NINELINE is Optimal’s AI-native application and supply-chain security platform. Real scanners, real repositories, and frontier-model reasoning compress thousands of raw findings down to the handful that are actually reachable and actively exploited — and every verdict ships with its evidence: the call chain, the tool trace, and an exportable VEX record your assessors and program office can actually use. Named for the close air support brief: strip everything down to the target.
How you get it: NINELINE is deployed inside your own environment — your tenant, your infrastructure, air-gap capable — and delivered with an engagement from the team that built it. Your code and scan data never leave your boundary.
SBOM / Reachability / EPSS + CISA KEV / VEX / AI-BOM / Auto-remediation
From raw scanner output to the targets that matter
Of 874 raw findings, 18 survive to the action queue. Of 8 findings on the CISA Known Exploited Vulnerabilities list, only 2 of 8 are reachable in this deployment — so the model deprioritizes the rest. Reachable-and-exploited is the real target; everything else is noise you can’t afford to chase.
Everything on screen comes from real analysis of real repositories — nothing is hardcoded. The model does the reading, the tracing, and the judgment an analyst would.
The flagship capability. For each high-signal finding, a frontier model reads the actual codebase — grepping, opening files, tracing call chains — to decide whether the vulnerable path is truly reachable from an entry point. It reads the code the way an analyst would, and shows its work.
EPSS exploitation probability, CISA KEV status, dependency position, and the reachability verdict fuse into a single mission priority — written for a program manager, not a pentester.
For the findings that survive triage, the model drafts the exact fix — an appliable pull request with the version bump or transitive override, breaking-change risk, and test focus. Automation fires only for what's proven reachable, not the whole backlog.
Every change to the software bill of materials is narrated in mission terms, and every discovered ML model gets an AI-written risk assessment — license suitability for government use, provenance confidence, training-data lineage.
Ask in plain English — “which critical findings are actually reachable,” “do any of our AI models have license problems.” Answers are grounded in the real scan data through query tools and cited to actual records. Never a hallucination.
The department no longer wants a scan report — it wants living SBOMs, adjudicated findings, and artifacts it can reuse. Reachability and mission context match how programs actually triage: mission assurance, not raw CVSS. And it runs air-gapped — reachability reads source, so nothing has to leave the enclave.
DoW's Software Fast Track moved from pilot to an evolving requirement in January 2026: machine-readable SBOMs that update with every code change, plus continuous risk artifacts. The Army now demands actual SBOM data, not self-attestations, and OMB M-26-05 lets agencies request raw SBOMs. NINELINE produces exactly those artifacts — the SBOM, the reachability-ranked findings, and the VEX record.
A verdict that suppresses a vulnerability alert has to be defensible — to your assessor, your AO, and your program office. Every NINELINE determination carries the call chain, the tool trace, and the record it was derived from, exported as VEX your reviewers can re-derive.
DoD is moving from point-in-time authorization to continuous monitoring. The drift → reachability → gated-remediation loop is exactly that posture, running on your own infrastructure.
CMMC's asset-inventory and vulnerability-management controls still gate DoD business even with Phase II third-party assessments suspended — NIST 800-171 obligations under DFARS 252.204-7012 are unchanged. And while the DIB adopts AI fast, the AI-BOM view surfaces the model license and provenance conflicts that stop a deployment.
Regulatory timelines move quickly — we’ll scope current enforcement to your specific contracts and environment.
“Scanners are commodity. The product is the verdict — and a verdict is only worth what its evidence can prove. NINELINE ships the evidence.”
Click into the live demonstrator, or book a walkthrough and we’ll show it against your stack — then scope standing it up in your environment.
