Golem unifies cloud posture, identity, code, software supply chain, data, Kubernetes and host runtime, external attack surface, network posture, Active Directory, AI-SPM and agent security in one inspectable platform — deployed in your environment with source code, Terraform, APIs and your choice of AI.
The October 13 release is organized around one rule: capability claims must be backed by code and evidence. The launch plan targets 99–100 depth across supported launch practices, with 100 reserved for functions that pass their release tests and end-to-end proof.
Every function below is part of the locked release rubric. “Current” means the capability exists in the codebase; “Release hardening” means the capability exists and is being deepened or validated for launch; “October 13 gate” means it is a required launch-track item planned before GA.
Golem does not pretend one scanner can understand every language and attack surface. The platform detects the repository's technology, runs the applicable engines, normalizes results, builds graph relationships and applies exploitability context.
The registered product code/IaC scanner registry contains 12 deterministic scanners. Runtime, DAST, signing and vulnerability-intelligence engines are additional platform components.
Golem's AI-security design treats the model as one component in a larger execution chain. The authorization path stays deterministic: the model can suggest, but policy and human approval decide whether a tool action proceeds.
These are defensive mappings to publicly reported incidents — not claims that Golem was deployed at either organization or that one product could guarantee prevention.
Hugging Face disclosed that a malicious dataset abused code-execution paths in a data-processing pipeline and that the intrusion was driven end to end by an autonomous AI-agent system.
Reuters reported that attackers claimed access to highly sensitive FBI personnel information; Reuters verified portions of leaked material while the FBI investigated the incident.
These are the planned completion tracks before the October 13 release. The objective is 99–100 capability depth across supported launch practices, but a function is labeled 100 only after its release tests, integration proof and evidence pass.
Wiz and Cortex Cloud are major enterprise platforms. Golem's positioning centers on customer ownership, inspectability, deterministic AI action governance, rapid code-level extensibility and one graph connecting code, cloud, identity, data, runtime and agents.
| Decision area | Golem | Wiz | Cortex Cloud |
|---|---|---|---|
| Delivery / control | Customer-owned source + Terraform + graph + evidence | Vendor-operated platform | Vendor-operated platform with sensors/agents where applicable |
| Security Graph | Code → pipeline → image → workload → identity → data → runtime → agent, with declared/observed/confirmed edge evidence | Mature Wiz Security Graph | Broad Cortex exposure and runtime context |
| Azure CIEM | PR #170: real RBAC assignments, transitive groups, privileged roles, service principals, managed identities, cross-subscription reach | Mature multi-cloud CIEM | Mature effective-permission / identity security |
| Native SAST | Native multi-engine SAST through the registered scanner framework | Native SAST and code-to-cloud workflows | Third-party SAST ingestion documented alongside broader Code Security |
| Supply-chain integrity | SBOM + SPDX + licenses + Cosign + expected signer + SLSA provenance + graph lineage | Broad software-supply-chain security | Broad code / artifact / runtime security |
| AI / agent governance | Exact-call approval digest, tool baseline digest, graph reach, kill switch and signed action evidence | AI-APP, AI runtime protection, Wiz MCP, agents/workflows | Unified AI-SPM, AgentiX and native MCP support |
| AI provider choice | Customer chooses cloud or local model | Wiz AI ecosystem | Palo Alto AI ecosystem |
| Runtime evidence | Pod/node + process tree + network connections + DNS config before containment, then response verification | Runtime sensor and cloud context | Deep runtime / XDR / response capabilities |
| Network posture | PAN-OS + Cisco IOS-XE + MikroTik, graph correlation and approval-gated network response | Cloud/network exposure context | Broad Palo Alto network/security ecosystem |
| Customization | Inspect, modify, test and ship the product code in your environment | Vendor platform configuration / APIs | Vendor platform configuration / APIs |
Vendor capabilities change rapidly. Comparison language is intentionally limited to publicly documented features and Golem code verified for this October 2026 release cycle.
DevOps Lab does not take over the client's environment. We train, code, design, troubleshoot and help implementation; the client's authorized staff executes changes in its own cloud, endpoints, network, repositories and production systems.
Deployment planning, integration help, training, supported fixes and handoff. Updates/upgrades remain supported when the customer does not independently fork the supported core.
Up to 20 hours/week, dedicated engineering support plus direct lead-architect involvement for integrations, custom development and implementation.
The release architecture is designed to connect repository and pipeline evidence to artifacts, images, cloud resources, identities, classified data, live runtime behavior and agent actions — then preserve the evidence needed to explain why a decision was made and whether the response actually worked.
Review the code, test the platform against your environment, or talk with DevOps Lab about an October 13 deployment and proof-of-value plan.