IoPE · DETER
Exposure
What exploitable privilege condition already exists?
Defender Intelligence Continuum · v3.3 UPDATED
See privilege risk before it becomes attack consequence.
Defender Intelligence connects known privilege exposure to runtime contact, warning, and defensive response without allowing the application to invent relationships that the data does not declare.
“While ATT&CK focuses on adversary behavior, Defender Intelligence gives defenders actionable intelligence about the durable signals their own environment emits—signals defenders can hunt to identify and disrupt the conditions threat actors rely on to advance their campaigns.”— Kevin E. Greene
R2.6 calibration UPDATED
Stable model. Wider evidence base.
Observability: loss of logging, telemetry, or forensic reconstruction is not itself a Prologue condition unless the same condition independently enables an operation across a defined authority boundary.
Evidence ceiling: CP-010 does not claim successful legacy-key theft; CP-011 stops at creation of a harmless internal pull request and does not claim merge, deployment, production, Slack, or email access.
Recurrence scope: EA01–EA05 is formally adjudicated across all eleven published Cyber Prologue cases. CP-010–011 add 40 condition-level decisions against the same frozen v0.2 standard, so the recurrence denominator is eleven.
The continuum
Latent → Contact → Warning → Spent
Each stage answers a different defender question. Contact does not prove consequence, and catalog relationships do not create runtime state.
IoPC · CONTACT
Contact
What observed activity has intersected that known exposure?
WoPE · DISRUPT
Warning
What contact now satisfies a declared warning pattern?
ATT&CK / IoC · HUNT
Spent
What evidence shows authority was exercised after contact?
Operational use
From exposure intelligence to Privilege Disruption.
Govern
Use IoPEs to identify authority that should not persist in the environment.
Hunt
Look for Contact Points where observed activity intersects known privilege exposure.
Disrupt
Act on WoPEs and other high-consequence contact before inherited authority becomes control.
Retire
Remove the privilege debt and path conditions that allowed the contact to matter.
Defender Intelligence · v3.3 canonical baseline
Explore Defender Intelligence
Select an exposure to see its admitted Attack Story evidence, declared WoPE relationships, and defensive response. The explorer reads the canonical JSON at runtime.
Execution Authority · Eleven-case evidence view
Where authority conditions recur—and where they are not established.
EA01–EA05 add a fifth domain to Defender Intelligence. Stories are rows; authority conditions are columns. Each admitted classification remains traceable to a Prologue condition, while unresolved and negative results stay visible.
Loading the eleven-case recurrence view…
Evidence → Governance
Govern the authority these conditions expose.
The governance matrix connects Human, NHI, and AI/Agentic authority lifecycles to GHDR and EA01–EA05.
See how these Execution Authority exposures are governed →Runtime boundary
Contact Point is an event, not a catalog node.
A Contact Point exists only when an observation carrying a valid iope_ref intersects a known exposure or a Path to Privilege it sits on. The baseline ships with no observations, so the site must render no runtime contact state.
Baseline runtime state
0 observations
No Contact Point is being inferred from catalog data.
Intelligence → Evidence
See how latent conditions become attack leverage.
Cyber Prologue attack stories show the same privilege conditions under real campaign pressure.
Explore Attack Stories →