SecureGraph Documentation

1. What is SecureGraph?

SecureGraph (also called SecureGraph AI) is a cybersecurity command centre made by Phantix Labs Ltd in Lagos, Nigeria. It combines vulnerability assessment and penetration testing (VAPT), continuous security testing and a governed AI pentest agent. Every result is verified before it reaches a report, and your security data stays in your own database or in one that we provision.

It is built for organizations that do security work alongside their main work. It tests your systems the way an attacker would, checks every result before you are asked to trust it, and keeps the record of your security position in your own database or in one that we provision. It runs in the browser; there is nothing to install on your computers.

SecureGraph is a set of applications that share one sign-in, one inventory and one findings register:

2. Core concepts: tests vs. the record

A test is an active check that you start on demand, on a schedule or from your pipeline. It runs against assets in your agreed scope and produces candidate findings for that run.

The record is what SecureGraph builds from your tests over time: the asset inventory, the security graph, the findings register, the risk register and the audit trail. Findings from every test area share one model, so the same weakness found two ways is one finding, and a fix is tracked until a retest confirms it.

3. The test areas: what each one checks

Which areas you can use depends on your plan. A locked page says which plan opens it.

4. Before your first test: what to set up

SecureGraph does not test anything until three things are in place. Each one protects you, and the product tells you which one is missing.

The first time you test a target you own, SecureGraph also asks you to accept the Acceptable Use Policy and the Rules of Engagement. It asks once.

5. Running a test: how to

1. Open Attack and choose a test: a scan, a VAPT campaign or the Autonomous Pentest Agent.
2. Select the targets. A target filter (for example, every asset tagged external) keeps the scope explicit.
3. Unlock operate when the dual-control prompt appears. Starting a test is a protected action.
4. Watch progress live. You can leave the page; the test continues, and the run is in the job history.
5. Approve or decline when the test pauses at a gate. Authentication steps and anything that changes the state of a system wait for a person.
6. Open the results. Each finding has its evidence, its impact and its verification state.
7. Stopped runs can be resumed from the job history. Completed work is not repeated.

6. Graph, correlation & attack paths

Every asset and finding is placed on the security graph, which shows how your systems relate to each other and where a weakness on one reaches another.

• Correlation merges findings that share a root cause, across test areas, into one tracked finding.
• Attack paths join single weaknesses into the route an attacker would take. A completed chain is recorded as one finding with evidence for each link, and a severity that reflects the whole chain.
• Asset intelligence gives each asset a risk score, an exposure level and its related findings.
• Living context: the product context you describe (projects, components, data flows) keeps threat models and priorities current as your systems change.

7. Dashboards

8. Findings lifecycle

A finding has two separate properties: its evidence (how sure we are) and its status (where the fix is).

Evidence

Status

9. The report types

Reports are generated from verified findings only. The list of types comes from the product, so a new type appears without an update on your side.

Formats: PDF and DOCX (following the standard VAPT layout), a PPTX board deck, HTML, Markdown, JSON, CSV and XLSX. Markdown and JSON are on every plan; the board-ready packages are on paid plans.

10. Reading a report

• Executive summary first. It is written in plain language from the stored evidence, in both business and technical terms.
• The verification gate panel states how many findings were reportable, and how many were left out as unverified or rejected. A report never hides what it excluded.
• Each finding has its severity, the affected asset, the evidence, the business impact and the steps to fix it.
• Attack paths appear as one finding with each link shown in order.
• The appendix holds unverified candidates for transparency. They never count towards a severity total.

11. What to expect

• SecureGraph supports your security program. It is not a certification and does not replace an auditor.
• Verification removes noise, but no tool guarantees zero false positives or full coverage. Where a category cannot be tested from the outside, the product says so.
• The AI plans and explains. It never invents a finding, changes a risk score or skips an approval.
• The Autonomous Pentest Agent is not unsupervised: authentication and state-changing actions wait for a person.
• Areas marked in development (for example, parts of security operations) say so in the product.

Organization & plans

1. Create the organization at platform.phantixlabs.com/register with a work email. A 6-digit code confirms the address.
2. The setup wizard asks for the essentials: dual control, your domain, your plan and which applications your company uses.
3. Finish the profile from the checklist on Platform → Home. Verification and branding unlock the full experience.

