Watch the model foresee the breach.
01
Ingest
02
Roll out
03
Rank
04
Counterfactual
Futures explored
0rollouts
crown risk DC01 · domain controller
0.000
How often the attacker reaches DC01 unseen, on its single worst path. 0 = safe · 1 = certain breach.
ranked futures top kill chains
posture drop in crown risk →
01 / ingest
A network as a model
A real AD graph — hosts, accounts, admin tiers, the crown DC — as nodes and edges.
02 / roll out
Every possible future
Thousands of intrusions walk the graph from the foothold. The brightest threads are where the attack goes.
03 / rank
Collapse to a ranking
The futures resolve into a few kill chains, each scored, bounded, and marked blind or seen.
04 / commit
One headline number
Crown risk = reachable and undetected. It climbs as the model commits to the top future.
05 / counterfactual
Deploy this one first
Switch on detection. The chain turns green — seen, no longer undetected — and risk drops to zero.
You just saw a fix collapse a breach
before it had a chance to move.