Kolena Corporate AI — agentic threat model

Not certain from the listing — The specific foundation models powering the 99% accurate responses are not disclosed. Threats include adversarial prompt injection and model reprogramming, which could bypass corporate counseling guardrails.

Not certain from the listing — While the platform processes multi-format documents (PDFs, presentations, video, audio), the underlying RAG architecture and vector database security are unspecified. Threats include document-based prompt injection and unauthorized data extraction.

Not certain from the listing — The orchestration framework for the no-code agent builder is proprietary. Threats include insecure tool integration with existing corporate systems and memory poisoning during multi-turn customer support interactions.

Not certain from the listing — The hosting environment and sandboxing mechanisms for processing untrusted multi-format files are not detailed, though SOC2 compliance implies standard cloud security controls. Threats include container escape during video/audio parsing.

Confident. The platform includes real-time analytics dashboards and reporting to monitor agent performance and response accuracy. Gaps may exist in detecting semantic drift or adversarial inputs that do not trigger standard validation rules.

Confident. Demonstrates a strong security posture with explicit SOC2 Type II and HIPAA compliance, indicating robust identity management, data encryption at rest/transit, and auditability for sensitive corporate and healthcare data.

Not certain from the listing — Although the platform deploys multiple specialized agents (recruiting, finance, support), it is unclear if they interact autonomously. Threats include cascading failures or unauthorized cross-agent data leakage within the enterprise tenant.