The TENSOR Framework
TENSOR (Threat Evaluation & Neutralization through Structured Organizational Resilience) is an open, graph-native standard for security investigations.
It is not a standalone product. It is a shared model that security teams, internal platforms, and vendors can use to represent investigation logic as reusable questions and decision paths.
Design Principles
The framework is intentionally opinionated around repeatability and interoperability:
- Graph-first: investigations are modeled as connected decisions, not isolated steps.
- Deterministic structure: IDs, edge semantics, and schema constraints are stable.
- Composable extension: teams can add local metadata without forking core semantics.
- Audit readiness: every branch and conclusion can be traced to explicit graph logic.
Tensor Standards Consortium
The Tensor Standards Consortium governs the framework as a vendor-neutral standards body. Its purpose is to maintain a stable core while enabling broad implementation across products and in-house SOC stacks.
The consortium is structured around practical outputs:
- Core spec stewardship: schema, graph semantics, and compatibility guarantees.
- Release governance: versioning policy, deprecation windows, and migration guidance.
- Working groups: domain-focused groups for new node sets and extension patterns.
- Conformance tracks: shared tests and examples to reduce implementation drift.
Why Enterprises Adopt It
Most enterprises already have a mix of SIEM, EDR, SOAR, and AI-assisted workflows. TENSOR provides a single investigation contract above those tools, so teams can keep execution technology flexible while keeping investigative intent consistent.
In practice, many existing workflows are linear with occasional decision and loop steps. TENSOR keeps those familiar patterns but prevents logic duplication by representing shared questions once and reusing them across paths.
That separation is important: toolchains evolve quickly, but institutional investigation logic should remain stable, reviewable, and portable.