• Free: asset inventory with fair-use limits, light checks, dual control, MFA, the audit trail and JSON/Markdown exports.
• Starter and Growth: VAPT campaigns, verified findings with remediation, pull-request review and the Autonomous Pentest Agent (credit-metered); Growth adds continuous and recurring testing, cloud posture and the compliance workbench.
• Enterprise: multi-company groups, custom branding and retention, white-label reports and an agreed SLA.

Current prices are on the pricing page.

Connecting your security database

Your findings, assets, risks and evidence live in a dedicated PostgreSQL database that you control. Use an empty database or a dedicated schema; SecureGraph never needs your application tables.

Publicly hosted database

1. Open Platform → Database and select Connect database, then Publicly hosted.
2. Add each SecureGraph address shown on the page to your database allowlist, and tick it.
3. Paste the connection string, select Test connection, then Prepare security database.

Database on a private network

1. Select On a private network and create a Connector named after where it runs.
2. Run the install command shown on the page next to your database. The connector reaches out; nothing needs to reach in.
3. When it reads Online, add the database, test it and prepare it.

People, roles & dual control

Add people on Platform → People. Each person gets a role, and access to each application is set per person.

• Both must use an address on your organization's domain. Personal webmail addresses cannot complete a dual-control sign-in.
• To act, a person unlocks operate with a one-time code. The session expires on its own.
• Reassigning a slot ends the live operate sessions of the previous assignment.

Scope & authorization

• Ownership: an asset is tested only after you prove ownership, for example with a DNS record or an HTTP check.
• Scope is fixed per engagement: once a campaign or agent session starts, its scope cannot be widened.
• Authorization is yours: you confirm that you own, or are authorized to test, every target you connect. SecureGraph supplies the controls; you supply the authorization.
• Scope documents for an external pentest can be drafted in Attack → Scope. Drafts are watermarked as not authorized until the authorizer approves them.

Configuring tests

Test modes

Autonomy (Autonomous Pentest Agent)

Approval gates apply at every level. Budgets for time, turns and AI credits are set per session.

Schedules

Recurring VAPT runs are set on Attack → VAPT → Schedules. Pick a window outside your busy hours. Continuous reassessment can also re-run a scope when your product context changes.

Troubleshooting

AI governance & audit

• The AI acts as the signed-in person and can do only what that person's role allows.
• Every action that changes something needs a fresh, single-use authorization bound to that action.
• Personal data is removed before any request leaves SecureGraph, and your raw security content is not sent out by default.
• Every AI action, decision and denial is recorded. Review them on Core → Activity and the audit trail.
• AI governance settings, budgets and credits are on Platform → AI.

Integrations & alerts

• GitHub, GitLab and Gitea connect through an app installation or OAuth. Public repositories work on Free; private ones on paid plans.
• Alert channels: email on every plan; Slack, Microsoft Teams, WhatsApp and Telegram when configured.
• Severity routing decides which severities reach which channel.
• Cloud accounts connect with the read access you grant, on Defend → Cloud.
• Browse and install integrations from the Core → Integrations hub.

Privacy & data protection

SecureGraph is designed around data-protection law, including the Nigeria Data Protection Act. Analytics on our sites are first-party, cookieless and off until you accept them. Tenant identifiers are removed before a successful procedure is shared as a reusable skill. Read the privacy notice and the Trust page.

Data & storage

SecureGraph never reads production business data such as ERP or CRM rows, customer personal data or your application tables. Repository analysis happens in a temporary workspace that is removed afterwards.

Remediation & retest

• Verified findings enter the fix queue on the Findings tracker, with step-by-step guidance beside the board.
• Give every row an owner and a due date. Overdue and regressed findings are counted at the top of the board.
• After a fix, retest the single finding from its row. A fix that is not retested stays open.
• Retests replay the original evidence against the same scope and return fixed, still vulnerable or inconclusive.
• In Code, AutoFix can propose a patch as a pull request for you to review.

Support

• Raise a ticket from Core → Support or Platform → Support. Quote your tenant ID for a faster answer.
• Step-by-step how-tos for every page are inside each application under Docs.
• Email [email protected], or use the contact page.