CYBER COMMON OPERATING PICTURE

Mission posture, not alert confetti.

Join exposure, identity, telemetry, mission dependency, trusted time, response authority, and evidence into one operational picture.

OPERATIONAL PRIORITY INDEX

Mission cyber posture

—

—/ 100CALCULATING

DECIDE FIRST

Top mission exposures

INCIDENT COMMAND

Active incidents

NEXT BEST ACTION

Recommended moves

OPENBUS / CYBER

Live security feed

SSE OFFLINE

ZERO-TRUST RESOURCE GRAPH

Assets, identities, services, models, and machines.

The thing to protect is a resource and its mission effect—not merely an IP address.

TECHNOLOGY & CYBER-PHYSICAL

Asset inventory

Asset	Type	Owner	Criticality	Exposure	Status

HUMAN • SERVICE • MACHINE • MODEL

Identity plane

MISSION DEPENDENCY

What breaks if this breaks?

EXPOSURE INTELLIGENCE

CVSS is one ingredient. Mission risk is the meal.

Prioritize with severity, EPSS, known exploitation, reachability, criticality, control strength, evidence confidence, and mission dependency.

Priority	Exposure	Asset	Evidence	Risk components	Status

DETECTION ENGINEERING

Measure coverage against behavior, not product licenses.

Portable detections map normalized telemetry to ATT&CK behavior and D3FEND countermeasures. Gaps remain visible instead of being airbrushed by a vendor score.

PRIORITY ATT&CK SET

Behavior coverage

—

DEFENSIVE KNOWLEDGE

D3FEND countermeasures

CORRELATED FINDINGS

Detection queue

Detection	Severity	Source	Assets	ATT&CK	Status

INCIDENT COMMAND & CASEWORK

Evidence-backed response with a human on the trigger.

Preserve provenance, calculate mission impact, use CACAO-style playbooks, and turn approved effects into OpenTask work.

CASE QUEUE

Incidents

CASE DETAIL

Select an incident

Select a case to inspect evidence, create a response task, or start a playbook.

APPROVAL-GATED AUTOMATION

Response playbooks

EXECUTION

Playbook runs

CONTINUOUS ASSURANCE

Controls with evidence, not checkboxes with amnesia.

Track CSF 2.0 outcomes, control state, evidence links, trusted time, exceptions, and machine-readable exports.

OSCAL-aligned JSON Verify evidence chain

CONTROL REGISTER

Assurance state

CHAIN —

Function	Control	Owner	Evidence	Status

SEMANTIC ATTACK PATHS

See the route to mission impact.

Fuse reachability, exposure, identity privilege, asset dependencies, and criticality. The graph identifies choke points before an adversary does.

CURRENT PATH

Attack path graph

—

RANKED PATHS

Mission attack paths

SOFTWARE, MODEL & AGENT ASSURANCE

Secure what can decide and act.

Correlate SBOM/VEX/CSAF with mission assets, and govern AI systems by data, model, identity, delegated authority, tools, and approval boundaries.

SOFTWARE SUPPLY CHAIN

SBOM inventory

0

Ingest SPDX / CycloneDXPOST documents to /api/cyber/ingest/sbom with an operator token.

AI / AGENTIC SYSTEMS

Authority inventory

0

INTEROPERABILITY