Hyground vs Traversal (2026)

Read only adapters reach Kubernetes, AWS, Azure and Google Cloud, Argo CD and Flux, Loki, OpenSearch, Elasticsearch, Graylog and Splunk logs, Prometheus, InfluxDB and Nagios metrics, Jaeger traces, PostgreSQL, MySQL, Oracle, MongoDB, Redis and ClickHouse, RabbitMQ and Kafka, and documentation in Confluence, Git and Artifactory, plus the customer's own HTTP APIs and in cluster MCP servers.

Scoped writes reach Jira, ServiceNow, PagerDuty, ilert, GitHub, GitLab, Slack, Teams and email, so findings come back as tickets, comments, pull requests and answered threads. Adapters run in the customer's cluster and refuse to start if their principal can write.

Sourcehyground.ai/product/integrations and hyground.ai/product/architectureread 2026-10-25

Traversal connects to about 30 observability tools (Datadog including RUM and Flex Logs, Dynatrace, Splunk, Grafana, Prometheus, CloudWatch, AppDynamics, Sentry) plus AWS, Azure Resource Manager and Monitor, Azure DevOps, Kubernetes through scoped read only kubectl, GitHub, GitLab, Confluence, Notion, Jira, Linear, ServiceNow, PagerDuty, incident.io, FireHydrant, Slack, Teams and external MCP servers, which it queries with scoped read access.

SourceTraversal docs llms.txt index and changelog; docs.traversal.com/changelogread 2026-10-22

A multi agent system plans each investigation, sends specialised agents to work logs, metrics and knowledge in parallel, and aggregates what they find into one answer, with a card per sub agent in the Tools panel. Investigations fan out across every cluster or cluster group the customer runs. Teams turn procedures into skills that run the same steps every time, on demand, from a schedule or loaded by the agent when a skill's When to use line matches, and the customer defines those steps.

Sourcehyground.ai/product/architecture and docs.hyground.ai/user-guide/glossary and run-a-skillread 2026-10-25

The Causal Search Engine walks the Production World Model across many hops, and Workers take plain language instructions and schedules per channel. There is no multi step builder, branching or coordination between agents, and the investigation flow is Traversal's own.

Sourcedocs.traversal.com/using-traversal/workersread 2026-10-22

Herald, Hyground's notification gateway, takes any JSON posted to one endpoint, from Alertmanager, Grafana, Datadog, PagerDuty, GitHub, Jira, ServiceNow, cron or curl, checks it for prompt injection and opens an Auto RCA when it describes an incident. People also start sessions from Slack, Microsoft Teams or email, schedules run saved tasks from every five minutes to monthly, and a watch repeats a check inside one session at an interval for up to 24 hours.

Sourcehyground.ai/product/triggers, docs.hyground.ai/user-guide/sessions-hyground-starts and schedule-a-sessionread 2026-10-25

Workers act without being asked. Incident Workers activate when high severity incidents are declared, Alert Workers monitor alert channels continuously, and Custom Workers run on plain language missions and schedules, in Slack and Microsoft Teams. Auto deploy rules start Workers in new channels, and in Teams a Worker can join meetings whose names match a rule.

Sourcedocs.traversal.com/using-traversal/workersread 2026-10-22

A knowledge base holds the customer's runbooks, documentation and past investigations, embedded for retrieval inside the customer's cluster. Administrators import what goes in, wiki pages, documentation files from Git repositories, files from Artifactory and uploaded documents, and the content is as current as the last import. The agent searches it on its own while it writes a reply, alongside live cluster state, and each search shows in the Tools panel with the words searched and the matching passages, each naming the document it came from.

Sourcehyground.ai/product/architecture and docs.hyground.ai/user-guide/how-the-agent-uses-knowledgeread 2026-10-25

The Production World Model is a continuously updated, AI readable, causal representation of the production system, exposed as a Wiki regenerated as the environment changes with history kept, beside searchable uploaded docs and runbooks in the Knowledge Bank. Uploaded PDFs are read including their diagrams, and a Skill can be attached to any investigation.

