The graph
A graph of techniques, built from work that actually happened
Most tools that claim breadth generate it from a vulnerability feed. Ours came from engagements, bug bounty programmes and problems somebody sat down and solved — and because every node is a technique rather than a target, the same library reaches an AWS account, a Kubernetes cluster and a Windows domain.
Where the techniques come from
Every node was written from something real: a bug bounty finding, a penetration test, a published writeup, or a capture-the-flag problem solved end to end. None of it is generated from a CVE feed, and that is the difference you feel on the second engagement rather than the first.
A vulnerability feed tells you what is broken. It does not tell you what an attacker does next, which is the question an assessment has to answer. Our nodes encode the move — read the metadata service, reuse the credential you just found, pivot on the trust you just proved — because they were written by people doing exactly that and recording what worked.
We do not publish the size of the library. A count of what it holds is an inventory of what there is to enumerate, and the same rule keeps technique identifiers out of the API. What we will show you is the walk your own engagement produced, with every command it ran.
Techniques, not targets
A node says list a storage bucket anonymously, or extract strings from an artifact, or reuse this credential against that service. It does not name a particular vulnerability on a particular host.
Why that matters commercially
One library serves every assessment we sell — cloud accounts, Kubernetes clusters, identity tenants, internal networks, external surface, software supply chain. Adding an assessment type is a matter of composing techniques that already exist and proving the ones that do not, rather than starting a new product.
Why it matters technically
A technique proven in one engagement composes into the next. The node that reads an instance metadata service does not care which customer it is pointed at, so evidence about whether it works is evidence you inherit rather than evidence we re-gather.
The walk is the product, not a diagram of it
The walker moves through technique nodes depth-first. When a node fails its condition it does not stop — it retreats to the last node that worked and tries another branch, and the branch it abandoned stays on the record.
That last part is the one worth dwelling on. A walk that records what it tried and refused is a walk you can audit: the report carries the route that reached a finding and the routes that did not, so an absence of findings is a statement about your estate rather than a statement about how hard we looked.
The library learns from its own runs
Every walk records which technique produced a result against which kind of target. That evidence changes what the next walk tries first.
-
A run banks what worked
Each technique that fires is recorded against the kind of artifact or service it fired on, along with whether it produced anything.
-
The order changes
The next walk consults that record and tries the techniques with a track record on the target in hand before the ones without. A success promotes on a single observation; a failure needs several, because one failure proves very little and acting on it would teach the walker to skip a technique that works.
-
A dead end becomes a technique
When a walk exhausts its options it does not report a dead end and discard the context — it writes up what the goal was, what it proved, every command it ran and what is sitting on disk. That dossier is what a human or a language model needs to say what to try next, and the answer comes back into the walk through the same seeding mechanism the walker already uses.
-
And everyone inherits it
When an answer turns out to be reusable, one of our engineers writes it as a new technique node. From then on it is part of the library, and every later engagement gets it. The judgement stays human at both ends — we do not let a model write attack techniques into the graph unreviewed — but the loop means the library gets better at the work by doing the work.
See what it finds in your estate
An engagement begins with a scope you define and a manifest you approve, and the first thing it produces is your detection gap — what your monitoring should have seen for every technique we ran.