MMT Autonomous · Autonomous Security Assurance
From attack surface to verified closure, autonomously.
Discover what is exposed, select attacker-relevant scenarios, safely prove what matters, show business impact, break the path, retest the exact relationship and preserve the evidence — without turning production into an offensive playground.
Current certified engineering position · 8 September 2026
647 Safe ValidatorsTechnique-relevant, bounded validation coverage.
6,712 Validation MethodsPlatform × objective configurations from certified validators.
5,536 Runnable ScenariosAcross eight compiled scenario modules, plus dedicated Phishing Readiness.
26/26 Defensive Gate PASSLive engineering boundary is machine-enforced and fail-closed.
Evidence Assurance V2Provenance, freshness, dual verification, blind spots and exact-path reproducibility.
Enterprise OperationsAction Center, Portfolio Exposure, owner/SLA workflow and evidence-backed closure.
Current Certified Depth
The platform is now much deeper than outside-in scanning.
The current engineering state combines threat research, attacker-path reasoning, safe proof execution, endpoint/private evidence, detection replay, remediation and exact-path closure.
Engineering certification is not customer proof or independent market validation. Those evidence states remain separate by design.
Nine Validation Modules
Choose the attacker outcome. Autonomous chooses the safe proof path.
Each module shares the same authorization, evidence, execution-governor and exact-retest rules.
Network Infiltration
Bounded service reachability, network trust, segmentation and synthetic egress validation without lateral exploitation.
Endpoint Attacks
Windows/macOS/Linux posture, persistence metadata, application context, local privilege metadata and synthetic secret canaries.
E-mail Infiltration
SPF/DMARC/MX, SMTP/TLS, synthetic mailbox delivery, inert link/attachment canaries and detection evidence.
Phishing & Human-Layer Assurance
Allowlisted customer test recipients, benign links, inert attachments, synthetic landing/form reach, reporting, detection, containment and exact campaign retest — without collecting credentials.
Web / API
Controlled browser, authenticated synthetic roles, API authorization, session, OAuth/OIDC, GraphQL and business-logic assurance.
Identity & Privilege
Synthetic authentication, MFA expectation, role boundaries, AD/Entra relationships, delegation and privilege-path reasoning.
Cloud & Kubernetes
Read-only IAM/RBAC relationships across AWS, Azure, OCI, GCP and Kubernetes, with workload-identity reasoning.
Data Access / Exfiltration
Synthetic protected-data markers, repository boundaries, role controls and egress canaries — never real customer records.
Ransomware & Recovery
Qilin, Play, BlackCat, Cl0p, LockBit and Conti behavior profiles using isolated scratch-file impact and recovery evidence.
MMTNEXUS Labs · Threat Research
Turn global threat intelligence into safe customer validation.
Threat Cases and Labs correlate public research with MMTNEXUS safe validators, platforms and attacker objectives. A named threat never becomes a customer finding until customer-specific evidence makes it relevant.
- 717 named Threat Cases across emerging threats, vendors, actors, campaigns, malware and ransomware
- 5,536 runnable threat × module × platform scenarios
- 6,721 unique safe actions in the scenario compiler
- Research updates change prioritization — never historical proof
Threat intelligence source fabric
Exploit references are metadata only. Malware samples are never downloaded or executed by the assurance engine.
Web / API Exploitability Assurance
Deep application assurance without unrestricted payload execution.
The Web/API engine maps observed application evidence to 21 governed scenarios, ranks what is applicable, and requires deterministic verification before promoting an unsafe condition.
SQL InjectionXSSSSRFCommand-Injection RiskXXEPath TraversalFile UploadRequest SmugglingAuth / SessionJWTOAuth / OIDCIDOR / BOLAPrivilege EscalationTenant IsolationAPI AuthorizationCORSGraphQLBusiness LogicRace / IdempotencySecret IndicatorsDependency / Supply Chain
Controlled Browser
Renders already-observed same-origin paths, follows bounded links, preserves DOM/screenshot hashes and separates anonymous from synthetic authenticated roles.