Sourcedocs.traversal.com/using-traversal/knowledge-bankread 2026-10-22

Inside a session the agent works from its full history, condensed into a summary when a session runs long. Across sessions, recall brings content from the user's own past sessions and every shared session into a new one when the user points the agent at earlier work, and never reads another user's private session. The knowledge base also holds past investigations embedded for retrieval, and the agent's writes include its own knowledge base. No memory the agent keeps for itself with a stated lifetime and a place to review or edit it is described.

Sourcedocs.hyground.ai/user-guide/what-the-agent-remembers, hyground.ai/product/architecture and hyground.ai/use-cases/nis2-doraread 2026-10-25

Memories are learnings the agent drafts mid investigation when corrected or told to remember, and they are kept only after a person approves, in an organization wide Knowledge Bank where knowledge persists indefinitely. Traversal does not say how a memory is deleted.

Sourcedocs.traversal.com/using-traversal/knowledge-bankread 2026-10-22

The agent is read only by default, and adapters enforce that below the model. Administrators allow selected write actions and decide which need confirmation; for those the agent shows an Action Confirmation Required card with the operation and the full command, which only the session owner can approve or deny, and the offer expires after 15 minutes by default. A mail or chat message is shown before it goes out unless the user asked for the send outright. Sessions from schedules and Auto RCAs have no owner, so no one can approve a write in them. Hyground does not claim remediation today.

Sourcedocs.hyground.ai/user-guide/whose-access-the-agent-uses and hyground.ai/use-cases/nis2-doraread 2026-10-25

Traversal cannot change a customer's systems or data unless the customer grants it write access, and integrations are read only by default. Self healing is an option a customer turns on, after which Traversal drafts a fix as a pull request for review and checks it against production. Workers never modify alerting, paging or routing, and memory proposals are kept only when a person approves.

Sourcedocs.traversal.com/responsible-use/securityread 2026-10-22

Hyground is ISO/IEC 27001:2022 certified and publishes a CycloneDX software bill of materials with every release. Sessions, queries and actions tie to a named user through OIDC single sign on (Entra ID, Zitadel or any OIDC provider), automation runs under scoped technical users with the same audit trail, and administrators assign roles that decide which connected systems and features each user may use. Tool responses pass a secret filter before the model sees them, and images are Chainguard distroless, non root and read only.

Sourcehyground.ai/product/security, hyground.ai/use-cases/nis2-dora and docs.hyground.ai/user-guide/personalize-hygroundread 2026-10-25

Customers sign in with SSO over OIDC or SAML 2.0, with Member and Admin roles and invite only or domain based access. Service accounts give scripts and MCP clients an organization owned identity with a role and rotating keys. SCIM is not supported, and Traversal publishes no audit log. SOC 2 Type II sits alongside GDPR and HIPAA alignment, third party penetration testing and a trust center.

Sourcedocs.traversal.com/get-started/authenticationread 2026-10-22

A Tools panel on each reply lists every tool call and knowledge search, Show command reveals exactly what the agent ran and Show response what each system returned, and the reasoning view shows the agent's thinking as it works. Every investigation, query and finding produces a structured, exportable record that compliance teams can audit, every step is recorded and replayable, sessions export with their files, and a post mortem draft is written from the investigation.

Sourcedocs.hyground.ai/user-guide/how-the-agent-answers, hyground.ai/product/security and hyground.ai/product/architectureread 2026-10-25

A result shows the root cause with confidence, evidence citations linking to source tools, anomalies and an incident timeline. Each Worker keeps an activity feed of its channel's messages and the tool calls it makes, and admins can review service account sessions from the last seven days. Traversal publishes no audit log of actions and no retention period for these records.

Sourcedocs.traversal.com/using-traversal/worker-featuresread 2026-10-22

Hyground installs from one Helm chart into the customer's own Kubernetes cluster (AKS, EKS, GKE, OpenShift, K3s or on premises) and stays there, the agents, knowledge base, audit trail and model connection included, with everything stored in the customer's own PostgreSQL. There is no SaaS control plane, phone home or vendor access path, the license validates offline, images mirror into air gapped registries, and each connected environment runs a small outpost gateway. The only outbound traffic is the prompt to the model the customer chose, and with a self hosted model nothing leaves.

