Attack chains & adversarial validation

Joins findings from different families into exploitable chains and walks the ones it can prove against an authorized isolated replica.

Family facts

Code: OVL-ATTACK-CHAIN
Status: partial — code maturity
Availability: partial — whether it is offerable
Ingest: overlay — how a target enters
Rules of Engagement: Not required
Kind: Overlay (a lens over a family)

What it decides

Whether separate findings actually compose into an exploitable chain — proven by walking it against an isolated replica, not inferred.

How it works

It joins findings across families into candidate chains (IAM escalation, cluster compromise, pivoting) and walks the ones it can prove against an authorized isolated replica, with a Tribunal verdict.

A statically derived chain is an indication, not a fact; a hop resting only on co-location is a lead and the verifier answers UNKNOWN until the chain is walked and verified.

Declared limits

Partial

The full cross-family join is not integrated; any measured validation rate describes the machine on its own corpus, not a promise about any real target.

References

[1]MITRE ATT&CK — attack chains

References point to public, well-known technical sources for further study.

Assurance / containment

ready · available

Cryptographic seal

ready · available

GDPR / EU AI Act

ready · available

LGPD (Latam)

partial · partial

How the catalog works

Families, states and the honesty guard.