Proof Engine.
Five engines that answer with evidence instead of opinion.
Evidence instead of opinion
Opinions are cheap in security. These engines return something you can check: a certificate, a counter-example, a ledger line, a policy trace.
Proof of Annihilation
Computes the extinction number (k): the smallest set of privileged identities or controls an adversary must compromise to destroy every recoverable copy of your data. A higher k means a harder attack.
Z3 Digital Proof
Encodes the current policy and the proposed fix and asks an SMT solver one question: could this change remove access that must stay?
Regulated Data Proof
Evaluates SCPs, permission boundaries, resource, endpoint and key policies together and shows whether anyone outside the allowed boundary can reach regulated data, and by which path.
CVE Ground Truth
A vulnerable package is not a vulnerable system. Ground Truth checks whether the vulnerable code can be reached and executed.
Proof you can hand to an auditor
A certificate, not a score
Proof of Annihilation returns a certificate that an independent checker, sharing no code with the engine's graph libraries, can verify. Then it proposes the cheapest cut that raises k.
Limits: computed on the modelled graph and the providers you have connected; it does not test restore speed.
Fix without fear
The fear of breaking production is why findings stay open. Z3 Digital Proof answers with the exact counter-example, or a proven no under the modelled policy semantics.
Limits: covers the policy layers Arkhein models; it does not observe runtime behaviour.
Ledger Truth Engine
Your bill knows about resources your inventory doesn't. The engine reconciles billing lines against the graph and flags spend with no known owner: shadow IT, forgotten environments, hijacked compute.
Evidence mapped to your regulators
Regulated Data Proof produces evidence mapped to BACEN 4893, LGPD, PCI-DSS, GDPR and HIPAA controls, showing who can reach regulated data and by which path.
Limits: mapped evidence for your auditor; it is not a certification.
Answers about
Proof Engine
The smallest number of privileged identities or controls an attacker must compromise to destroy every recoverable copy of your data. A higher k means a harder attack.
An independent checker that shares no code with the engine's graph libraries verifies it, so the result does not depend on trusting the engine.
No. It proves properties of the policy layers Arkhein models, under the modelled semantics. Runtime behaviour is covered by Live Defense.
No. It produces evidence mapped to BACEN 4893, LGPD, PCI-DSS, GDPR and HIPAA controls that your auditor can review.
It stays visible as unknown. Reachability depends on language support and runtime visibility, and CVE Ground Truth never silently drops a finding it cannot assess.
Ready to see your cloud
as an attacker does?
Book a demo and our team will walk you through Arkhein on your own cloud.