CAIN-42 CAIN StudioAGENTIC AI 75 · #36
Evidence-grounded threat investigation
Flashpoint launched agents investigating vulnerabilities, credentials, fraud and threat actors across datasets.
Last reviewed 2026-11-11
Agentic AI 75 / #36
2026 status: Product launch · Category: Security operations
The 2026 development
Flashpoint launched agents investigating vulnerabilities, credentials, fraud and threat actors across datasets.
The governance gap
An investigation that loses its sources becomes an opinion. Multi-step threat work needs every claim linked to the artifact that supports it, and a way to show where the trail stops.
Where CAIN-42 fits: Moat 4 — Execution Provenance & Attestation
Core question: Can we prove what actually happened? Hash-chained, signed records binding decision to execution to observable effect.
Build the investigation as an evidence graph: claims, artifacts, source timestamps and confidence. The agent may propose a conclusion; the graph must show which artifacts support it and which do not.
How the wiring works
- Ingest artifacts with source, timestamp and digest.
- Attach each claim to the artifacts that support or contradict it.
- Mark unsupported inference explicitly.
- Export the graph with the report so a reviewer can audit it.
What is real today
LIBRARY Production code and tests exist in this repository; there is no hosted route for this exact use.
The evidence-graph and export code exist. No threat-intelligence dataset or Flashpoint integration is present.
| Component in this repository | What the module says it is |
|---|---|
cain/causality/evidence.py | CAIN CAUSALITY — Causal Evidence Independence Graph (Prompt CAUSALITY, Phase 9). |
cain/causality/graph.py | CAIN CAUSALITY — Causal Event Graph (Prompt CAUSALITY, Phase 3). |
cain/worm_export.py | CAIN Trust Fabric - tamper-evident WORM Causal Evidence Fabric (Phase 4) |
cain/telemetry.py | CAIN Trust Fabric - Enterprise SIEM & SOC Telemetry Connectors (Phase 3) |
Descriptions are the first line of each module's own docstring, read without importing it. A module path is a pointer into this repository, not a hosted endpoint. Its existence is checked by the test suite; its status for this use is the label above.
Check it yourself
- Inspect the live ARGUS status
/fabric/argus/status - Fire a live decision through the CAIN-42 pipeline
/fabric/try— the same enforcement path every product sits behind.
Commercial package
| Offer | Threat Investigation Evidence Review |
|---|---|
| Buyer | SOC, CTI and incident-response teams |
| Price (proposal) | $2,500–$5,000 per review |
| Bundle | Runtime Containment & Evidence — Contain first, then prove what happened. |
| Operator stream | Stream 4 of the 10-stream operator playbook |
SOC, incident response, compliance, enterprise IT is the bundle buyer. The entry offer for this bundle is Runtime containment review; signed evidence pack; the range is $2,500–$5,000 per review; $2,000–$10,000 per evidence pack. A price on this page is a proposal, not a validated rate, and no customer is claimed.
Buy this as a product or service
CAIN-A75-036 — Threat Investigation Evidence Review DELIVERABLE
A bounded engine run on the buyer's sample: findings, a written report, and a SHA-256 artifact manifest. The manifest is unsigned: it is not a signature and not an attestation.
Kind: Evidence Pack · Price (proposal): $2,500–$5,000 per review · Lead time: 5 business days.
Open the product page · all 75 products
What this page does not claim
What this page is not. CAIN-42 is not affiliated with, endorsed by, integrated into, or shipped with the organisation named in the 2026 item. The item is public context; the page describes how CAIN-42 would govern that class of capability. No page here claims a customer, a partnership, a certification, a patent, or a production integration. Prices are proposals. Built by a three-person team.