The shape of the answer
Acme Capital is fictional, and its paths, fix and dollar figures are illustrative. The board, the hop-by-hop layout and the labels are the ones your own uploads get.
Interactive demo · Your config · Analyzed in memory, never stored
Paste your own firewall config. Watch the engine work.
Drop a FortiGate policy block below: the engine extracts the network graph, simulates one attack path, surfaces a single choke-point fix, and headlines an industry-default dollar estimate. Same extractor, same min-cut, same FAIR engine as the product — one input, so network-layer only.
Analyzed in memory · never stored · 32 KiB cap · 8 runs / 5 min / IP
No config handy?
Walk the worked example: Acme Capital.
Acme Capital is a fictional 200-person fintech. The board below is an illustrative sample: its paths, fix and dollar figures are hand-built to show the shape of the answer across 14 vendor families, in the same layout your own uploads get, with every edge carrying its MITRE technique. Expand any path to walk its steps.
Cross-vendor chains: Program
Modeled
$84K–$680K a year
range · MODELED · loss size DECLARED
Phishing victim (CloudOps engineer)Entra group: CloudOps (admin)MDE: Ops Admin laptopsFortiGate zone: vpn-poolFortiGate zone: prod-paymentsAWS IAM user: cloudops-admin◆ Secrets Manager: stripe-live-keys
6 hops to Secrets Manager: stripe-live-keys · ~47m to data
Cheapest cut: CloudOps group excluded from MFA Conditional Access policy
Modeled
$58K–$494K a year
range · MODELED · loss size DECLARED
Phishing victim (Marketing user)Entra group: MarketingMDE: Corp Laptops device groupFortiGate zone: internal-corpFortiGate zone: prod-paymentsAWS IAM role: PowerUserRole (over-provisioned)◆ S3 bucket: acme-customer-pii
6 hops to S3 bucket: acme-customer-pii · ~1h to data
Cheapest cut: MFA not enforced for Marketing group
Modeled
$102K–$846K a year
range · MODELED · loss size DECLARED
Exposed SSL-VPN portal (no MFA)FortiGate zone: internal-corpFortiGate zone: prod-paymentsAWS IAM role: PowerUserRole (over-provisioned)◆ RDS: prod-payments-db
4 hops to RDS: prod-payments-db · ~28m to data
Cheapest cut: SSL-VPN MFA not required
Show 11 more paths
Modeled
$58K–$494K a year
range · MODELED · loss size DECLARED
Legacy auth not blocked (IMAP / POP)Entra group: MarketingMDE: Corp Laptops device groupFortiGate zone: internal-corpFortiGate zone: prod-paymentsAWS IAM role: PowerUserRole (over-provisioned)◆ S3 bucket: acme-customer-pii
6 hops to S3 bucket: acme-customer-pii · ~1h to data
Cheapest cut: Legacy auth not blocked tenant-wide
Modeled
$84K–$680K a year
range · MODELED · loss size DECLARED
Phishing victim (CloudOps engineer)Entra group: CloudOps (admin)MDE: Ops Admin laptopsFortiGate zone: internal-corpFortiGate zone: prod-paymentsAWS IAM user: cloudops-admin◆ Secrets Manager: stripe-live-keys
6 hops to Secrets Manager: stripe-live-keys · ~53m to data
Cheapest cut: CloudOps group excluded from MFA Conditional Access policy
Observed
$248K–$2.1M a year
range · MODELED · illustrative loss size
Internet (Cloudflare-fronted app)Cloudflare WAF for app.acme.io (custom skip rule for legacy partner)◆ Origin: app.acme.io (production payments API)
2 hops to Origin: app.acme.io (production payments API) · ~22m to data
Cheapest cut: Cloudflare custom rule with action=skip on managed ruleset
Observed
$248K–$2.1M a year
range · MODELED · illustrative loss size
Internet (post-drift exposure)◆ S3 bucket: reporting-snapshots (public after config drift)
1 hop to S3 bucket: reporting-snapshots (public after config drift) · ~18m to data
Cheapest cut: S3 bucket reporting-snapshots is publicly readable (bucket policy allows Principal: *)
Modeled
Phishing victim (CloudOps engineer)Entra group: CloudOps (admin)MDE: Ops Admin laptopsCrowdStrike Falcon: Engineering host group (200 hosts)◆ Falcon exclusion: rundll32 / appdata\Local\Temp\* permit
4 hops to Falcon exclusion: rundll32 / appdata\Local\Temp\* permit · ~35m to data
Cheapest cut: CloudOps group excluded from MFA Conditional Access policy
Modeled
$74K–$596K a year
range · MODELED · loss size DECLARED
Branch office Cisco ASA outside interface (sec-level 0)Branch office LAN (sec-level 100)FortiGate zone: internal-corpFortiGate zone: prod-paymentsAWS IAM role: PowerUserRole (over-provisioned)◆ S3 bucket: acme-customer-pii
