Discovery starts from what’s actually running in your cloud and your code.
Point your AI at your environment, or just describe how the company works.
It proposes the systems and risks your record doesn’t have yet.
Harbor Ledger, a made-up fintech, ran discovery on its AWS account.
- Dana
She started the job.
Kanonik copied the prompt for the job, which is called Find the risks that are actually mine. Dana pasted it into Claude Desktop with one extra line: look at the AWS account and the main repository.
- Dana’s AI
The assistant looked at what was really there.
It used read-only access to the AWS account that Harbor Ledger’s IT team had granted to the assistant itself. Then it compared what it found with Harbor Ledger’s record, through Kanonik, and proposed what the record didn’t already have.
- Dana’s AI
It asked what could go wrong with each one.
For every system and vendor, it wrote down a realistic threat, the weak spot the threat would use and what it would cost the business. Each risk carries a likelihood and a severity, and it’s tied to the system or vendor it threatens. In our experience, auditors can tell a template risk register from one written about the company in front of them.
- Kanonik and Dana
Eighteen drafts came back from that one run.
Kanonik checked them on its own server, and they arrived in To decide as one request. All eighteen passed. Dana read them and approved them.
- Kanonik
The gaps showed where controls were missing.
A risk with no control treating it shows up as a gap, and when Dana asks for controls, that’s where the AI starts.
Eighteen drafts from one discovery run, all passed.
To decide in Kanonik, with sample data from Harbor Ledger.
Evidence stays in the system it came from.
Your auditor reads the note on each piece of evidence word for word, so it’s worth a second look before you approve it.
Discovery finds proof as well: last quarter’s access review, a closed ticket, a restore test report in Confluence. Your AI proposes each one as evidence for the control it supports, so at Harbor Ledger the access review would go to Quarterly review of production admin access.
Kanonik keeps the file’s fingerprint, a note of what it proves, the system it came from and the date it was collected, plus a link to where the file lives. If someone edits the file later, even by a single character, the fingerprint won’t match any more.