> For the complete documentation index, see [llms.txt](https://doc.threatreaper.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://doc.threatreaper.ai/getting-started/pre-requisites.md).

# ✅ Pre-requisites

One Platform - One Source of Truth  Enterprise GRC – AI Security & Governance

Before you sign in and start using LockThreat, make sure you have the following ready. This page is organised so you can jump straight to what applies to you.

### 1. Account access

| You need                                                                                                                                    | Notes                                                                                                         |
| ------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- |
| An invitation email from your administrator, **or** a self-registration link (if your deployment allows new organisations to self-register) | See Quick Start → Step 1                                                                                      |
| A valid work email address                                                                                                                  | Used for sign-in and for receiving invitation/password-reset links                                            |
| A password that meets the policy                                                                                                            | At least 8 characters, one uppercase letter, and one digit                                                    |
| Knowledge of which **organisation** and **project** you belong to                                                                           | If you belong to more than one, you'll be asked to choose at sign-in. Ask your administrator if you're unsure |

> If your company uses LockThreat single sign-on (SSO), you won't need a separate LockThreat password — use the SSO sign-in option your administrator provides instead.

### 2. Browser and network

* **Supported browsers:** the latest versions of Chrome, Firefox, Safari or Edge.
* **Network access:** your device needs outbound HTTPS access to your console URL (for example `https://console.threatreaper.ai`, or your On-Premises URL).
* **Session behaviour to expect:** sessions time out after about 15 minutes of inactivity, and (by default) only one active session per user is allowed — signing in on a second device may end the first session, depending on your administrator's configuration.

### 3. The right role for the task

Not every task needs an administrator — but some do. Check with your administrator if you can't see an option described in these docs:

| Task                                           | Typical role needed                                            |
| ---------------------------------------------- | -------------------------------------------------------------- |
| Run a scan, test a policy, view dashboards     | Standard project member                                        |
| Create a policy, project, or chat wrapper      | Role with **Create** permission on that module                 |
| Add a connector, invite a user, manage billing | Role with **Create/Update** permission on Settings             |
| View audit logs                                | Role with **View** permission on Audit Logs (often Admin-only) |

### 4. Credentials for the integrations you plan to use

You don't need all of these — only gather credentials for the systems you intend to connect. Each is entered once, into a **Connector**, and reused across modules.

| If you plan to...                                                                         | You'll need                                                                               | Where to get it                                                  |
| ----------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- | ---------------------------------------------------------------- |
| Scan an **AWS** account (AI-Discover)                                                     | Access Key ID, Secret Access Key, AWS Region                                              | An IAM user/role with read-only inventory + security permissions |
| Scan an **Azure** subscription                                                            | Tenant ID, Client ID, Client Secret, Subscription ID (GUID format)                        | An Azure AD App Registration                                     |
| Scan a **GCP** project                                                                    | Project ID + a Service Account JSON key                                                   | GCP IAM & Admin → Service Accounts                               |
| Scan a **GitHub** repository (AI-Probe)                                                   | A personal access token (`ghp_`, `gho_`, or `ghs_` prefix)                                | GitHub → Developer Settings → Personal Access Tokens             |
| Protect or test an **LLM provider** (OpenAI, Azure OpenAI, Anthropic, Gemini, and others) | An API key for that provider                                                              | The provider's own developer console                             |
| Deploy a **network or endpoint agent** for on-prem/local discovery                        | A reachable host with outbound HTTPS to your console, and permission to install the agent | Your IT/infrastructure team                                      |
| Route alerts to **Slack / Microsoft Teams**                                               | An incoming webhook URL for the target channel                                            | Slack/Teams app directory → Incoming Webhooks                    |
| Route alerts by **email**                                                                 | SMTP host, port, and credentials                                                          | Your mail provider                                               |
| Set up **billing**                                                                        | A payment card or bank account                                                            | —                                                                |

> **Security tip:** use the least-privileged credential that works (read-only/inventory roles for cloud, a scoped token for GitHub). Never share these credentials outside your organisation.

### 5. Licensing and credits

* Confirm your organisation's plan includes the modules you intend to use — a module only appears in the sidebar if it's licensed, enabled for your project, and permitted by your role.
* Some actions (scans, compliance checks, creating a chat wrapper) consume **credits** from a per-module balance. Ask your administrator what your organisation's current balance is before running a large batch of scans.

