Assets and the graph

Every asset Aether AI discovers is a real thing an attacker could reach, and the relationship graph is the factual lens that shows how those things connect. It is not a risk score and it does not rank anything. It answers a simpler, load-bearing question: given this domain, this host, this cloud resource, what else does it touch, and where did each of those come from. That context is what turns a flat inventory into something you can prioritise against.

What counts as an asset

Aether AI discovers your surface from seeds you provide, such as domains, subdomains, IPs, CIDRs and keywords, and it captures the things that surface into a small, deliberate set of asset types. Keeping the set closed means every asset has a clear shape, and the graph can reason about how one relates to another.

• Domain: a registrable domain you own or control, the root of a branch of your surface.
• Subdomain: a name discovered under a domain, often where the actual applications and services live.
• IP: an address a name resolves to or that Aether AI finds directly, the point where a network attack actually lands.
• Cloud resource: an asset discovered through a cloud connector, such as something running in AWS, Azure or Cloudflare, brought in so the surface reflects what is actually deployed.
• Identity or person: a person associated with the organisation, tracked as an asset because attackers target people and their credentials, not only hosts.

Every asset carries its provenance from the moment it is ingested. Aether AI records the provider it came from and the account or scope id it was found under, so a cloud resource is never just an anonymous host: it is tied back to the exact account it belongs to. That provenance is what lets the graph stay honest about where each asset really sits.

The graph is a lens, not a verdict

It is worth being precise about what the relationship graph is, because the word graph gets used loosely. In Aether AI it is a factual map of how assets connect. A domain resolves to an IP. A subdomain sits under a domain. A cloud resource is provisioned in a particular account. Those edges are observed facts, not inferences, and the graph draws them exactly as they are.

What the graph is not is a scoring surface. It does not tell you an asset is dangerous, it does not weight one path over another, and it makes no attempt to guess which of your assets are crown jewels. Risk is scored separately, per asset, from confirmed and live findings, and it stays out of the graph on purpose. Mixing the two would make both harder to trust. The graph's job is to describe the surface truthfully so that everything else, validation, monitoring, risk, has solid ground to stand on.

Why the connections matter

An isolated finding on a single host tells you very little on its own. The same finding matters a great deal more when you can see that the host is a subdomain of a production domain, resolving to an IP in a cloud account you recognise, sitting one hop from an identity that also appears in your surface. The relationships are the context, and context is most of prioritisation.

Seeing how assets relate helps in a few concrete ways. It shows blast direction, in the plain sense of what is adjacent to what, without Aether AI pretending to know business impact it cannot see. It makes provenance actionable, because an asset tied back to a specific cloud account is an asset an owner can be found for. And it keeps discovery grounded, because when a new subdomain or resource appears, you can see immediately where it attached to the surface rather than finding a stray host with no explanation.

This is also where the graph connects to how closely Aether AI watches each asset. Discovery places an asset on the surface, the graph shows where it sits, and the monitoring status you assign decides how much work is done on it from there.

What you see and do

Assets appear on your surface as they are discovered, each with its type, its provenance, and its place in the graph. You can move through the graph from any asset to the things it connects to, which is often the fastest way to understand an unfamiliar part of your own estate. From an asset you set its monitoring status, which is the control that decides whether Aether AI simply records it, watches it passively, or actively validates it.

The statuses are a closed set, and they mean exactly one thing each: Discovered, Confirmed, Monitor, Monitor Plus, and Ignored. Monitor turns on passive enrichment such as open-port inventory and technology detection with change alerting. Monitor Plus adds active exploitability validation on top. Downgrading an asset stops the deeper work, and the tier meters cost per asset, so you spend attention where the surface actually warrants it.

Related