Watch the attack. Read the catch. Pick your industry.
Choose a sector and watch a real attacker pick a route to your crown jewels, then read the purple-team analysis underneath: every stage flagged to MITRE ATT&CK, and the MITRE D3FEND countermeasure, and the control, that should catch it.
Payments, trading systems, customer accounts, and the deal book.
Every sector has a prize an attacker is after: its crown jewels, named above. Pick your sector below, then click an entry point in the graph and trace a path toward it. Each step you take is flagged to MITRE ATT&CK, and matched to the MITRE D3FEND countermeasure (and the control) that catches it.
Phishing, stolen credentials, a trusted third party, an exposed app.
MFA and conditional access, email security, and tightly scoped third-party access.
Code runs on the first host, and the attacker digs in.
EDR on every endpoint, alerting on the suspicious process and script behavior the foothold needs.
Host to host, toward where the value actually sits.
Segmentation that stops the hop, with NDR watching east-west traffic for the pivot.
Steal credentials and become an administrator.
Tiered admin and LAPS, with identity analytics flagging the anomalous logon.
Reach payments and trading, or quietly exfiltrate customer data.
Segmentation around the payments core, DLP on egress, and transaction-flow monitoring.
A freelancer’s laptop, a post-house’s shared project, the public streaming app.
MFA on vendor and remote access, email security, and hardened public apps.
Code runs on the first host, and the attacker digs in.
EDR on every endpoint, alerting on the suspicious process and script behavior the foothold needs.
Host to host, toward where the value actually sits.
Segmentation that stops the hop, with NDR watching east-west traffic for the pivot.
Steal credentials and become an administrator.
Tiered admin and LAPS, with identity analytics flagging the anomalous logon.
Reach and exfiltrate unreleased masters, or take broadcast down.
DLP and egress filtering on the asset stores, with isolation around broadcast.
A phished engineer, vendor remote-maintenance, removable media on the OT side.
MFA on remote and vendor access, and removable-media controls at the boundary.
Code runs on the first host, and the attacker digs in.
EDR on every endpoint, alerting on the suspicious process and script behavior the foothold needs.
Host to host, toward where the value actually sits.
Segmentation that stops the hop, with NDR watching east-west traffic for the pivot.
Steal credentials and become an administrator.
Tiered admin and LAPS, with identity analytics flagging the anomalous logon.
Cross IT→OT to manipulate control, or encrypt the historian and stop the line.
Enforced IT/OT segmentation and conduits, with OT-aware monitoring on the boundary.
Phishing, stolen credentials, an exposed VPN, or a trusted contractor.
MFA, a patched perimeter, and hardened contractor and remote access.
Code runs on the first host, and the attacker digs in.
EDR on every endpoint, alerting on the suspicious process and script behavior the foothold needs.
Host to host, toward where the value actually sits.
Segmentation that stops the hop, with NDR watching east-west traffic for the pivot.
Steal credentials and become an administrator.
Tiered admin and LAPS, with identity analytics flagging the anomalous logon.
Exfiltrate classified or CUI data, or settle in for long-dwell espionage.
DLP and egress monitoring, with identity analytics catching the quiet account.
Phishing a clerk, stolen credentials, an exposed VPN or public portal, a shared MSP.
MFA, a patched perimeter, and a WAF in front of public portals.
Code runs on the first host, and the attacker digs in.
EDR on every endpoint, alerting on the suspicious process and script behavior the foothold needs.
Host to host, toward where the value actually sits.
Segmentation that stops the hop, with NDR watching east-west traffic for the pivot.
Steal credentials and become an administrator.
Tiered admin and LAPS, with identity analytics flagging the anomalous logon.
Exfiltrate citizen data, or ransom the services a community depends on.
DLP and egress monitoring, plus tested segmentation and backups for the ransomware play.
A web skimmer, a payment integration, a store network, a phish.
WAF and MFA, plus payment-page integrity monitoring for the skimmer.
Code runs on the first host, and the attacker digs in.
EDR on every endpoint, alerting on the suspicious process and script behavior the foothold needs.
Host to host, toward where the value actually sits.
Segmentation that stops the hop, with NDR watching east-west traffic for the pivot.
Steal credentials and become an administrator.
Tiered admin and LAPS, with identity analytics flagging the anomalous logon.
Skim card data, reach the CDE, or take the storefront down at peak.
CDE segmentation, DLP, and file-integrity monitoring on payment pages.
An ag-tech platform, IoT telemetry, remote access, an exposed service.
MFA, a patched edge, and IoT/OT segmentation off the business network.
Code runs on the first host, and the attacker digs in.
EDR on every endpoint, alerting on the suspicious process and script behavior the foothold needs.
Host to host, toward where the value actually sits.
Segmentation that stops the hop, with NDR watching east-west traffic for the pivot.
Steal credentials and become an administrator.
Tiered admin and LAPS, with identity analytics flagging the anomalous logon.
Disrupt processing and logistics, tamper with automation, or ransom.
OT/IoT segmentation and monitoring, with tested, isolated backups.
Representative paths, not a specific engagement. Your real attack surface, ATT&CK coverage and D3FEND mapping are established live, in the open, on a purple team. Frameworks: MITRE ATT&CK ↗ MITRE D3FEND ↗