Secure
Probing/Recon
Compromised
Isolated
Node Info
Secure
Details...
Vulnerability: -
Agent Action: -
Containment Status: -
Investigate machine-speed multi-agent cyber swarms breaching enterprise infrastructure in <10 hours.
Details...
How does the simulator evaluate lateral movement and defensive mitigations across an enterprise topology?
This interactive model demonstrates how defensive controls alter attack progression across an eight-node network graph over a 10-hour timeline. When time advances, each host transitions between secure, probing, compromised, and isolated states according to programmed rule thresholds. Applying defensive controls such as Zero-Trust microsegmentation, honeypots, hardware MFA, and automated quarantining delays or caps access hurdles, preventing the adversary pathway from reaching sensitive internal targets like the Active Directory domain controller and customer data vault.
The simulation uses deterministic, heuristic time thresholds (such as 1.8 hours for initial edge compromise and 8.9 hours for vault exfiltration) rather than empirical telemetry or stochastic vulnerability modeling. Similarly, the 128.0-hour human red team benchmark and additive mitigation percentages (45% for zero trust, 25% for MFA, 15% each for honeypots and automated isolation) serve as didactic abstractions rather than measured operational risk reductions.
Clicking the 'Zero-Trust Hardened' preset activates Zero-Trust microsegmentation, Phishing-Resistant FIDO2/MFA, and Automated Quarantining, while positioning the timeline scrubber at 10.0 hrs. In this state, the Mitigation Factor rises from 0% to 85%, AI Time-to-Exfiltrate reads 'BLOCKED', and compromised assets are held to 2 out of 7 internal targets (Edge API Gateway and DMZ Web Cluster), because lateral trust links to internal workstations and identity stores remain severed.
Traditional perimeter defenses assume internal network zones carry implicit trust. In contrast, Zero Trust Architecture (ZTA) treats all communication pathways as untrusted, requiring discrete authentication and authorization before establishing any resource session. NIST SP 800-207: Zero Trust Architecture
In the simulator, toggling Zero-Trust microsegmentation sets internal lateral pivot thresholds to infinity, visually displaying broken trust lines toward Active Directory and the database repository.
Decoy honeypots divert autonomous reconnaissance swarms into simulated vulnerabilities, delaying exfiltration timelines, while automated quarantining severs network ingress once anomalous traffic is flagged.
NIST SP 800-207 emphasizes protecting individual enterprise assets and data flows continuously rather than relying on static network segments. NIST SP 800-207: Zero Trust Architecture
Defines Zero Trust Architecture principles, emphasizing that no implicit trust is granted based on network location and that access decisions require discrete authorization.
The fixture contains eight named nodes including the attacking internet source, leaving seven evaluated local nodes. The source is excluded from the compromised counter, and an inactive honeypot still remains in its seven node denominator. At forty pixels per count all, evaluated and source measure three hundred twenty, two hundred eighty and forty. Each node receives fixed probe and compromise times. There is no real network scan, credential use, exploit or data exfiltration. The graph is a teaching scenario with predefined labels and state branches, not a measurement of autonomous attack capability. With defenses disabled the assigned gateway compromise time is one point eight hours, directory six point eight and vault eight point nine. At thirty pixels per hour their bars measure fifty four, two hundred four and two hundred sixty seven. The human baseline is a chosen one hundred twenty eight hours, so dividing it by eight point nine gives about fourteen point four, matching the exported velocity label. This does not compare measured teams. Zero trust or MFA assigns the vault threshold nine hundred ninety nine hours, outside the displayed simulation horizon, rather than proving an actual attack was stopped. Other node states change independently by the same branch rules. The mitigation label simply adds forty five points for zero trust, twenty five for MFA, fifteen for honeypots and fifteen for automated isolation. At three pixels per point zero trust, MFA and the final pair measure one hundred thirty five, seventy five and ninety. All four total one hundred; zero trust with honeypot and isolation totals seventy five rather than a measured effectiveness rate. Compromised nodes become isolated at assigned times and then leave the compromised counter, which is current status rather than cumulative breach count. The saved offline graph library is absent before listeners bind, so controls and export remain inert. Original dimensions and state are preserved without claiming healthy graph execution or real containment.