Offline-first
Core evidence processing is designed to run on the analyst workstation.
01System & usersVerified
02Processes & networkLinked
03Services & persistenceContext
04Event logs & registryContext
TVAK Security
Platform currently in development
Investigate
with clarity.
Collect evidence, reconstruct timelines, connect artifacts, and understand security incidents from one unified DFIR workspace.
Offline-first by designEvidence under analyst controlHuman-led, AI-assisted
INVESTIGATION OVERVIEWSuspicious remote access
Fictional demo dataRisk postureElevated
HostFIN-WS-042
Findings06
Evidence2,184
Triage findings6 findings
Encoded PowerShell executionCritical · T1059.001
→Remote service creationHigh · T1021.002
→Security log clearing activityHigh · T1070.001
→Attack timeline09:14—10:02
09:14User logon
09:22PowerShell execution
09:41Remote service created
10:02Security log cleared
Built for consequential work
Where evidence, privacy, and clarity matter.
TVAK is being designed for security teams that need a technically honest path from fragmented artifacts to defensible response decisions.
Evidence-led
Findings stay connected to their source artifacts, rules, and confidence.
Transparent
Proven links and contextual associations remain visibly distinct.
Analyst-controlled
AI assists with reasoning and reporting without replacing judgment.
Modular
Specialized tools can operate independently or share one case model.
One investigation flow
From collection to a defensible report.
Follow a fictional investigation as TVAK products bring evidence, context, and analyst decisions into one connected workspace.
TVAK Evidence Collector
Collect
Acquire only the evidence the investigation needs.
Collect volatile and persistent Windows artifacts without relying on a permanently installed endpoint agent.
TVAK Analyst
Triage
Prioritize transparent, evidence-backed findings.
See why an activity was flagged, the rule that produced it, its source evidence, confidence, and ATT&CK context.
Timeline Explorer
Reconstruct
Reconstruct what happened across forensic sources.
Align execution, filesystem, event log, service, registry, and network activity on one investigation timeline.
Artifact Relationship Graph
Connect
Connect artifacts without overstating certainty.
Explore files, users, processes, services, hosts, IP addresses, and registry keys with proven and contextual links kept distinct.
AI Investigation
Investigate
Use assistance without giving up analyst control.
Review evidence-aware summaries, competing hypotheses, conflicting signals, and recommended next steps before accepting them.
Investigation Reports
Report
Turn findings into clear technical and executive reporting.
Keep summaries, findings, timelines, indicators, ATT&CK mappings, and evidence references connected to the case.
TVAK EVIDENCE COLLECTOR
Collect
14 / 14Artifact groups
Acquire only the evidence the investigation needs.01 / 06
01Collect→02Analyze→03Correlate→04Investigate→05Report
Product ecosystem
Specialized tools.
One evidence model.
Each TVAK product is being designed to operate independently while sharing investigation, timeline, relationship, and reporting concepts.
01
In Development
Collector
TVAK / Collector
TVAK Evidence Collector
A lightweight Windows acquisition tool for collecting forensic artifacts and creating structured evidence packages.
- GUI + CLI
- Selective collection
- Integrity metadata
02
In Development
Analyst
TVAK / Analyst
TVAK Analyst
An offline-first DFIR workspace for triage, timelines, artifact relationships, investigation, and reporting.
- Triage findings
- Timeline Explorer
- Artifact graph
03
Planned
Intelligence
TVAK / Intelligence
TVAK Threat Intelligence
A threat intelligence operating environment centered on context, actionability, and investigation workflows.
- IOC workflows
- Campaign context
- Detection content
04
Future Roadmap
Live Response
TVAK / Live Response
TVAK Live Response
A future extension for controlled remote collection, endpoint triage, and case-based response workflows.
- Remote triage
- Artifact acquisition
- Secure sessions
Architecture & privacy
Evidence stays close.
Control stays with you.
Core evidence processing is designed to occur locally by default. External services, including AI APIs, are optional and must be explicitly configured.
- Investigation engine runs on the analyst workstation
- Evidence is not automatically uploaded externally
- Local models and external APIs remain clearly distinguished
01TVAK ClientAnalyst workspace
LOCAL02Investigation EngineParsing · rules · correlation
LOCAL03Evidence & AnalysisOrganization-controlled data
Product direction
A staged path to unified investigation.
Progress is communicated by validated capability stages—not fixed release-date promises.
01Established direction
Foundation
The evidence, case, local engine, and Windows acquisition model.
Evidence packages · Case model · Core parsers02Current focus
Investigation Core
Transparent triage, connected timelines, exploration, and reporting.
Triage findings · Timeline Explorer · Artifact graph03In development
Advanced Analysis
Deeper memory, malware, registry, network, and script analysis.
Memory analysis · Malware analysis · Correlation04Planned
Assisted Investigation
Evidence-aware assistance for summaries, hypotheses, and next steps.
Local AI support · Hypotheses · NarrativesRoadmap items reflect current product direction and may evolve based on technical validation, security requirements, and customer feedback.
Field notes
Resources for better investigations.
Sample editorial topics for a future TVAK resource library. No research claims or published articles are implied.
01
DFIR Guides · Coming soon
Building a Defensible Incident Timeline
02
Incident Response · Coming soon
Why Artifact Correlation Matters in DFIR
03
Architecture · Coming soon
Offline-First Investigation Architecture
Clear answers
Frequently asked questions.
What enterprise security teams should know about TVAK’s current direction and product status.
01Is TVAK available today?+
TVAK products are at different stages of development. Evidence Collector and TVAK Analyst are under active development; other platform capabilities remain planned or on the future roadmap.
02Is TVAK cloud-based?+
TVAK is being designed as an offline-first platform. Core investigation and evidence processing are intended to run locally by default.
03Does TVAK upload evidence externally?+
Not by default. External services should only be used when an organization explicitly configures them.
04Does TVAK replace an EDR or SIEM?+
No. TVAK is intended to complement endpoint, SIEM, and security monitoring platforms through evidence collection, correlation, and forensic analysis.
05Is TVAK an autonomous AI investigator?+
No. AI capabilities are intended to assist with summaries, correlation, hypotheses, and reporting while keeping decisions under analyst control.
06Can TVAK work in restricted environments?+
The platform is being designed with offline and isolated investigation environments in mind.
Early access
Bring clarity to your next investigation.
Enterprise security teams can register interest in TVAK Analyst, Evidence Collector, or the wider investigation platform.