BreachBayInvestigate
the breach.Decide with evidence.
A shared workspace for investigating simulated incidents, comparing response options, and keeping humans in control.
AI proposes. Authorized people approve.
Explore the synthetic response twin
Drag to rotate; Shift-drag to pan. Ctrl/⌘ + wheel zooms. Focus the camera and use arrows to pan, +/− to zoom, [/] to rotate, and Home to reset.
Select an asset to inspect it. Offscreen assets remain in Focus asset and the full record below. Signal motion shows relationship direction, not measured traffic.
Read assets and relationships
- Host · Compromised
- Host · Active
- Database · Active
- Host · Active
- Service · Active
- Workstation → Application hostCommunication route · Enabled · Evidence supported
- Application host → Customer databaseCommunication route · Enabled · Evidence supported
- Workstation → Jump hostCommunication route · Enabled · Evidence supported
- Jump host → Customer databaseRemaining communication route · Enabled · Evidence supported
- Customer portal → Application hostService dependency · Enabled · Evidence supported
Two modeled routes reach the customer database. This example changes no real system.
One shared incident.
Every step visible.
Follow the evidence, watch the investigation unfold, and understand the impact before anyone acts.
Customer data at risk
Response twin
Modeled pathsCited evidence
Source-linked evidence. Findings require human review.
Start with what you can prove.
Bring the alert and access log into one shared incident. Keep their source and classification attached.
Investigate with NVIDIA Nemotron. Collaborate in real time. Preview every response.
One incident.
A clear path forward.
Less context switching. More clarity about what you know, what you’re deciding, and what still needs attention.
Evidence
Evidence stays linked to its source.
Investigate
An AI finding remains a hypothesis until reviewed.
Preview
Remaining exposure and service impact are explicit.
Human approval
Approval is tied to the current scenario and expires.
Verify
Simulated execution. No action against a real network.
The application host can reach the customer database.
Supported by an observed connection in the access log.
Discuss the observation.
Keep its source in view.
Evidence your team
can follow.
Keep evidence, findings, conversations and response decisions in the same incident. Inspect the AI’s investigation trace, follow its citations, and review what belongs in the record.
Explore the workspaceKnow the impact.
Own the decision.
A response can reduce exposure and disrupt a service at the same time. BreachBay previews that tradeoff before an authorized person approves an action.
The AI service proposes. Humans approve. Execution changes the synthetic scenario, and verification records what changed.
Isolate the application host
- Database exposure
- Reduced, route remains
- Customer portal
- Service degraded
- Execution
- Simulated only
Review the preview. Record a reason.
Verify the outcome.
Clear by design.
Does BreachBay change a real network?
No. Response previews and execution operate on synthetic scenarios. The workspace makes that boundary explicit.
What does the AI do?
NVIDIA Nemotron investigates model-approved evidence and proposes findings and responses. Its output is validated, and people review the evidence and decisions.
Can my team work together?
Yes. Incident-scoped access lets responders share evidence, collaborate and follow the same live incident. Approval and execution depend on each person’s permissions.