Kolena Real Estate AI — agentic threat model
Kolena Real Estate AI presents a moderate-to-high risk profile due to its integration with critical property management systems (Yardi, RealPage) and processing of sensitive financial and tenant PII, though this is significantly mitigated by its SOC2 Type II and HIPAA compliance certifications.
OWASP AIVSS score rationale
| Autonomy of Action | 0.40 | |
| Goal-Driven Planning | 0.50 | |
| Self-Modification | 0.10 | |
| Dynamic Tool Use | 0.60 | |
| Persistent Memory | 0.40 | |
| Contextual Awareness | 0.70 | |
| Dynamic Identity | 0.20 | |
| Multi-Agent Interactions | 0.30 | |
| Non-Determinism | 0.50 | |
| Opacity & Reflexivity | 0.60 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — Likely relies on commercial foundation models (e.g., GPT-4, Claude) for multi-format document processing. Primary threats include prompt injection causing incorrect lease term extraction or financial calculation errors.
Processes highly sensitive real estate data, including leases, cash flows, and tenant risk assessments. Risks include data exfiltration of tenant PII and financial records, as well as ingestion of malicious or poisoned PDFs/images designed to exploit parser vulnerabilities.
Orchestrates document parsing, term extraction, and report generation. Insecure tool integration with property management systems (Yardi, RealPage) could allow unauthorized data modification or extraction if the agent framework is compromised.
Not certain from the listing — Hosted cloud infrastructure is implied. While SOC2 Type II and HIPAA compliance suggest strong network isolation, encryption, and access controls, specific sandboxing of document parsers is unverified.
Not certain from the listing — Features real-time analytics dashboards and reporting, but specific LLM-focused observability, drift detection, or hallucination guardrails for financial underwriting are not detailed.
Strong security posture with explicit SOC2 Type II and HIPAA compliance. This ensures robust identity and access management, audit logging, and regulatory alignment for handling sensitive tenant and financial data.
Integrates with major external property management ecosystems (Yardi, RealPage). A compromise of the agent's API credentials could lead to unauthorized access or cascading data exposure across the connected enterprise systems.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).