### Checklist before you start

* [ ] I have a sign-in method (invitation accepted, or SSO access confirmed)
* [ ] I know my organisation and project name
* [ ] I know my role, or who to ask if I'm missing a permission
* [ ] I have credentials ready for the specific connector(s) I plan to add
* [ ] I've confirmed credits are available for the module I'm about to use

Ready? Continue to 🚀 Quick Start.

\
\
**Table of Contents**\
 

1. About Us 
2. Who we are “LockThreat” 
3. Platform modules 
4. Architecture 
5. Deployment architecture & modes 
6. Technical pre-requisites 

 

**1. About LockThreat** 

LockThreat is an AI-native Enterprise GRC, Cyber Compliance and AI Security & Governance platform that governs and defends. The platform provides organizations with structured visibility, risk management, compliance oversight, control management, and protection across their evolving technology and AI environments. 

For years, GRC platforms helped organizations document controls, prepare audits, and report risk after the fact. That model is no longer enough. 

Enterprises are now operating in a world of cloud, cyber risk, AI applications, autonomous agents, data privacy pressure, and continuous regulatory change. Risk is no longer static. Controls cannot be checked once a year. AI cannot be governed only through policy documents. 

LockThreat brings Enterprise GRC, Cyber Compliance, and AI Governance & Security into one platform — so organizations can govern, quantify, and defend risk in real time. 

We call this GRC 3.0. 

It combines the system of record for governance with the system of defense for cyber and AI risk. One platform to manage controls, policies, evidence, audits, cyber posture, AI usage, AI compliance, and runtime AI protection. 

For regulated enterprises, government, financial institutions, healthcare, and critical industries, LockThreat gives leaders what legacy tools cannot: continuous visibility, reusable evidence, measurable risk, governed AI adoption, and defensible control over the modern enterprise. 

Discover → Test → Protect → Govern → Monitor → Respond 

 

**2.1 Platform Modules** 

* **Enterprise GRC** - The system of record for enterprise risk unifying policies, controls, audits, evidence, third parties, and board reporting across the business. 
* **Cyber Compliance** - Continuous control assurance mapping frameworks, testing control effectiveness, finding gaps, and keeping audit-ready evidence in real time. 
* **Discover** - Discovers AI applications, models, agents, vector databases, AI infrastructure, shadow AI usage, vulnerabilities, exposed security assets, and unmanaged AI/ML assets. 
* **Probe** - Tests AI systems, code repositories, model artifacts, and AI applications against adversarial attacks, emerging threats, prompt injection, jailbreaks, unsafe outputs, and other emerging AI threats. 
* **Protect** - Protects AI applications, Bots, agents, Agentic AI, LLM chats in real time through policy enforcement, threat detection, sensitive data protection, and security controls. Supports autonomous or agent-assisted security validation 
* **Govern** - Aligns compliance regulations & frameworks for AI initiatives, evidence collection, regulatory obligations, and audit requirements. 
* **Optimize** - Provides visibility and analytics into AI usage and token-related activities to support monitoring, analysis, rate limiting & budget control for AI consumption. 

 

 

 

3\. Architecture 

LockThreat can support deployment models aligned with the customer's security, data residency, infrastructure, and operational requirements. 

Reference architecture for our platform deployment either in your own cloud/ on premises 

**Managed SaaS**: Fully managed SaaS, multi-tenant or single tenant with a single dedicated database for customers that require full isolation.  

**Private Cloud and VPC**: Dedicated deployment inside the customer's own cloud account, with custom networking and integration to existing workloads. 

**On premises**: Deployed in the customer's own data center or on-premises servers, fully behind the corporate perimeter. 

Sovereign and In-Country: Approved regions with full data residency for government, defence, and highly regulated financial services 

 

 

  

 

4\. Technical pre-requisites 

This section provides detailed information on the infrastructure, network, and connectivity prerequisites required to execute the POV. Specifications should be confirmed jointly with the customer's infrastructure team prior to deployment. 

