This is a working pipeline, not a roadmap slide. A threat report comes in, Forge analyses the coverage gap, generates a Shield rule, and throws it into the Crucible. No defence ships without proof it works.
Real-time agent monitoring. Incident-driven defence generation. Every new rule stress-tested before it reaches your machine.
When a new AI-agent attack pattern shows up anywhere in the world, Forge builds a defence for it automatically, hours after detection — not months after your vendor's next release. Every rule is signed, tested, and shipped without waiting on a human.
Your first 30 days of Thuban Individual is free. No card required, just a valid email address.
This is not AI reading the news. It is a controlled machine-speed security research pipeline — every step logged, every step gated.
A report, advisory or disclosure enters the system from a source with a known trust tier.
The source is classified against the trust tiers before anything else happens.
Independent confirmation is required. One unverified post never moves the pipeline forward alone.
Forge attempts to reproduce the incident in isolation — no production access, no live credentials.
A candidate protection rule is drafted. It is an untrusted artefact, not a shipped fix.
The candidate is thrown against adversarial variants to see if it actually holds up.
The candidate must not break existing protections or legitimate workflows.
A person signs off. The machine does not mark its own homework.
Only now does the protection cross the release boundary and reach your machine.
Every signal entering Forge is classified before it can influence anything.
Vendor advisories, CVE/NVD, CISA, OWASP, NIST, maintainer disclosures, peer-reviewed research.
Established cybersecurity publications, named researchers with evidence, major news organisations, IR company reports.
Social posts, forums, anonymous claims, blogs without technical evidence, auto-generated summaries.
Tier 3 can trigger research. It can NEVER trigger protection.
A malicious actor should not be able to invent a story and cause Thuban to block legitimate commands across thousands of machines.
Forge is treated as a potentially hostile research laboratory. Generated protections are untrusted artefacts until they cross the release boundary.
Confidence determines action. Nothing gets blocked on a hunch.
Unconfirmed or poorly documented reports: add telemetry, increase logging, create research tasks. Do not block anything.
Credible but incomplete threats: alert user, require approval, offer temporary high-security mode, add expiring narrow rules.
Reproducible high-confidence threats: ship signed enforcement rules, record Crucible test results, provide rollback and compatibility data.
A real trip through the Forge pipeline, timestamped stage by stage.
No install, no config files, no signup required.
$ npx thuban shield init
Click to copy
New to Thuban? Read the full Getting Started Guide.