Threat Informed Defense
from the threats you face to the controls and detections that stop them
Start from the adversaries that target you, and see which of their techniques you can detect and which controls would close the gap.
Security programmes are usually built from framework checklists, not from the attackers that target the business. Teams cannot say which techniques their top threats use, whether those techniques would be detected today, or which control would reduce the most risk next.
KnightGuard tracks the threat actors, malware and ransomware that matter to you and maps them onto MITRE ATT&CK, with your detection coverage overlaid technique by technique. It ranks the NIST SP 800-53 controls that mitigate the most of those techniques, grades your readiness from F to A, and shows the controls and detections that would take you to the next grade.
Where it works in CTEM
Contribution by stage across the continuous exposure management lifecycle.
Share of this use case's platform capability at each CTEM stage. The five shares sum to 100%. & the cycle repeats continuously
SCOPING
15%Name your threats. Track the threats that matter in four editable categories, such as threat actors, malware, ransomware and future threats, each rated by impact; build a risk profile on NIST SP 800-53.
DISCOVERY
20%Map them to ATT&CK. Tracked threats mapped onto ATT&CK by tactic, with each technique's mitigations, NIST 800-53 controls and D3FEND countermeasures, alongside CISA KEV, NVD and exploit intelligence.
PRIORITIZATION
35%Rank techniques and controls. Techniques ranked by how many of your threats use them, controls ranked by the techniques they mitigate, and a risk grade from F to A with the controls for the next grade.
VALIDATION
15%Check detection coverage. Each technique shows its detection status, from not covered through tested and validated to deployed, with the detections available for it; emulation campaigns test them (use case 08).
MOBILIZATION
15%Close the next gap. Work the controls that move you up a grade, compare controls across threats and tactics, and track each control in your risk profile as not in place, in progress or in place.
How it works
Each step follows the CTEM stage it belongs to.
Track your threats
Actors, malware and ransomware, rated by impact
Map to ATT&CK
Techniques by tactic, with mitigations and controls
Rank what matters
Techniques by threat usage, controls by techniques mitigated
Check detections
Status per technique, from not covered to deployed
Close the gap
Controls and detections for the next grade
Key capabilities
Threat landscape
Tracked threats in four categories you can rename and edit, each with an impact rating. Investigate sends up to five threats from a category onto the ATT&CK matrix.
ATT&CK with detection overlay
The selected threats' techniques by tactic, coloured by detection status with deployed and total counts, with views for common techniques and for the Enterprise, Mobile and ICS domains.
Detections where they matter
The attack techniques your threats use most, with the detections available for each in the library and your own detections by status: not tested, tested, validated or deployed.
Controls that move the grade
NIST SP 800-53 controls ranked by the techniques they mitigate, with completion percentage, and a comparison that traces threats to controls to tactics.
Risk grade from F to A
Each step up the grade widens the set of threats, controls and techniques that must be covered, and needs both control coverage and deployed detections above 75%.
Risk profile on 800-53
Start from the 800-53 baselines, your top-techniques list or a framework such as DORA, Essential Eight, CIS or HIPAA, and track every control as in place, in progress, not in place or not applicable.
From threats to techniques to controls
From the adversaries you track to their techniques, the controls that mitigate them and your grade.
Detection coverage, technique by technique
Your threats' techniques by tactic, each with its detection status, and the gaps to build next.
Ready to level up your cyber defence?
Supports modern enterprises with agentic AI discovery, real-time threat validation, and autonomous exposure prioritization.