the forge

Author a fix.
Ship it in minutes.

A new vulnerability drops on a Friday afternoon. Security teams scramble. Am I impacted? What do I do? The Forge answers both — automatically. Chat with the Forge. It investigates the issue, drafts a check, authors a strategy, defines a scope, and deploys. The window between disclosure and remediation closes from days to minutes.

forge · session #f-2148 — package compromise · npm
LIVE
forge ▸ ask the forge anything… ⌘ K

Vendors ship checks on their timeline. Attackers don't.

Most vulnerability tools depend on vendor-supplied detection content. When a Log4Shell or a major package compromise drops, you wait — sometimes days — for your scanner to know what to look for. By the time the check lands, the exploit window has been wide open.

The Forge cuts the wait out entirely. It works the way you'd work if you had infinite security engineers and infinite hours: researching the issue, writing the check, authoring the fix, defining where it runs, and shipping it — all in a single agentic flow.

Disclosure → Working Check
Attackerworking exploit
~ minutes
Vendorscanner content
days
— sometimes weeks
The Forgecheck + fix shipped
minutes
how it works

Investigate and ship.

The Forge is an agentic interface — closer to Cursor or Claude Code than to a SIEM rule editor — that operates across your infrastructure and your endpoints.

Tell it what you're worried about.

What to look for. The detection logic that surfaces a finding.

"There's a new compromise in a package we use. Am I affected? Fix it."

The Forge investigates.

It pulls the published indicators, reads the advisory, and queries your graph for affected endpoints.

$advisory.read()
$graph.query()
47 hosts

It authors the primitives.

A check to detect the issue, a strategy to fix it, and a suggested scope — all drafted automatically.

CHECKSTRATEGYSCOPE

You approve. It ships.

Or you adjust scope, threshold, or approach first. Your call.

edit scopeAPPROVE & SHIP

It learns.

Every execution feeds the next one — across your fleet, and across every Furl customer.

Independent of vendor roadmaps.

This is the part competitors can't match. Every legacy tool is a thin layer over someone else's content. When the vendor lags, the tool lags. The Forge makes you the vendor. New zero-day this morning? You don't wait. You ship.

Detection content · who supplies it
Legacy scannervendordays
EDR rulesvendordays
SIEM contentvendor + youhours
The Forgeyou (agentic)minutes