Sourcehyground.ai/product/security, hyground.ai/product/architecture and hyground.ai/use-cases/nis2-doraread 2026-10-25

Deployment options are private on premises, Bring Your Own Cloud with data residency in the customer's cloud account, single tenant SaaS and PrivateLink.

SourceTraversal security page and docs llms.txt index (deployment options); traversal.com/securityread 2026-10-22

System skills ship with Hyground, always active and read only, and a Skill blueprints page offers ready made use cases, filtered by tags and marked when the skill needs write access. Choosing one has the agent explore the environment, check the blueprint's assumptions against it, gather the setup details it needs from the user, write the skill with them and offer a test run. Named jobs include incident investigation, cost analysis, CVE blast radius, RBAC drift, cluster right sizing and NIS2 and DORA reporting. Teams also write and share their own skills, versioned and grouped by category.

Sourcedocs.hyground.ai/user-guide/create-a-skill, run-a-skill and hyground.airead 2026-10-25

Incident, Alert and Custom Workers are variants of one worker product deployed to different channels, and Skills are procedures the customer's team writes. Traversal offers a prompt library but no agent or template catalog.

Sourcedocs.traversal.com/using-traversal/workersread 2026-10-22

Agents reach their model through LiteLLM, with a primary and a fallback, so the customer picks Azure OpenAI, OpenAI, Anthropic, Google Gemini on Vertex AI or AI Studio, AWS Bedrock, Azure AI Foundry, OpenAI compatible endpoints such as vLLM, Scaleway, Together or Fireworks, or a self hosted model through Ollama, and swaps providers without touching the rest of the system. Model costs are paid to the provider under the customer's own contract.

Sourcehyground.ai/product/architecture, hyground.ai/product/integrations and hyground.ai/use-cases/nis2-doraread 2026-10-25

With Bring Your Own Model, customers run Traversal with their preferred LLMs, including self hosted or customer managed models.

Sourcetraversal.com/securityread 2026-10-22

Herald's single webhook endpoint (/api/herald/webhook) lets any outside system that can POST JSON start an investigation, and the architecture page lists Claude Code, Cursor and any MCP client among the signals that reach Hyground. There is no API reference, SDK or Hyground MCP server documented with an endpoint and authentication, and the customer MCP servers and HTTP APIs it connects to are integrations the agent calls.

Sourcehyground.ai/product/triggers and hyground.ai/product/architectureread 2026-10-25

An API at api.traversal.com uses API key authentication and covers anything a member can do in the web app, including a Sessions API (create, list, get, stream, follow up) and a Knowledge Files API (create, replace, delete), plus MCP access that lets coding agents check a change against production. Service accounts hold keys for scripts and pipelines.

Sourcedocs.traversal.com/api/overviewread 2026-10-22

Users rate replies up or down, with reasons such as inaccurate, missing context or made up, and guidance shows how to check each claim against a tool result. A skill written from a blueprint comes with an offered test run, and teams can schedule a skill that checks the agent's own tools on a cadence. There is no evaluation harness that scores agent runs against tests, and the sandbox is for trying the product.

Sourcedocs.hyground.ai/user-guide/get-help, check-the-agents-work, create-a-skill and hyground.ai/blog/ai-sre-agent-beyond-incidents-regression-test; docs.hyground.ai/user-guide/check-the-agents-workread 2026-10-25

Traversal publishes its own benchmarks on high severity production incidents as marketing. Customers get no evaluation harness, scored test or rerun comparison.

Sourcedocs.traversal.com/using-traversal/understanding-resultsread 2026-10-22

A WebFetch tool fetches allowlisted URLs at run time and converts HTML to Markdown. That is a headless fetch, and the agent never sees a browser, a desktop or the user's screen.

Sourcehyground.ai/product/integrations and docs.hyground.ai/user-guide/what-the-agent-can-seeread 2026-10-25

Traversal works through observability and code integrations, Slack, Teams, an API and MCP, with no browser, desktop or computer control.

Sourcedocs.traversal.com/using-traversal/workersread 2026-10-22