Cyber operations
Every security platform that ships offensive tooling has the same problem: the capability is easy and the authority to use it is hard. Running a scan against a production estate, or modelling an attack path through a customer's network, is not a technical decision.
So the honest way to read this area is that the governance is the product. The assessment and analysis capabilities are real and useful, and the part that makes them safe to run at all is the engagement machinery around them.
Active discovery and exploitation are simulation and modelling, not live testing. The platform can model an attack; it does not run a live penetration test. The exploit component is explicitly a simulator.
The rules-of-engagement and cryptographic authorization machinery is the core of this area, and the reason the rest of it can be pointed at a real estate at all.
The engagement core
This is the subsystem that governs everything else, and it is worth reading before the capability list.
| Component | What it does |
|---|---|
| Rules of engagement | The declared boundary of what an engagement may do |
| Authorization workflow | How permission to act is obtained, rather than assumed from a role |
| Approval quorum | N-of-M cryptographic authorization, so a consequential action needs several parties rather than one operator |
| Scope management | What is in bounds, enforced rather than documented |
| Engagement audit | The record of what was authorized and what was done |
| Exploit simulator | Modelling, deliberately not live exploitation |
The quorum is the load-bearing part. An assessment capability behind a single operator's permission is a capability one compromised account turns into an incident. Behind an N-of-M approval bound to an engagement scope with an audit trail, it is something a customer can actually authorize you to run.
The capability subsystems
Ten subsystems, described as capability rather than as a shipping console.
| Subsystem | What it covers |
|---|---|
| Discovery | Passive and active discovery, network topology mapping, DNS mapping, service enumeration, OS fingerprinting, certificate analysis |
| Assessment | Attack surface, configuration assessment, credential testing, vulnerability matching, wireless security, compliance mapping |
| Analysis | An attack-path engine, lateral movement, privilege escalation, blast radius, and critical-asset identification |
| Wireless | Wi-Fi assessment, Bluetooth reconnaissance, IoT wireless scanning, rogue detection, RF network mapping |
| Engagement | The governance core above |
| Coordination | A mission coordinator, finding aggregator, cell health, stealth management and an air-gap bridge |
| Persistence | Deployment management, scan scheduling, covert channels, traffic blending |
| AI operations | Autonomous reconnaissance, adaptive scanning, threat hunting, attack simulation, vulnerability prioritisation, and an assistant |
| Reporting | Evidence management, remediation tracking, trend analysis, report generation |
Blast radius is the one worth pulling out. The question an assessment should answer is not only "what is reachable" but "what does reaching it get you", and modelling that across an attack path is what turns a vulnerability list into a prioritised remediation plan.
Why it lives on this substrate
Running assessment tooling from inside the platform rather than beside it changes three things.
Findings arrive as governed data. An assessment result is a catalog asset with a classification and a lineage record, not a report file, so it inherits the same policy surface as everything else and can be correlated with what the SIEM already holds.
Reach spans the estate. The same assessment runs across air-gapped sites, on-premises infrastructure and multiple clouds simultaneously, because the platform is already in those places. A cloud-bound scanner is not.
Authorization composes with the platform's own gates. An engagement crosses the rules-of-engagement check, the approval quorum, and the decision gate every consequential action crosses, so an autonomous reconnaissance agent is bounded by the same machinery as any other agent.
Counter-threat operations
A separate defense capability tier sits alongside this one, covering counter-botnet work (command-and-control protocol analysis, sinkholing, botnet intelligence, a disruption coordinator) and counter-terror analysis (actor profiling, communication and crypto-flow analysis, propaganda detection).
This tier is activated by cell profile and licence, is not included in commercial deployments, and carries the same simulation ceiling as the rest of this area. It is not a shipping surface, and the authorization machinery above applies to it in full.
Where this sits commercially
Cyber operations is defense capability tier 3, activated independently by cell profile and licence. A defense contractor running enterprise analytics can take advanced threat detection without this tier, and a tactical unit can take communications and battlefield operations without it.
It also underpins the security assessment motion in consulting, where the honest framing is: the platform can deliver a threat, posture and exposure assessment and operate a small-scale SIEM. It can model attacks. It does not run live penetration tests.
Related
- Security operations, the detection side.
- Threat intelligence, the knowledge graph findings enrich.
- Consulting, the assessment motion and its honest capability matrix.
- Battlefield operations, the neighbouring mission tier and its reachable slice.