Authenticated Synthetic Roles
Validates login, session rotation, logout, CSRF, MFA expectations and explicit allowed/denied routes without real-user credentials.
Independent Verification
Candidate unsafe evidence must agree across a second deterministic path or receipt before it becomes a customer finding.
Private Runner + Endpoint Assurance
See private networks and endpoints without deploying a remote shell.
The Private Runner polls outbound over HTTPS, accepts only certified fixed-function jobs, and returns normalized evidence receipts. The control plane never accepts arbitrary commands.
- Private Runner v1.4.0 · 25 runtime capabilities
- 40 governed proof kinds at the gateway
- Linux, Windows and macOS support
- No inbound firewall rule, no shell, no credential capture
WindowsDefender / firewall / persistence / app posture
macOSXProtect / TCC / LaunchAgents / app metadata
LinuxLocal privilege / service / package / network metadata
Synthetic canariesSecrets · host control · lateral reachability · ransomware scratch impact
Endpoint / Malware Behavior Assurance
Validate malware behavior safely - never by running malware.
Eleven certified behavior profiles model attacker-relevant endpoint conditions using posture metadata and synthetic canaries.
Windows
Security posture, persistence paths, application metadata, egress policy and synthetic secret boundaries.
macOS
XProtect/TCC posture, launch persistence, application inventory and endpoint network policy evidence.
Application profiles
Application execution and synthetic-secret boundaries tied to customer-safe proof only.
Integration Fabric
Thirty-six ways to add context — never a dependency for core assurance.
The Integration Fabric normalizes evidence from identity, cloud, network controls, detection, vulnerability, threat-intelligence and remediation systems. Connection state alone never upgrades a security result.
Asset & Environment Discovery
AD · Entra · Intune/MECM · vCenter · ServiceNow CMDB · AWS · Azure · OCI · GCP · Kubernetes
Network & Security Controls
Palo Alto · Fortinet FortiGate · Cisco Secure Firewall / ASA · Cisco ISE · F5 BIG-IP
Detection & Response
Microsoft Sentinel · Splunk · CrowdStrike Falcon · Defender XDR · SentinelOne · QRadar · Elastic Security
Vulnerability & Exposure
Tenable · Qualys · Rapid7 InsightVM · Wiz
Threat Intelligence
Recorded Future · Google / Mandiant · CrowdStrike Intelligence · Microsoft Threat Intelligence · STIX / TAXII
Ticketing & Remediation
ServiceNow Security Operations · Jira · Azure DevOps · GitHub · GitLab
Execution & Proof Ledger
See what was available, relevant, evaluated and actually executed.
Every assessment persists a machine-readable execution lifecycle. Planned proofs are never counted as executed; fixed-function execution requires receipt-backed evidence.
- Execution & Proof Ledger with cryptographic SHA-256 receipts
- Watch the Hacker replay of persisted decisions and evidence order
- Available → Relevant → Evaluated → Executed kept separate
- Exact-path retest and alternate-route search before closure
AVAILABLESafe contract exists
→RELEVANTTarget evidence matches
→EVALUATEDCondition tested
→EXECUTEDReceipt-backed proof
→VERIFIEDExact closure evidence
EVIDENCE ASSURANCE V2
Know exactly how much of an assessment you can rely on and why.
Coverage, freshness, provenance, corroboration, reproducibility, blind spots and exact-path closure are measured separately. MMTNEXUS does not hide uncertainty inside a generic confidence score.
Provenance & Freshness
Every evidence item keeps source, scope, method, timestamp, freshness state and cryptographic reference. Stale evidence is quarantined instead of silently remaining valid.
Dual Verification
High/Critical conclusions require independent corroboration where technically possible. One scanner, one signal or one observation cannot become strong verification by itself.
Blind Spots & Completeness
Every run reports what was applicable, what was evaluated, what could not be tested and the prerequisite that is missing.
Cross-Source Corroboration
Native proof, cloud/identity evidence, vulnerability tools, detection platforms and integrations strengthen a conclusion only when their evidence semantics actually agree.
