Macro Risk Score
72/100
Elevated because infrastructure mentions, CVE pressure, and supplier concentration moved together.
External Exposure
19
Publicly observable assets requiring owner validation, TLS review, or inventory reconciliation.
Identity Signals
6
Credential exposure indicators mapped to defensive reset, MFA, and conditional access workflow.
Control Coverage
83%
ATT&CK detection coverage across endpoint, identity, cloud, email, DNS, and network telemetry.
Global Risk Map · Public-Source Geopolitical Context
LAWFUL PUBLIC-SOURCE AGGREGATION · NO PRIVATE COLLECTION · AUDITABLE PROVENANCE
Threat Intel Split View
APT29 infrastructure overlapHigh
Public DNS and certificate transparency signals overlap with known infrastructure naming patterns. Defensive validation recommended.
FIN7 phishing kit reuseCritical
Clear-web reporting and OSINT enrichment suggest reuse of infrastructure tied to financial-sector targeting.
Supplier attack-surface driftMedium
Third-party cloud endpoint changed posture outside approved baseline. Route to vendor-risk owner.
Detection Engineering
- Sigma, KQL, SPL, and YARA-L rule lifecycle.
- Coverage mapped to ATT&CK tactics and control owners.
- False-positive budget and rule confidence scoring.
SOAR Readiness
- Playbook status: isolate host, reset identity, block domain.
- Human approval gate for high-impact actions.
- Audit-ready action chain with rollback notes.
Exposure-to-Control Graph
- Asset → owner → vulnerability → detection → runbook path.
- EPSS/CVSS prioritization with business criticality.
- Control gaps surfaced before exploitation pressure rises.
Deception Defense
- Honeytoken and canary tripwire inventory.
- Low-noise alerts routed to identity and cloud owners.
- Legal and privacy banner for compliant deployment.
Telemetry Health
- EDR, DNS, email, identity, cloud, and firewall feed status.
- Parser drift, ingestion delay, and schema-change detection.
- Analyst trust score per source feed.
ATT&CK Coverage Matrix
Visual heatmap of detection coverage by tactic.
30-DAY CAMPAIGN TIMELINEDay 22 · infrastructure pivot
InformationalElevatedCriticalValidated control