iLAB SecureX
Threat-informed ATO automation for defense and federal systems. SecureX collects live evidence from infrastructure, vulnerability scanners, and STIG/CIS tooling, and uses AI to draft compliance narratives from real configurations. Narratives stay drafts until a human approves them, and nothing is submitted automatically. Findings are prioritized with CISA KEV, EPSS, and MITRE ATT&CK. SecureX exports OSCAL, Word, PDF, SAR, and eMASS packages and hands off to Xacta 360 as schema-valid OSCAL 1.1.2 SSP and POA&M files. Frameworks are defined as YAML profiles, including DoD IL4 and IL5, CMMC Level 2, NIST AI RMF 1.0, and OMB M-25-21. It deploys inside your boundary in AWS commercial or AWS GovCloud (US).
ATO timelines measured in months
Authorization packages often take 6 to 18 months, with teams rewriting narratives and chasing stale screenshots the whole way.
Evidence goes stale before review
By the time an assessor reads a package, the infrastructure it describes has already changed.
Findings are not threat-informed
Compliance findings are rarely ranked by adversary relevance, so remediation effort is spent on the wrong issues first.
Reauthorization restarts the cycle
Without regularly refreshed evidence, every reauthorization restarts the same manual evidence grind.
Connect evidence sources
Adapters pull live artifacts from cloud infrastructure, scanners, containers, source code, and STIG/CIS tooling inside your boundary.
Draft AI narratives
Amazon Bedrock drafts control narratives that cite real configurations rather than generic templates. Humans review and approve each one.
Prioritize by threat
Findings are ranked with CISA KEV, EPSS, and MITRE ATT&CK so remediation focuses on what adversaries actually use.
Export & review
Export submission-ready packages, including OSCAL for Xacta 360. Scheduled collection and the Review Queue keep stale evidence and overdue POA&Ms in front of a human.
Live evidence collection
Pulls evidence from cloud infrastructure, scanners, source code, containers, and STIG/CIS tooling, mapped directly to controls. Collection can run on a schedule.
AI compliance narratives
Drafts control narratives grounded in your real configurations, not boilerplate templates. Every narrative is a draft until a human approves it, and nothing is auto-submitted.
Read-only AI Copilot
A context-aware assistant that answers questions about the current system and your portfolio. It is read-only and cannot change data.
Inheritance resolver agent
An AI agent that determines which controls are the cloud provider's responsibility and which belong to the customer.
Policy document generation
Generates policy documents for the package alongside control narratives.
Threat-informed prioritization
Ranks remediation using CISA Known Exploited Vulnerabilities (KEV), EPSS exploit-likelihood scores, and MITRE ATT&CK technique mapping.
Risk-based decisions on POA&Ms
Record a risk decision on a POA&M item with a written justification, the decider, and a timestamp, so assessors can see the rationale and approval.
Provenance and timestamps throughout
Evidence carries its collection time and a SHA-256 integrity hash. Narratives record the model and date they were generated with. Decisions keep a trail with author and time.
Profile-based frameworks
Frameworks are YAML profiles, not code. Current profiles cover NIST SP 800-53 Rev 5 (High baseline), DoD IL4 and IL5, FedRAMP 20x (Moderate), CMMC Level 2, NIST AI RMF 1.0, and OMB M-25-21. New frameworks are added by writing a profile.
Submission-ready exports
Produces OSCAL, Word, PDF, SAR, and eMASS packages.
Xacta 360 handoff
Exports a schema-valid OSCAL 1.1.2 SSP and POA&M for import into Xacta 360. This is a file handoff, not a live API integration.
Review Queue for stale and overdue items
Stale evidence and open or overdue POA&M items are escalated to a human Review Queue so reviewers know what needs attention.
AWS commercial and GovCloud (US)
Deploys in AWS commercial and in AWS GovCloud (US), inside your own boundary.
ISSOs
Automated evidence collection and AI-drafted narratives shift ATO effort from writing to review.
ISSMs
See compliance posture across systems with live evidence instead of static spreadsheets.
Assessors
Review evidence-backed narratives with integrity hashes, timestamps, and recorded risk decisions instead of unverifiable boilerplate.
Program managers
Track ATO readiness across a portfolio and reduce the labor burden of reauthorization.