Engagement 11
“Would This Have Stopped It?”
Walk the real kill chain of a public incident against the controls you actually run.
The situation
Every board asks the same question once a breach is in the news, and most security teams answer it from the vendor briefing rather than from their own controls. The answer is reassuring, and nobody in the room believes it — including the person giving it.
This is the opposite. One real incident, walked step by step against the estate you actually run, with the steps where you would not have been caught said out loud.
This is you if
- Your board asked about a breach in the news and the answer was reassuring rather than evidenced.
- You want to know where you would have been caught, not where a vendor says you would.
- You need a security conversation that engineers will attend voluntarily.
How it runs
- Before
Pick the incident that fits you
Chosen from the incidents we model to match your stack and your delivery shape, so the kill chain is one your engineers recognize rather than one from somebody else's industry.
- The session
Walk it against your controls
Half a day, step by step. At each step: would this have been seen, would it have been stopped, and by what. Engineers attend these voluntarily, which is most of why they work.
- After
The honest gap list
A short written list of the steps where the chain would have continued, ordered by what it would take to close each one.
What you are left holding
- One real incident, step by step, mapped against your estate
- The points at which your current controls would and would not have intervened
- A short honest gap list, ordered by what it would take to close
- No product recommendation unless one is genuinely the answer
What we need from you
- Two hours of preparation access to your pipeline configuration, so the walk runs against your controls and not a generic estate.
- The engineers who run the pipeline in the room, not only the security team.
- Permission to be wrong in public, since the value is in the steps where the answer is that it would not have.
A fixed fee that assumes nothing about access is a guess. This is the list that keeps the price the price.
What this is not
- Not a tabletop exercise. Nobody roleplays; we walk a real published kill chain against real configuration.
- Not a sales meeting. No product is recommended unless one is genuinely the answer, and the gap list is yours either way.
What we can already show
44 incidents are modeled technique by technique, each with the capabilities that counter it.
Why people call about this one
The worst cases had no CVE
Compromised maintainer accounts, OAuth applications, reseller channels and retagged actions produce nothing for a scanner to match. Companies that only scan are discovering what that leaves uncovered.
33 of the 44 supply chain incidents we model had no CVE ever assigned
The shape of it
- Shape
- Half a day, on site or remote
- Usually funded by
- CISO · Engineering
- Often leads to
- Nothing. This one stands alone.