Product guidance ยท September 23, 2026

An architecture model becomes useful operationally when a reviewer can connect a finding to its source, the exact model revision and the next authorized action. A diagram alone cannot establish which detection is deployed or whether the necessary telemetry exists.

Start with a current, reviewed model

Threat Blueprints retains immutable semantic topology revisions. Changing components, security boundaries or typed flows makes dependent analysis stale; moving a card changes its layout without creating a new security meaning.

Asset Context adds exact revisions of explicitly selected business assets to Blueprint components. Identity, freshness and conflicting assertions remain visible. New inventory information does not silently rewrite an accepted architecture.

Review proposed changes before applying them

Forge proposals separate additions, changes, conflicts, removal recommendations and decisions that need an analyst. Inspect the source, assumptions, confidence and intended effect. Apply only a proposal whose required sources, topology and policy remain current.

STRIDE baseline findings and Threat Foundry Resilience Model recommendations are deterministic. Optional AI narrative can assist explanation, while the model and review record retain their authority.

Classify the gap before choosing the work

A detection gap, a validation gap and a telemetry gap need different responses. A missing data source is not repaired by generating a rule that cannot run. Architecture, control and exposure issues also have their own remediation paths.

Eligible detection and validation gaps can create or reuse governed Detection Studio review work. Reviewed risk intake retains the source evidence and decision context. Associated, validated, known deployed, executed and matched remain different states.

Keep handoffs honest

Inspect the target-specific artifact, current validation evidence and customer implementation requirements before treating work as ready. A portable rule export does not establish that a customer installed it.

The supported architecture-to-detection and risk handoffs are useful on their own. They should not be presented as a complete automatic Blueprint-to-hunt execution chain. Later evidence can inform a new review without rewriting an earlier conclusion.

Explore governed Blueprints and compare detection output capabilities.