Exact-Path Reproducibility
Remediation is not closure. The same relationship sequence must be replayed and the original attacker condition must disappear or be blocked.
Customer Adjudication
TP, FP, FN, remediation verification and exact-retest outcomes are tracked separately from internal engineering certification.
Independent Evidence Pack
External validation remains fail-closed until independently adjudicated evidence exists. MMTNEXUS never self-awards independent validation.
Transparent completeness formulaEvidence completeness = evaluated applicable validators ÷ all applicable validators. Proof strength, freshness, corroboration and retest status are displayed separately.
Advanced Autonomous Fabric
Research, prove, reassess and federate under the same safety model.
The latest platform adds continuous threat-led reassessment, passive external discovery, provider collection, federated proof and isolated-lab evidence without weakening the production boundary.
Passive External Discovery
Certificate Transparency and DNS metadata discover candidate assets. Newly found names remain unauthorized until separately added and verified.
Continuous / Rapid Reassessment
Threat, asset, identity, configuration and remediation changes can trigger bounded reassessment or exact-path retest decisions.
Isolated Exploit Validation Lab
When production-safe evidence is insufficient, reproduction can move to an isolated disposable replica. Customer production remains outside unrestricted exploit execution.
Mission Assurance & Federated Proof
Threat fingerprints, change gates, federated proof objects and receipt verification preserve evidence integrity across assurance workflows.
Read-only Provider Collectors
Customer-side collectors normalize AD, Entra, AWS, Azure, OCI, GCP and Kubernetes relationships while credentials stay local.
MCP / Agent Interface
Organization-scoped tokens expose governed read, assessment, retest and evidence tools to authorized AI/SecOps agents without exposing internal gateway credentials.
Enterprise Operations
Turn security evidence into an accountable daily operating model.
Autonomous now connects findings, owners, SLAs, remediation, exact retest, stale evidence, runner health and portfolio exposure in one operational layer.
AUTONOMOUS ACTION CENTER
One mission queue for findings, unassigned work, overdue SLAs, stale evidence, offline Private Runners, continuous-assurance issues and closure work.
Portfolio Exposure
Rank assets by current finding severity, open attack stages, threat relevance, exact-path closure status and latest assessment evidence.
Owner & SLA Accountability
Assign an organization or external owner, apply severity-based SLA targets, and track acknowledgement, fix progress, blocked state and retest readiness.
Fix & Break Workflow
Move directly from evidence to the smallest effective remediation, Change Safety requirements, rollback conditions and the exact proof required for closure.
Closure Cannot Be Manually Claimed
Ticket state, owner confirmation or configuration change cannot mark a finding Verified Closed. Exact-path evidence is authoritative.
Continuous Operational Reassessment
Surface changes, threat signals, identity/cloud changes, remediation state and evidence freshness feed the operating queue instead of disappearing into backend telemetry.
The Seven Answers
Security assurance in the language leadership needs.
Technical depth stays underneath. Leaders get one evidence-backed story from entry to closure.
Can they get in?
Shows whether attacker reachability is proven from the authorized entry point.
How far can they go?
Counts only proven attacker-reachable relationship hops.
What can they reach?
Connects technical reachability to the highest-value known service or crown jewel.
What should I fix?
Prioritizes the smallest proven relationship change with the highest path-breaking value.
Did the fix work?
Requires an identical safe retest — not a ticket or configuration status.
Is there another route?
Searches for credible alternate attacker paths after the primary route changes.
Are we verified?
Campaign-level closure requires exact-path evidence and no unresolved credible route for the mapped objective.
Defensive Development Gate
26/26 live engineering checks passed.
The standing development boundary is machine-enforced across proof adapters, Private Runner, controlled browser, Web/API assurance, execution governance and endpoint-malware assurance.
MMT Autonomous
Run the complete evidence-led security story from one customer workspace.
Discover → Validate → Path → Impact → Fix → Retest → Prove. Every conclusion remains tied to the exact evidence that produced it.