exposure management — built on a deterministic agentic engine grounded in your data. Here's what's live today, what's on the workbench, and the new hounds joining the pack — grounded in real queries, gated by your approval, always.
— The Plan
Shipping in the console, the artifact, and the open-source repo.
Give it one asset — a UUID or an IP — and it tells the whole story: a risk score, every tag deciphered to the hound that raised it, top CVEs, software and certificates, on one page.
ShippedCloses the loop: owner-routed remediation emails, CISA KEV fire-alarms, certificate countdowns, and Contract run summaries — plan before it runs, results after. Double-gated via NAVI_EMAIL=1 + per-call confirmation, previewed before anything sends.
ShippedKEV, attack paths, identity, certificates, post-quantum crypto, AI, IoT, software, ownership, asset classification, alerting, remediation tracking, threat intelligence, cloud discovery, container security, compliance mapping, and more — 41 agents, each hunting one exposure class. Together they cover the surface.
ShippedCapture your tagging & ACR policy once, arm it, and the pack runs on a schedule — planning first, writing only when you approve. Now includes Ownership and Software.
ShippedThe whole console running in your browser on a bundled sample dataset — no install, no keys — so anyone can see the pack in action before connecting their own Tenable.
ShippedCIS / STIG audit findings folded into tagging and coverage via three dedicated audit agents — AEGIS (compliance posture), NEMESIS (risk ranking), and HECATE (policy enforcement) — so posture and compliance share one grounded view.
ShippedActively being built or polished.
A dedicated, exportable hit-list that ranks your most business-critical assets by real exploitability — identity × KEV × criticality — wired straight to the KEV hound.
In progressRun-history over time so you can answer the board's question: are our unknowns growing or shrinking? Trend lines on the "On the Scent" overview.
In progressA printable one-pager for every hound — what it does, why it matters, and the proof behind it — so the whole pack is easy to hand to leadership.
In progressA board-ready export: coverage, crown jewels, and trend on a single page — generated from the same grounded queries the pack runs.
PlannedSpeced and prioritized — joining the pack next.
Finds duplicate assets, brings the candidates to you for approval, then retires the stale copies through a short-lived clean-up network — ending the confusion duplicates create and flagging ephemeral assets before they pile up.
In designGives the pack a memory. Snapshots your exposure over time and compares them — so you can finally answer "are we getting better?" with per-metric, per-tag trends and progress toward the targets you set.
In designIdeas we're weighing with the community.
Full history of every tag and ACR change — old → new, who, when, why — with one-click revert.
IdeaIAM users and roles, never-rotated keys, over-privileged roles — a cloud-identity lens for the Identity hound.
Idea— The Loop Closers
Every hound proposes; you approve. These extend the pack from finding exposures to acting on them — and watching for change between runs.
Gabriel · The Messenger
ShippedReports · owner-routed remediation
The pack already knows who owns what. Gabriel turns that into action — delivering focused remediation to the people who can actually fix it, and reporting back so nothing falls through. Double-gated via NAVI_EMAIL=1 + per-call confirmation, previewed before anything sends.
Alert Raven · the raven that rides with the pack
ShippedBetween-runs watchdog · gated email digest
Alert Raven watches navi.db for the conditions worth waking a human — coverage drops, scans running long, fresh CISA KEV, expiring certs, ownerless or EOL rising, or any condition you craft in plain English. Fires on change (once, until it clears). A raven, not a hound — the pack's scout.
Amarok · The Remediation Tracker
ShippedRemediation velocity · SLA tracking · closure verification
Amarok watches the gap between a finding being raised and a finding being closed — tracking remediation velocity, flagging SLA breaches before they happen, and verifying closure against real scan data rather than taking a ticket's word for it.
Echo · The Duplicate Hunter
In designDuplicate detection · human-gated clean-up
Duplicate and ephemeral assets quietly inflate your inventory and skew your metrics. Echo hunts them down, shows you the evidence, and — only with your approval — retires the stale copies.
Echo and Urd are in active design — details may change before release.
— What Won't Change
Every tag, score, and clean-up is gated behind human confirmation. Nothing runs autonomously until you arm it.
Every answer comes from a real query against your own data — or the pack tells you it can't answer.
Uncredentialed hosts and stale data get called out, not hidden. Coverage is always on the record.
— Open Source
Install the navi CLI and start hunting exposures in your own environment today — the whole pack is open source.