Watch the model foresee the breach.

A BloodHound export becomes the world: workstations, service accounts, servers, admin tiers, and the crown, dc01. Every permission is an edge the attacker could walk.

Thousands of intrusions walk the graph from the foothold at ws01. The brightest threads are where the attack keeps going.

The futures resolve into five kill chains, each scored by how likely it is to work and to go unseen. The top one becomes the crown risk.

Scry applies the single change that removes the most risk. Try the others. Each one re-routes the attacker somewhere different, and the number tells you how much it bought.