AI · Threat Intelligence · Detection Assurance
X3M.AI connects threat understanding, controlled adversary emulation and AI-assisted evidence reasoning through Merlino and Morgana — free to download from Camelot.
A connected method
Validation only matters when it starts from what the organisation actually needs to protect. The method moves from context and relevant threats, through clearly scoped validation, to evidence that supports real decisions.
Organisation context, important services and exposure shape what actually matters.
Threat scenarios and a Threat Profile focus validation on the behaviours that matter most.
A Catalogue and coherent Validation Packages define clear, traceable objectives.
Morgana plans controlled tests and gathers evidence in the real environment.
Detection reasoning turns evidence into confidence, gaps and priorities.
The ecosystem
Two products with equal weight and distinct responsibilities. Merlino explains why and what to validate. Morgana plans how, records what happened, and reasons over the evidence.
Understands the threat
Merlino turns organisation context and threat intelligence into a Threat Profile and Catalogue — a structured, traceable view of what actually deserves validation.
Operationalises validation
Morgana resolves what can actually be tested, plans controlled validation, executes it and gathers evidence — then reasons over what that evidence shows.
AI across the validation lifecycle
Merlino combines assessment and AI-assisted threat analysis inside Excel. Morgana brings cognitive agents and evidence reasoning into operational validation. Together, they connect the reasons for a test with what the test reveals.
Analyse selected workbook context, run repeatable Promptbooks and produce AI-assisted explanations and report narratives — always reviewed by the analyst.
See Merlino AIThe Executive Brain coordinates specialist cognitive agents and a local inference engine to support planning and evidence reasoning.
See Morgana AIAssurance that supports action
The point of validation is not a score — it is knowing where your defences held, where they did not, and what to do next.
Contact
Nino Crudele · Founder of X3M.AI
For product access, collaboration or a conversation about threat-informed validation, connect with Nino on LinkedIn.