NINELINE is Optimal’s working reference implementation of AI-native application and supply-chain security. Real scanners, real repositories, and frontier-model reasoning compress thousands of raw findings down to the handful that are actually reachable and actively exploited — the targets that matter. Named for the close air support brief: strip everything down to the target.
SBOM / Reachability / EPSS + CISA KEV / AI-BOM / Auto-remediation
From raw scanner output to the targets that matter
Of 874 raw findings, 18 survive to the action queue. Of 8 findings on the CISA Known Exploited Vulnerabilities list, only 2 of 8 are reachable in this deployment — so the model deprioritizes the rest. Reachable-and-exploited is the real target; everything else is noise you can’t afford to chase.
Everything on screen comes from real analysis of real repositories — nothing is hardcoded. The model does the reading, the tracing, and the judgment an analyst would.
The flagship capability. For each high-signal finding, a frontier model reads the actual codebase — grepping, opening files, tracing call chains — to decide whether the vulnerable path is truly reachable from an entry point. It reads the code the way an analyst would, and shows its work.
EPSS exploitation probability, CISA KEV status, dependency position, and the reachability verdict fuse into a single mission priority — written for a program manager, not a pentester.
For the findings that survive triage, the model drafts the exact fix — an appliable pull request with the version bump or transitive override, breaking-change risk, and test focus. Automation fires only for what's proven reachable, not the whole backlog.
Every change to the software bill of materials is narrated in mission terms, and every discovered ML model gets an AI-written risk assessment — license suitability for government use, provenance confidence, training-data lineage.
Ask in plain English — “which critical findings are actually reachable,” “do any of our AI models have license problems.” Answers are grounded in the real scan data through query tools and cited to actual records. Never a hallucination.
Reachability and mission context match how the department actually triages — mission assurance, not raw CVSS. And it runs air-gapped: reachability reads source, so nothing has to leave the enclave.
Asset inventory and vulnerability management are gating controls for keeping DoD business. NINELINE is the evidence engine — an authoritative SBOM plus the risk analysis on top of it.
Federal software-supply-chain direction (EO 14028, OMB memoranda, NIST SSDF) expects a bill of materials and secure-development attestation. This produces the SBOM and the reachability-ranked findings against it.
DoD is moving from point-in-time authorization to continuous monitoring. The drift → reachability → gated-remediation loop is exactly that posture, running on your own infrastructure.
Model provenance, license, and lineage tooling barely exists while the DIB adopts AI fast. The AI-BOM view surfaces the license conflicts that stop a model from reaching production.
Regulatory timelines move quickly — we’ll scope current enforcement to your specific contracts and environment.
“NINELINE is how we show what governed, AI-native security looks like when we build it — a working reference implementation you can run in your own environment, not a SaaS subscription.”
Click into the live demonstrator, or book a walkthrough and we’ll show it against your stack — then scope standing it up in your environment.
