Start with an application boundary.
Review evidence for ECS/Fargate, load balancers, RDS, S3, VPC configuration and IAM roles. Collection scope and source freshness stay attached.
Architecture Modernization
Understand the architecture. Plan the next step.
Connect application evidence, identity context and guided investigation. Review the current state, make missing evidence visible and prepare practical modernization proposals.
Evidence to action
One application. A reviewable starting point.
Begin with a selected snapshot in a Threat Blueprint. Preserve the evidence behind the review as your understanding of the application changes.
- 01Import evidence
Choose one scoped application snapshot and retain its provenance.
- 02Review the architecture
Inspect resources, identities, relationships and evidence gaps.
- 03Plan the next step
Review a guided investigation or an optional modernization proposal.
- 04Share the review
Export a version-bound package with assumptions and limitations.
Current-state architecture
See resources and identities in context.
Explore application resources, application and execution roles, and their recorded relationships in one current-state diagram. Full registers retain the detail behind the overview.
Keep role responsibilities clear.
Distinguish the identity used by application code from the execution role used by the platform. Inspect recorded permissions and trust relationships.
Make uncertainty part of the review.
Keep missing workforce identity, authorization, application and telemetry information visible. A configuration relationship does not prove runtime traffic or effective access.
Guided investigations
Turn architecture context into focused hunt plans.
Generate deterministic suggestions from the selected application, resource or identity scope. Each plan retains a hypothesis, investigation steps, required fields and plausible benign explanations.
Investigate unexpected workload activity.
Review role and session attribution, compare a suitable baseline, and examine activity outside expected application behavior.
Review changes to access and trust.
Identify affected roles and policies, inspect the administrative actor, and correlate changes with the approved change process.
Examine unusual data access.
Confirm object-level telemetry, review the calling identity, and compare access patterns against a suitable baseline.
A useful plan includes its visibility limits.
Field mappings, searchable datasets, role/session attribution, time windows and comparable baselines determine readiness. Configured logging alone does not establish searchable evidence. Suggestions remain unexecuted until the exact query and scope pass the normal execution controls.
Forge-assisted planning
Explore a proposed architecture before changing it.
Use optional, configured AI assistance to prepare modernization alternatives grounded in the reviewed snapshot. Inspect the assumptions and source-to-target lineage behind each proposal.
Compare the proposed outcome.
Inspect proposed resources, relationships and access changes alongside their source evidence and unresolved assumptions.
Review the stages of change.
Examine phased replacement and dependencies so engineering teams can assess the sequence and ownership of the work.
Plan validation and rollback.
Review implementation steps, validation guidance and rollback considerations. Your engineering team controls deployment and verification.
Review packages
Keep the architecture and its reasoning together.
Share a version-bound review package tied to the selected snapshot. Preserve its assumptions, proposed work and investigation limitations for the next reviewer.
Retain structured evidence.
Export the selected package with snapshot identity and content digests for traceable downstream review.
Share a readable review.
Keep architecture detail, review context and planned work together in a portable document.
Carry the diagram forward.
Use a scalable view of the selected architecture in your review materials while retaining the associated evidence package.
Getting started
Choose the workflow your team needs.
Architecture Modernization is enabled per tenant and follows existing permissions, licensing and review controls. Start with one application and an agreed evidence scope.
Can we start without AI or a live integration?
Yes. Import a supported evidence snapshot, review the current architecture, generate deterministic hunt suggestions and export the review. A clearly labeled synthetic snapshot supports a guided demonstration without a model request.
Which cloud evidence is supported?
The implemented modernization evidence profile covers scoped AWS applications. Azure and Google Cloud modernization collectors are not included. Existing Blueprint import capabilities are a separate workflow.
Does a proposal run a hunt or deploy a change?
Review, execution and implementation are separate decisions. Hunt execution requires verified telemetry, an approved query, scope, time window and limits. Modernization proposals provide guidance for your engineering process; they do not deploy infrastructure or change authoritative risk.
What should we validate in our environment?
Confirm collection scope, source completeness, telemetry mappings and any configured AI route before operational use. Synthetic integration tests and an authenticated local journey cover the review workflow; live integration behavior and actual model recommendation quality require environment-specific evaluation.
How is review history retained?
Versioned evidence preserves the basis of earlier decisions. Archive and revocation control future access while retaining historical evidence. Archiving is not physical erasure and cannot recall downloaded copies.
Start with the workflow
Explore your application’s next step.
Bring your current intelligence, exposure, telemetry, architecture, detection content, and analyst or service process. We will map the fastest path to a useful outcome.