A scanner runs, prints its findings, and forgets everything. The next run starts from zero. It doesn't remember that the endpoint it just flagged was flagged last week, that the finding was triaged as a false positive, or that the service behind it moved to a new account three days ago. Statelessness is the default in security tooling, and it's why so much of the work is repetitive: people supply the memory the tools lack.
The Memory Layer is our answer to that. It's a persistent model of your environment that every SecNode agent reads from and writes to. Reasoning accumulates instead of resetting.
What it actually stores
The Memory Layer is a graph, not a log. Entities are nodes, relationships are edges. It's built automatically from your integrations and kept current as your environment changes.
- Environment: code, cloud accounts, services, identities, and the runtime topology that connects them.
- Evidence: findings, reproductions, exploit paths, and the outcome of every past engagement.
- Policy: scope boundaries, approval rules, and the organizational context that governs what agents may do.
The value is in the edges, not in any single node. Knowing a bucket exists is a scanner's job. Knowing that a staging role can assume into the account that owns that bucket, and that the bucket holds data classified sensitive, is reasoning. The graph is what makes that reasoning possible.
Why a graph, not a database of alerts
Reachability is a path problem. Whether a misconfiguration matters depends on whether an attacker can get to it from somewhere they already are, and that's a traversal across identity, network, and trust relationships. A flat table of findings can't answer it. A graph can.
A finding without its surrounding context is a guess. The Memory Layer is the context.
Continuously updated, not snapshotted
Environments drift. A model that's accurate at deploy time and stale a week later is worse than no model, because it invites confident wrong conclusions. The Memory Layer updates as your integrations report change, so agents reason against what's true now. Diffs become signals in their own right: a new endpoint, a widened trust relationship, a role that gained a permission overnight.
Why memory compounds
Every engagement writes back, so each one leaves the environment model richer than it found it. The investigation that reconstructed an incident timeline last month is context for the one that starts today. That's the difference between a tool you run and a system that gets to know your environment. It's also why we say the third engagement knows everything the first two learned.
SecNode AI reasons against this graph on every call. That grounding is what keeps its conclusions specific to you, instead of generic advice a general model could give anyone.