Valkyrie: turning the scanner firehose into ranked findings
Raw recon output is a firehose of mostly noise. Valkyrie is the triage layer that reads it, ranks what matters by severity, and tells you why each finding is worth your time. Here is what it does, what it costs, and what it does not do yet.
Contents
A content-discovery run against a mid-size target comes back with tens of thousands of responses. Two of them matter. Reading the other forty thousand to find those two is the part of the job nobody has ever enjoyed, and the part that does not get faster when you add machines.
Valkyrie reads it for you and hands back a ranked list. It is not a smarter scanner and it is definitely not an autonomous hacker, whatever the category is claiming this month. It reads output and decides what deserves your attention first. Here is what it does, what it costs, and what it still cannot do.
The real problem: output volume, not output scarcity
Modern recon tooling does not suffer from a shortage of results. The opposite. A single content-discovery run against a mid-size target can return tens of thousands of responses. A subdomain sweep plus a port scan adds thousands more. Each line is technically a "result," and the vast majority are completely uninteresting: a 301 redirect, a generic 200, a tech-detect info note.
The expensive, human part is reading all of it and deciding what deserves a second look. An exposed .git/config, a legacy server with known RCEs, an unauthenticated staging app: those are in there, but they look identical to the noise until someone with context reads the line and recognizes it. That recognition step is what Valkyrie automates.
Think of Valkyrie as the analyst pass that normally happens after a scan finishes, not a replacement for the scan. The engines produce evidence. Valkyrie reads the pile of evidence and tells you where to look first.
What Valkyrie actually does
When a workflow produces output, Valkyrie reads the full set of results and returns ranked findings. Each finding carries three things:
- A severity: critical, high, medium, or low. This is the ordering signal, so the things most likely to matter sit at the top of the list.
- A short title: the specific thing that was found, on the specific host (for example, "Exposed .git/config on target.com").
- A why: a sentence or two of context explaining what the finding means and why it earned that severity, so you are not reverse-engineering the ranking.
The point of the "why" is that a ranked list with no reasoning is just a different kind of noise. You should be able to read a finding and immediately know whether it is worth pivoting on or worth skipping. A legacy Apache 2.2.15 banner gets flagged high because that build has multiple known RCEs, and Valkyrie says exactly that, rather than leaving you to look it up.
Findings land in the same Findings explorer as everything else, so you can filter by severity, search, and export the triaged set to CSV, JSON, or Markdown for your report. See the findings docs for the full explorer.
What it does not do (and why we say so)
We are deliberate about not overclaiming here. Valkyrie reads output and prioritizes it. It does not probe targets on its own, it does not confirm exploitability, and it does not replace your judgment about scope or about whether a flagged item is a real issue in context. A "critical" from Valkyrie means "look at this first," not "this is confirmed exploitable."
A ranked finding is a prioritization signal, not a verdict. Severity tells you where to spend attention first. Confirming a finding is still your call and your responsibility within your authorized scope.
The agentic things people imagine when they hear "AI security agent" are not in the product. Valkyrie does not craft its own payloads and it does not probe a target to confirm a finding. The probing is done by cortex, our vulnerability engine, which ships today and does its own confirmation in ordinary code. Valkyrie reads what cortex and the recon engines produce. We will say plainly if that ever changes.
How it is billed
Valkyrie is the one thing that spends credits, billed separately from your subscription. Scanning never touches them. Triage is charged per finding analysed, so you pay for the reading you actually asked for.
- Every plan pre-loads a batch of credits each term, so normal triage usage is covered by what your plan already gives you.
- Heavier triage draws from your credit balance, and you can top up any time.
- Per-term grants refresh each cycle and purchased top-ups never expire. At a zero balance a prepaid account pauses AI rather than running up a bill.
The separation is intentional. Your subscription buys capacity (nodes, concurrency, workspaces, seats) and unlimited scanning within it. Credits meter only the AI. Pricing them independently means you never pay a flat AI surcharge for a month where you barely ran any triage. See pricing for the plan grants.
Your data stays yours
Valkyrie reads your scan output to triage it, and that is the only thing it does with your data. Your findings are isolated per team and are never used to train any model. The output of your engagement does not leak into anyone else's results, and it does not become training data. This is not a setting you have to find and toggle. It is how the system is built.
Where it fits
If you are a solo hunter, Valkyrie is the analyst pass you do not have time to do by hand on every run. If you are a small red team, it is a consistent first cut across everything your fleet produces, so nothing high-severity sits unread at the bottom of a 40,000-line scan. Either way it changes the question from "did I read all of it" to "what should I look at first."
Run a scan, let Valkyrie read it, and find out whether the top of the list was worth your afternoon. Let it read a scan