4.1 Prerequisites for On-Premises / Private Cloud Cluster 

<table data-header-hidden><thead><tr><th></th><th></th><th></th></tr></thead><tbody><tr><td colspan="3">Com<code>pute</code>  </td></tr><tr><td>Category  </td><td>Specification  </td><td>Remarks  </td></tr><tr><td>Compute –  K8s </td><td>4 vCPU / 8 GB * 2 nodes = Run UI, backend, chat &#x26; ingress.  </td><td>Either vm or k8s CPU is sufficient.  </td></tr><tr><td>Compute –  K8s </td><td>16 vCPU / 32 GB * 2 node = Run ML/LLMs and inference engines </td><td>For optimal performance, we recommend having a GPU for specific latency requirements. (Start with 2 and then scale) </td></tr><tr><td>Storage (SSD)  </td><td>200 GB SSD    </td><td>For Storing data   </td></tr><tr><td>Operating System  </td><td>Ubuntu 24.04 LTS (Hardened CIS Level 1)  </td><td>Based on what is available on cloud or on-premises we are agnostic   </td></tr><tr><td>Database  </td><td>MongoDB community, MongoDB atlas or Cosmos DB </td><td>See below in 3.2  </td></tr><tr><td>Network Interface / IP  </td><td>10 Gbps NIC   /24 minimum subnet </td><td>Any network subnet is fine this is just for internal pods  </td></tr><tr><td>Internal IP  </td><td>Static IP pool of 5 no’s </td><td>For UI, backend, DB </td></tr><tr><td>External IP   </td><td>1 no’s Mapping for FQDN  </td><td>One for Frontend to access UI </td></tr><tr><td>Load Balancer  </td><td>Load balancer  </td><td>For distributing the load </td></tr><tr><td>Reverse proxy  </td><td>NGINX Ingress Controller (Deployed in K8s cluster) </td><td>TLS, SSL certificate, routing, traffic controller </td></tr><tr><td>DNS / DHCP  </td><td>Required (local DNS or external) / Required </td><td> </td></tr><tr><td>Secrets management </td><td>HashiCorp Vault, AWS Secrets Manager, Azure Key Vault) </td><td>Any which is relevant </td></tr><tr><td>Firewall/Security Group rules </td><td>(inbound/outbound allowlist) </td><td>As per customer network policy </td></tr><tr><td>Monitoring stack </td><td>(Prometheus/Grafana or equivalent) </td><td>Customer to consider their own stack idea is to ensure that infra is monitored </td></tr><tr><td>Private registry endpoint </td><td>ACR, GCR, Docker etc. </td><td> </td></tr><tr><td>Alerting/notification channel </td><td>Email SMTP </td><td> </td></tr><tr><td>Optional - Backup </td><td>Backed deployment yaml and db  </td><td>If on premises – applicable </td></tr><tr><td>Internet Access  </td><td>Yes In Jump server  </td><td>Required (for licensing, updates, logs, Model APIs) Jump Server </td></tr></tbody></table>

&#x20;

4.2 Database  &#x20;

| Category                                        | Specification                      | Remarks                                                                              |
| ----------------------------------------------- | ---------------------------------- | ------------------------------------------------------------------------------------ |
| Cosmos DB or MongoDB Atlas or MongoDB Community | 4vCPU, 8 GB memory, 100GB SSD disk | Required for storing semi-structured and unstructured data generated by the platform |

&#x20;

4.3 Network Connectivity Requirements&#x20;

| Source                 | Destination                          | Protocol : Port | Direction      | Description                                    |
| ---------------------- | ------------------------------------ | --------------- | -------------- | ---------------------------------------------- |
| LockThreat product pod | LockThreat product pod               | TCP: 443        | Bidirectional  | Pod-to-pod connectivity                        |
| LockThreat product     | LockThreat database                  | TCP: 27017      | Bidirectional  | Application-to-database connectivity           |
| LockThreat product     | Customer GenAI application (via API) | TCP: 443        | Unidirectional | Application connectivity via LockThreat API    |
| Registry tool          | LockThreat cluster                   | TCP: 443        | Unidirectional | Platform deployment via the LockThreat cluster |

Note: Jump server / bastion host access is required for platform deployment (temporary internet access).&#x20;

4.4 API / Endpoint Mapping&#x20;

| Source / Endpoint                                    | IP Address                     | Description                                       |
| ---------------------------------------------------- | ------------------------------ | ------------------------------------------------- |
| Console endpoint (e.g., console. \[customer-domain]) | <p>console.abc.ai </p><p> </p> | To be updated once the pod service receives an IP |
| Backend endpoint                                     | <p>bkcd.abc.ai </p><p> </p>    | To be updated once the pod service receives an IP |
| Model endpoint                                       | <p>model.abc.ai </p><p> </p>   | To be updated once the pod service receives an IP |
| Agent endpoint                                       | <p>agent.abc.ai </p><p> </p>   | To be updated once the pod service receives an IP |
| Chat endpoint                                        | <p>chat.abc.ai </p><p> </p>    | To be updated once the pod service receives an IP |

&#x20;

&#x20;


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://doc.threatreaper.ai/getting-started/pre-requisites.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.