TELHAWKGet the free Beta

GALEN SECURITY / HOW IT WORKS

From application code
to a checked correction.

Understand the risk, follow the evidence, and check what the fix actually changes. Galen Security gives your team a connected workflow for the whole review.

Available now: Galen Policy Beta and Managed Galen Security Audits. Self-service Galen Security is coming soon.

Explore the workflow About Galen Security

ONE CONNECTED REVIEW

Find the issue.
Carry the evidence forward.

Each stage preserves the context needed for the next. Telhawk-led managed reviews use this process today. The planned self-service workflow will follow the same review stages, within supported analysis.

  1. 01

    Define the review

    Choose the code version, API paths, or agent workflows to examine. Agree on the access, sensitive data, and security questions that matter to your application.

    A defined scope and review target
  2. 02

    Map the application

    Galen retains facts about routes, calls, data flows, guards, and sensitive operations. Where policy intent is recovered, review and approve the intended baseline for later comparisons.

    Application context that stays with the review
  3. 03

    Establish and prioritize findings

    Inspect the affected path, controls, and evidence behind each conclusion. Review priority in the context of reachability, exposure, and business impact. Keep missing evidence explicit.

    Findings with evidence and a reason to act
  4. 04

    Guide the correction

    Give your developers or coding tool a focused explanation of the issue and the control that needs to change. Review proposed patches and developer-authored fixes before accepting them.

    A proposed change tied to the original issue
  5. 05

    Validate the changed version

    Re-evaluate the corrected code against the same security question. Check the affected path and control, review the validation status, and retain any remaining evidence gaps.

    A checked outcome, rather than an assumed fix
  6. 06

    Report and retain the history

    Keep findings, evidence, reviewed versions, correction decisions, and validation status together. Retained application context and an approved baseline support later reviews.

    A durable record for technical and business reviewers

THE EVIDENCE LAYER

Code facts first.
An explanation you can inspect.

Galen is Telhawk’s proprietary engine for web application security. It retains the relationships between entry points, data, controls, and sensitive operations, then derives findings and verifies their derivation.

AI-assisted review uses that focused evidence to explain an issue and help prepare a correction. The application context remains available outside a single conversation or coding session.

Read the full methodology
Evidence behind a finding
Reachability
The route, handler, or call path leading to the operation.
Data flow
Where the relevant value originates and how it changes.
Controls
The permissions, guards, and constraints along the path.
Sensitive operation
The point where an unsafe action or exposure can occur.

Inspect the proof status and any missing evidence alongside the conclusion.

YOUR APPLICATION / YOUR WORKFLOW

Review the paths
that matter to your team.

The analysis is independent of the AI model that wrote the code. Scope the review around your application and development process; coverage varies by language, framework, and check.

Code and API paths

Examine routes, handlers, input flows, and sensitive operations across the supported application structure.

Access and sensitive data

Review ownership, tenant and role boundaries, guards, and fields exposed through responses.

AI-written code and agent entry points

Review generated changes and supported tool or permission paths through the underlying application code.

Corrections and release versions

Review a defined version, recheck submitted fixes, and compare supported behavior with the approved baseline.

VALIDATION AFTER CORRECTION

A patch is a proposal.
Recheck the boundary.

Keep the affected route, expected control, and original finding attached to the correction. Re-evaluate the changed version and retain the outcome with its evidence.

Functional tests and code review remain part of the process. A check establishes what the supported analysis can demonstrate; incomplete evidence remains a gap to resolve.

Illustrative example · customer export

Expected rule: only administrators may export customer records.

Finding

Sign-in alone permits the export.

The route authenticates the requester but omits the required administrator guard.

Correction to review

Restore the role check.

Apply the administrator guard before the sensitive operation. Review the change and run the check again.

Validation asks: does the corrected path now enforce the intended boundary?

Conceptual workflow, not live product output or a reported scan result.

CHOOSE WHO LEADS THE REVIEW

Managed review today.
Self-service coming soon.

Galen Security

Coming soon: your team will be able to initiate audits, inspect findings, manage remediation, and check submitted corrections. Keep the review in your own development process.

Explore Security plans

Managed Galen Security Audit

Telhawk scopes and leads the engagement, interprets the evidence, guides remediation, and reviews submitted corrections. Receive reporting appropriate to the agreed scope.

Explore Managed Audit

MAKE THE NEXT REVIEW COUNT

Know the issue.
Check the correction.
Keep the evidence.

Bring a defined security question to your next application review.

View Security plans Talk to Telhawk