Threat state — live estate measurement

measuring…

Owned principals reaching a crown jewel

–

–nodes

–edges

–crown jewels

–owned

—

The 90-second arc collateral-ranked cut plans → human gate → re-query → receipts — no README needed

Simulate the breach Mark an identity compromised — every attack path in the estate re-scores live. waiting for a breach
Read the exposure The canonical shortest path each owned principal can walk to a crown jewel. waiting for a breach
Approve → confirm the cut The two-step human gate over the ranked proposal — nothing is severed without the second press. waiting for a breach
Read the receipt The engine is re-queried; reachability is re-measured before vs after. waiting for the first cut

BloodHound shows you these paths; SEVER removes the edge and proves the collapse with a measured receipt. Everything runs on the public BloodHound CE sample estate as a labeled simulated replay — no real organization.

Simulate the breach

Start the replay: mark an identity compromised, or grant a new ACE — the estate re-scores every attack path live. Results land in the threat-state banner above.

Attack paths

What the breach exposes — the canonical shortest path per crown jewel, hop chains from the owned principal.

No owned principals — simulate a breach to begin.

Interdiction — the human gate

Edges ranked by the attack paths their removal kills; benign usage breaks ties. Approve, then confirm — nothing is ever severed without the second press. Or plan a k-cut sequence instead of one edge.

Nothing to propose.

Receipts

The proof — append-only case ledger, newest first: every action re-measured live, before vs after, attributed to its operator.

—