Unified Exposure Validation
threat scenarios, emulation campaigns, phishing and EDR posture
Prove your defences against the attackers you actually face: emulate their techniques, check that your SIEM saw them, and close the gaps.
Detection rules are written and rarely tested, EDR policies drift from block to detect-only, and phishing training is a yearly checkbox. A coverage map says a technique is covered, but nobody knows whether the alert would fire on the day.
KnightGuard builds threat scenarios from real attacker playbooks, each a chain of ATT&CK techniques, and turns them into campaigns that an agent runs on a designated lab host. After each step it queries your SIEM with that step's detection analytics and keeps the matched events as evidence, so a missing detection shows as a technique with no events. Phishing campaigns test people, EDR posture checks test that endpoint protection is set to block, and validated rules are deployed to the SIEM under a four-eyes rule.
Where it works in CTEM
Contribution by stage across the continuous exposure management lifecycle.
Share of this use case's platform capability at each CTEM stage. The five shares sum to 100%. & the cycle repeats continuously
SCOPING
10%Pick the adversary. Scenarios start from the threat actors and malware that matter to you, built step by step or generated with AI from a threat entity, and target your organisation's priority techniques.
DISCOVERY
10%Map your coverage. Coverage per ATT&CK tactic shows which techniques have scenarios and campaigns; EDR policy and agent settings are read from your EDR; users and groups are imported for phishing.
PRIORITIZATION
15%Rank the gaps. Techniques with no scenarios or campaigns are ranked by your priority, and the coverage report bands each phase of an attack below, at or above average.
VALIDATION
50%Emulate and check. Each emulated step's detection analytics run against your SIEM, with the matched events kept as evidence; phishing measures opens, clicks, submissions and reports; EDR settings pass or fail.
MOBILIZATION
15%Deploy what works. Detection rules move from tested to validated to deployed in your SIEM, and the person who tested a rule cannot deploy it; users who submitted data are sent training.
How it works
Each step follows the CTEM stage it belongs to.
Pick the adversary
Threat actor or malware, scenario from its playbook
Map coverage
Techniques with and without scenarios, per tactic
Rank the gaps
Uncovered techniques by your priority
Emulate
An agent runs each step on a designated lab host
Check the SIEM
Matched events per step; none marks a gap
Deploy the rule
Tested, validated, deployed, by two people
Key capabilities
Threat scenarios from real playbooks
ATT&CK technique chains attributed to threat actors and malware. Build one in four steps or generate it with AI from a threat entity; techniques with no scenario open straight into detection authoring.
Breach and attack emulation
A scenario becomes a campaign: a chain of steps that a downloadable agent runs on a designated lab host. Every run is kept with its status, so results can be compared over time.
Detection checked in your SIEM
After each step, its detection analytics are queried in Microsoft Sentinel, Splunk, Elastic, Securonix or Stellar Cyber. View Logs shows the events that matched; no events marks the gap to fix.
Rules deployed under four eyes
Deploy All Detection Rules takes each rule from tested to validated to deployed. Deployment is blocked until a rule is tested and validated, and the tester cannot deploy it.
Phishing simulation
Templates, landing pages, sending profiles and groups, written with AI or by hand. Sent, opened, clicked, submitted and reported are measured, and those who submitted data are sent training.
EDR prevention posture
SentinelOne and Bitdefender policies checked for protect rather than detect-only mode, tamper protection, quarantine, on-access scanning and up-to-date agents, as pass or fail findings.
Emulate the adversary, check the SIEM
An adversary's techniques emulated on a lab host, each checked against your SIEM's analytics.
Three ways to prove a defence
Detection, people and prevention, each validated its own way, with four-eyes deployment.
Ready to level up your cyber defence?
Supports modern enterprises with agentic AI discovery, real-time threat validation, and autonomous exposure prioritization.