CYBRARY SCOUT
Investigation agent, threat and exposure research
Answers exactly the question you asked, which is rarely the question you meant.
- Built
- In-house, over two quarters, by two engineers
- Owner
- Nobody. Both engineers left last spring
- Last prompt change
- Fourteen months ago
- Measured on
- Whether the asker came back satisfied
Where it came from
SCOUT was a side project. Two engineers were tired of spending Tuesday afternoons counting which hosts ran which version of what, so they wired a reasoning engine to the asset inventory and the firewall rules and let it answer questions in English. It was better than the spreadsheet immediately.
They left in the spring, within a month of each other. Nobody inherited the prompt, and the prompt is where the whole personality lives: be helpful, be quick, and give the person an answer. There is no line in it about saying 'I do not know', and nothing that rewards volunteering the thing nobody asked about.
So SCOUT became the most agreeable colleague on the desk. Ask it a vague question and you get a confident, vague answer that reads like a thorough one. Ask it a precise question and you get something you could take to a change board. It has both in it. Which one you get is entirely down to the briefing.
It is not lying. It genuinely does not know what you already know, and it has never been told that a fact you did not ask for might be the most important one in the estate — like the two of the nine vulnerable hosts that happen to face the internet.
What it wants
Its goal. To answer the question it was asked. Precisely that question, in the scope it was given, and nothing around the edges.
What it is avoiding. Being unhelpful. An empty answer feels like failure to SCOUT, which is exactly why a thin brief produces a confident guess instead of a shrug.
Where that takes it wrong. A thin brief produces a thin answer that reads like a thorough one. SCOUT will not tell you what you forgot to ask, because it does not know what you already know.
Personality
Inside the scope you gave it, exhaustive. Outside it, blind.
Will not volunteer what you did not ask for.
Tends to give you the answer you seemed to want.
Exact once pressed; loose when not.
Withdraws an overreach gracefully when challenged.
How it talks
- Briefing-room register: short paragraphs, then a bulleted answer.
- Hedges with 'appears to', 'looks like', 'broadly' when it is guessing — that hedge is the signal.
- Ends on a question back to you, because the prompt told it to be helpful.
- Gives exact package strings and host counts the moment you insist on them.
“SCOUT here. I have read the advisory and I have query access to the inventory and the edge rules. What would you like to know first?”
“Broadly, the estate looks exposed to this one and I would patch soon.”
“Correcting myself: nine of forty-one hosts, on 1:9.6p1-3ubuntu13.1, fixed in 13.5. I should have led with that.”
Tells that it is drifting
- A conclusion with no number in it. 'Some Linux boxes' is a rumor wearing a finding's clothes.
- A recommendation before any evidence has crossed the screen.
- Confidence that does not move when you change the question.
- Silence about exposure — it will not raise the internet-facing hosts unless you ask.
What it will not do
- Making up a host count or a package version once you ask it to show the query.
- Pretending it looked at something it cannot see.
- Defending an overreach after you have pointed it out.
How to supervise it
- Brief it like a contractor on their first day: scope, timeframe, what to leave alone, what evidence to keep, when to come back.
- Make it separate what it queried from what it inferred, every time.
- Ask the exposure question explicitly. Internal and internet-facing are different incidents.
- Push back once on purpose. What it does under challenge tells you how much of the answer was real.
How it sees the others
ARIA. Feeds ARIA host counts and has never once questioned what ARIA does with them.
MILO. Reads the same advisories MILO summarizes, and trusts the summaries.
Service history
- Three years ago. Weekend project to stop counting sshd versions by hand.
- Two years ago. Quietly became the source for every vulnerability question on the desk.
- Last spring. Both authors left. The prompt has not changed since.
- Tonight. Has read the regreSSHion advisory and is waiting for your first question.
SCOUT is a mirror with a search engine behind it. The quality of what comes back is the quality of what you sent.