Optimization
Measured Improvement, Not Asserted Improvement
Every claim on this page is a measurement plan. Improvement is demonstrated by replaying your own history and running the decision layer in shadow beside your existing stack.
By technology
What Improves in Each System You Already Own
The overlay does not compete with these products. It improves the determination made on top of what they produce.
| Technology | Role | Specific optimization |
|---|---|---|
| IAM, PAM, ZTNA, CIEM | Access decision enrichment | Converts static role decisions into contextual, continuous, least-privilege decisions; recommends step-up authentication, just-in-time privilege, session restrictions, token revocation, or denial. |
| SIEM | Evidence correlation and incident adjudication | Deduplicates alerts, resolves entities, links related events, scores evidence quality, distinguishes symptoms from root incidents, and prioritizes by business impact rather than alert severity alone. |
| XDR | Cross-domain decision layer | Correlates endpoint, identity, email, network, cloud, and workload detections; challenges single-vendor conclusions; separates corroborating from contradictory signals. |
| SOAR | Governed playbook selection | Selects the appropriate playbook, simulates likely consequences, determines required authority, inserts approvals, constrains automation, and verifies rollback before execution. |
| EDR and NDR | Detection adjudication and coordinated containment | Determines whether endpoint and network anomalies form one attack sequence; recommends coordinated isolation, credential revocation, process termination, or continued monitoring through native APIs. |
| CNAPP, CSPM, CWPP | Cloud attack-path intelligence | Combines misconfiguration, runtime activity, entitlement, vulnerability, reachability, data sensitivity, and workload criticality into a single remediation priority. |
| Vulnerability and exposure management | Contextual prioritization | Replaces severity-only ranking with exploitability, reachability, active threat evidence, asset importance, identity paths, compensating controls, blast radius, and remediation disruption. |
| Threat-intelligence platform | Intelligence validation | Scores source reliability, freshness, independence, relevance, corroboration, and contradiction; maps intelligence to local assets and emits normalized STIX objects. |
| DLP and DSPM | Intent and context adjudication | Distinguishes legitimate business movement from anomalous exfiltration using identity, classification, destination, application, volume, history, and business process context. |
| BAS and purple team | Test selection and control learning | Prioritizes simulations around actual exposure and control gaps, maps results to ATT&CK techniques and D3FEND countermeasures, and feeds measured efficacy back into response decisions. |
| OT and ICS security | Passive analysis and safety-governed simulation | Operates read-only by default, models operational and safety consequences, and requires human approval for any action capable of affecting a physical process. |
| GRC and compliance tooling | Continuous evidence and governance | Links control claims to operating evidence, detects policy drift, manages exceptions, records authority and risk acceptance, and maintains audit-ready lineage without claiming automatic compliance. |
Reasoning dimensions
Ten Interacting Axes
Conventional tools analyze one or two projections of a security situation. The value comes from the interactions among them.
I
Identity state
Assurance, entitlement, behavior, and history for human and machine identities.
D
Device state
Management, posture, patch level, and compromise indicators.
N
Network state
Zone, path, geography, and observed communication behavior.
W
Workload state
Application and workload configuration, runtime behavior, and reachability.
A
Asset and data criticality
Business importance, classification, and regulatory exposure.
T
Threat state
Active campaigns, techniques, and intelligence relevant to this environment.
V
Vulnerability and exposure
Exploitability, reachability, and attack-path contribution.
B
Business consequence
Process dependency, downtime cost, and grantee organization impact.
C
Control effectiveness
Whether the compensating controls actually work in this context.
U
Uncertainty
What is unknown, stale, contested, or unsupported by evidence.
Decision logic
Incident Risk and Response Utility Are Separate Calculations
A high risk score is not an instruction to take the most aggressive action available. Risk describes the situation. Utility describes whether a given response is worth its cost.
Incident risk
R_i = P(compromise | E) x I_b x B_r x P_s
- E
- Validated evidence
- I_b
- Business impact
- B_r
- Potential blast radius
- P_s
- Persistence or systemic propagation factor
Evidence-adjusted confidence
C_d = (E_i x C_c x S_a x F_r) / (1 + K_c + D_s + U_m)
- E_i
- Evidence integrity
- C_c
- Context completeness
- S_a
- Independent source agreement
- F_r
- Evidence freshness
- K_c
- Material contradictions
- D_s
- Data staleness
- U_m
- Model uncertainty
Response-action utility
U(a) = E[dR_i | a] - L1 x O_d - L2 x A_r - L3 x U_a - L4 x R_b
- dR_i
- Expected reduction in incident risk
- O_d
- Operational disruption
- A_r
- Action-induced risk
- U_a
- Uncertainty about the action effect
- R_b
- Rollback or recovery burden
An action is eligible for automatic execution only when every condition holds
- Confidence at or above the configured minimum
- Model uncertainty at or below the configured maximum
- Blast radius within the configured limit
- The action is reversible
- Policy permits the action in this workflow
- The requesting authority is sufficient for the action
Published formulas describe the shape of the calculation. Coefficients, thresholds, and model configuration are set per deployment and are not published.
Scorecard
What Gets Measured
Eight domains, measured before and after, on your incidents rather than on a reference dataset.
Detection
- Alert precision
- Incident correlation accuracy
- Duplicate-alert reduction
- Missed-technique rate
- ATT&CK coverage
Triage
- Mean time to triage
- Analyst touches per incident
- Escalation accuracy
- Evidence completeness
Response
- Mean time to contain
- Containment success
- Rollback frequency
- Unnecessary disruption
- Recurrence
Identity
- Risky access prevented
- Privilege duration
- Dormant privilege reduction
- Step-up success
- Unauthorized escalation
Cloud exposure
- Reachable critical findings
- Attack-path closure
- Remediation effectiveness
- Exposure burn-down
Decision quality
- Brier score
- Calibration error
- Contradiction rate
- Analyst override rate
- Unsupported conclusion rate
Governance
- Approval compliance
- Policy exception age
- Audit completeness
- Provenance coverage
- Stale-policy detection
Business impact
- Avoided downtime
- False-containment cost
- Recovery time
- Critical-process interruption
Validation is a replay and shadow comparison: the native security stack measured against the native stack plus ArtOfTheHack, using historical incidents, live shadow decisions, controlled simulations, and purple-team exercises. Improvement is measured, not asserted as a percentage before deployment.