Viper Attack
Dashboards

Every test. Every outcome.

Validation overview

Q3 validation cycle · 72 tests in scope

Q3 cycle
Tests run726 techniques excluded by scope
Blocked3853% of tests run
Detected only1115% · alert raised, not stopped
Allowed2028% · no block, no alert
Inconclusive34% · evidence too thin

Results by control area

  • Blocked
  • Detected only
  • Allowed
  • Inconclusive
View as table
Control areaBlockedDetectedAllowedInconclusiveTotal
Endpoint & malware922114
Email security712010
Segmentation / zero trust1005116
Firewall & egress534012
AI data exposure534012
Identity & credentials22318

Trend by quarter

Share of tests each quarter

  • Blocked
  • Allowed
Blocked share rose from 36% to 53% over four quarters while allowed share fell from 44% to 28%. 60%40%20%0% Q4Q1Q2Q3 53% 28%

No single score

A blended number hides the one path that matters. Every outcome here traces to a specific test, system and date.

Technique coverage by attack stage

Tests grouped by MITRE ATT&CK tactic · each tile is one simulated technique

Q3 cycle
  • Blocked
  • Detected only
  • Allowed
  • Inconclusive
  • Not tested

Initial access

Malicious link in emailAttachment with macroPassword sprayingExternal VPN exploit

Execution

Office macro runs scriptScript download cradleIn-memory script

Persistence

Scheduled taskStartup folder itemNew local account

Privilege escalation

Shared local admin reuseService permission abuse

Defense evasion

Disable security toolClear event logsSigned system binary misuse

Credential access

Credential dumpingName resolution poisoningBrowser password store

Discovery

Network share scanDirectory enumeration

Lateral movement

Remote service with reused adminRemote desktop to serversRelayed authentication

Command & control

Encrypted beaconKnown-bad test domainDNS tunneling pattern

Exfiltration

Upload to personal cloudPaste to unapproved AI toolLarge outbound transfer

Tactics follow the MITRE ATT&CK framework.

Attack path to sensitive files

How individual weaknesses chained together from one compromised laptop

Q3 cycle
From a staff laptop foothold, credential dumping was blocked. Reusing a shared local admin password was allowed, giving access to three workstations. Legacy name resolution poisoning was allowed, then relayed authentication reached the file server. The file server was reached. The fix for shared admin passwords breaks the path at step two. Staff laptopStarting foothold Shared admin reuseAllowed · 3 hosts Name poisoningAllowed · relayed auth File serverReached in test Credential dumpingBlocked by endpoint Best fix: unique admin passwords 3 steps

One fix breaks the chain at step two.

Zero trust and segmentation checks

Can traffic cross between network zones when policy says it shouldn't? 16 tested flows

Q3 cycle
  • Blocked as intended
  • Allowed against policy
  • Permitted by policy
  • Inconclusive
Source zone in rows, destination zone in columns
From \ ToStaff devicesFinanceServersAdmin consoles
Guest Wi-FiBlockedBlockedAllowedBlocked
Staff devicesPermittedAllowedPermittedAllowed
FinanceBlockedPermittedPermittedBlocked
Printers & IoTBlockedBlockedAllowedInconclusive
Remote workersBlockedAllowedBlockedBlocked

Firewall and outbound traffic

Would data or a remote-control channel get out? 12 tests

Q3 cycle
  • Connection to a known-bad test domainBlocked
  • Upload to personal cloud storageBlocked
  • Outbound file sharing (SMB)Blocked
  • Anonymizing network connectionBlocked
  • Outbound remote desktopBlocked
  • Encrypted beacon to test serverDetected
  • Large transfer to unknown hostDetected
  • HTTPS on a non-standard portDetected
  • DNS tunneling patternAllowed
  • Newly registered domain over HTTPSAllowed
  • Outbound file transfer (FTP)Allowed
  • ICMP tunneling patternAllowed

Endpoint and malware controls

Safe simulations only, never live malware. 14 tests

Q3 cycle
  • Industry-standard antivirus test file downloadBlocked
  • Test file as email attachmentBlocked
  • Ransomware-style encryption of a test folderBlocked
  • Credential dumping attemptBlocked
  • Office macro launching a scriptBlocked
  • Attempt to disable the security agentBlocked
  • Process injection simulationBlocked
  • In-memory script executionBlocked
  • USB autorun of a test fileBlocked
  • Script download cradleDetected
  • Persistence via scheduled taskDetected
  • Misuse of a signed system toolAllowed
  • Clearing security event logsAllowed
  • Reading the browser password storeInconclusive

AI data exposure

Can staff paste or upload sensitive data into AI chat tools? Tested with synthetic data only

Q3 cycle
AI tools seen in test window9From approved browser and proxy logs
Not approved by the company4Personal accounts and unknown tools
Sensitive pastes blocked5 of 12Stopped before reaching the AI tool
Reached the AI tool unnoticed4 of 12No block, warning or log entry
Synthetic data usedWhere it wentMethodResultWhat happened
Fake Social Security numbersPublic AI chat, personal accountPasteBlockedBrowser control stopped the paste and showed a warning
Test credit card numbersPublic AI chat, personal accountPasteBlockedStopped on paste
Fake customer list (CSV)Public AI chat, personal accountFile uploadBlockedUpload refused by web proxy
Fake bank account numbersAI browser extensionPasteBlockedExtension not on the approved list
Fake HR filePublic AI chat, personal accountFile uploadBlockedUpload refused by web proxy
Fake Social Security numbersCompany AI workspacePasteDetectedAllowed by policy and logged for review
Code containing a fake API keyAI coding assistantPasteDetectedAlert raised; key not redacted
Fake contract textCompany AI workspacePasteDetectedLogged; no action required by policy
Fake patient recordPublic AI chat, personal accountPasteAllowedHealth data pattern not in the DLP policy
Fake customer list (CSV)Unapproved AI toolFile uploadAllowedTool not in the web proxy's AI category
Fake Social Security numbersPublic AI chat, personal accountTyped by handAllowedControl only inspected pastes, not typing
Screenshot of fake payrollPublic AI chat, personal accountImage uploadAllowedImages not inspected for text

Tested with synthetic data only.

Phishing simulation

One authorized campaign · 60 recipients · reported in aggregate

Q3 cycle

Reported in aggregate only.

Remediation tracker

Who owns each fix and whether a retest confirmed it

Q3 cycle
FindingOwnerStatus
Legacy name resolutionIT providerVerified fixed
Card data paste to AI chatIT providerVerified fixed
Shared local admin passwordIT providerPartly fixed
Health data not in DLP policyCompliance leadAwaiting retest
Printers can reach serversIT providerAwaiting retest
DNS tunneling not filteredIT providerOpen
Event log clearing unalertedSecurity vendorRisk accepted

"Verified fixed" means retested, not just closed.

See your own results.

Start with a scoped pilot assessment.

Discuss a pilot assessment Read the sample report