5 hops to S3 bucket: acme-customer-pii · ~41m to data
Cheapest cut: Cisco ASA shadowed deny rule on branch-outside-in
Modeled
Phishing victim (CloudOps engineer)Entra group: CloudOps (admin)Compromised mailbox (CFO auto-forward to personal)◆ External recipient — exfil destination
3 hops to External recipient — exfil destination · ~24m to data
Cheapest cut: CloudOps group excluded from MFA Conditional Access policy
Modeled
$108K–$890K a year
range · MODELED · loss size DECLARED
Phishing victim (CloudOps engineer)Entra group: CloudOps (admin)MDE: Ops Admin laptopsFortiGate zone: vpn-poolFortiGate zone: prod-paymentsAWS IAM user: cloudops-adminGCP SA: analytics-runner (proj-data)◆ GCP project "proj-prod-payments" admin scope (1 admin SA)
7 hops to GCP project "proj-prod-payments" admin scope (1 admin SA) · ~58m to data
Cheapest cut: CloudOps group excluded from MFA Conditional Access policy
Modeled
$91K–$767K a year
range · MODELED · loss size DECLARED
Phishing victim (CloudOps engineer)Entra group: CloudOps (admin)MDE: Ops Admin laptopsFortiGate zone: vpn-poolFortiGate zone: prod-paymentsAWS IAM user: cloudops-adminAzure SP: deploy-bot◆ Azure subscription m365-ecosystem (Owner inherits to all RGs)
7 hops to Azure subscription m365-ecosystem (Owner inherits to all RGs) · ~56m to data
Cheapest cut: CloudOps group excluded from MFA Conditional Access policy
Modeled
Phishing victim (CloudOps engineer)Entra group: CloudOps (admin)Adversary using stolen valid credentials (Sentinel blind spot)◆ Detection gap: no enabled Sentinel rule for T1078.004 cloud-account sign-ins
3 hops to Detection gap: no enabled Sentinel rule for T1078.004 cloud-account sign-ins · ~31m to data
Cheapest cut: CloudOps group excluded from MFA Conditional Access policy
Modeled
$63K–$522K a year
range · MODELED · loss size DECLARED
Okta sign-in page (from network diagram)Okta user: eng-lead@acme (Super Admin)Okta Super Admin roleEntra group: CloudOps (admin)MDE: Ops Admin laptopsFortiGate zone: internal-corpFortiGate zone: prod-paymentsAWS IAM user: cloudops-admin◆ Secrets Manager: stripe-live-keys
8 hops to Secrets Manager: stripe-live-keys · ~1h to data
Cheapest cut: Standing SUPER_ADMIN assignment without JIT
ModeledThe one change: fix “FortiGate policy 47: any internal-corp → prod-payments allowed (overly broad)”. It would break 6 of the 13 paths in this model.
generated 2026-05-07 · sample fixture · modeled
What you're looking at
A sample board, and what your upload changes.
The Acme board is illustrative. Here is what it shows, and what the engine does when the file is yours.
How edges are named
26 MITRE techniques map to specific edge types, and each path is matched against 11 named threat groups — inferred edges are dashed and explained, never hand-waved.
How the one change is chosen
On your own upload, a search runs from every entry point to every sensitive resource, and the single change that breaks the most paths surfaces first — labeled modeled.
Where it ends
Every run ends in a proof, not a screenshot.
Dashboards ask you to trust the vendor. A CyberTwin run ends in an artifact you can hand an auditor — and they can re-check it without trusting us.
Dated
Every proof carries the date it was recorded, from a real timestamp — a position you can defend later, not a live gauge that resets every time someone looks.
Signed
Entries are Ed25519-signed and chained in an evidence ledger — tamper a single field, including the record's own honesty framing, and the signature breaks.
Re-checkable
A counterparty re-parses the same artifact and re-derives the result themselves. The verifier runs in the browser: offline, no login, nothing uploads.
The sample is a fictional estate with a real signature — tamper with one field, including its own disclaimer, and verification fails.
Run the same analysis for your environment
Your stack. Your attack paths.
Your cheapest fix.
The sandbox and the Acme graph are the demo. The Program tier runs the same analysis against your real environment — re-upload a fresh export any time and the engine re-checks your posture; re-parseable artifacts re-prove it.