Skip to content
CyberbladeAssay
SourceSign in

Documentation

How to deploy Cyberblade Assay and how the validation workflow fits together.

Deploy self-hosted

Assay runs on Docker or Podman Compose for a single node, or Kubernetes with Helm for high availability. The full sequence: render the environment file, bring up Postgres/Valkey/OpenBao, initialize and unseal OpenBao, migrate each service into its own schema, bring up the services, then run the preflight check.

cbctl assay init
cbctl assay up --profile core
cbctl assay migrate
cbctl assay up --profile core,services
cbctl assay doctor

OpenBao does not unseal itself: an operator initializes it and stores the unseal shares off-host, separately from the rest of the deployment.

Core workflow

  1. 1

    Discover and mark crown jewels

    Assay builds an exposure graph (OWASP Open Asset Model) from discovered assets and operator inventory. Mark the assets an attacker must not reach as crown jewels.

  2. 2

    Issue an authorization

    A signed, in-scope authorization names the target, the allowed safety classes, and a time window. Nothing runs without one.

  3. 3

    Run a validation

    The engine dispatches a technique under the safe-mode ceiling the authorization allows and produces a signed evidence bundle: proof, not an assumption.

  4. 4

    Prioritize by proven reachability

    A finding with a proven path to a crown jewel ranks above one with none, regardless of its raw severity score.

  5. 5

    Verify the fix

    Re-run the same finding after remediation. It is marked fixed only when the re-run comes back clean, not when a ticket is closed.

Safety model

Every action runs through one authorization choke-point, default-deny. Passive and active-safe techniques are on by default; active-safe proves a condition by evidence, never by effect. Active-intrusive techniques are interface-only in the open-core build and require a separately licensed, two-person-gated capability. A kill switch halts all dispatch and revokes every active authorization immediately.

Further reading

The full operator guides — deployment, administration, backup and restore, and the API reference — ship in the repository.