Attack graph

The Attack Graph is Pilot’s view of how everything connects. It’s modelled directly on Bloodhound’s “Point A → Point B” approach: every node is something an attacker would collect during reconnaissance, every edge is a real pivot they would make.

There are no letter grades here, no posture percentages. The frame is tradecraft: what would an adversary’s recon graph look like over the data you’ve collected, and what concrete chains of pivots could move them from external visibility to business-impacting data?

Node kinds

The nodes are things you’d see in an MITRE PRE-ATT&CK enumeration:

Kind	What it represents
company	The organisation you’re scoping (logical container).
domain	A root domain you own (acme.com).
subdomain	A child host under a known domain (api.acme.com).
ip	An IP the host resolved to.
host	The live HTTP/S endpoint at host:port.
technology	A server / framework / CMS fingerprinted on the host.
js_bundle	An external JS file the host serves.
finding	A nuclei finding tied to a host.
secret	A leaked credential from page/JS/repo source.
repo	A connected GitHub/GitLab repository.
cloud_asset	An inferred AWS/GCP/Azure resource (from secret matches).
saas_service	A detected SaaS Pilot saw in use.
idp	A detected identity provider (Okta, Auth0, Azure AD, GWS).

Edge kinds and confidence

Edges are tradecraft verbs — OWNS, HAS_CHILD, RESOLVES_TO, HOSTS, RUNS, SERVES, EXPOSES, LEAKS, AUTHENTICATES_TO, FEDERATES_WITH, IMPERSONATES, MATRIX_CHAIN, and a few more — each tagged with a MITRE PRE-ATT&CK technique id.

Every edge has a confidence label that shows on screen as a colour:

• verified (solid emerald) — we observed it. host RUNS technology is verified because we fingerprinted the response.
• inferred (dashed amber) — follows necessarily from what we observed. idp FEDERATES_WITH saas_service is inferred when both endpoints are detected for the same company.
• speculative (dotted zinc) — the attacker’s reasonable guess. cloud_asset HOSTS_DATA inferred-bucket based on naming conventions is speculative.

The matrix-driven edges (PR15+) get their own distinct emerald-dotted treatment — same speculative confidence, but visually labelled so you know they’re catalogue hypotheses, not naming guesses.

Modes

The Attack Graph has five top-level modes (tabs at the top of the page):

• Canonical — pre-baked queries: “Code-leak blast radius”, “Front-door pivots”, “Subdomains with live CVEs”, “Client-side JavaScript surface”, “Identity provider blast radius”, “SaaS Matrix chains”. One click → ranked path list + canvas highlight.
• Entry Point — pick a node, walk outward N hops. The classic Bloodhound investigation.
• Path Pair — pick A and B, get the top-k tradecraft chains between them.
• What-if — AI hypotheses (catalogue + LLM) over the graph. Clearly framed as research, not findings.
• All View — everything, capped at 2000 nodes. Opt-in because it’s visually heavy.

Interacting with the canvas

• Click a node → opens the Node Inspector panel on the right with provenance, evidence, and related counts.
• Double-click a node → expand its 1-hop neighbours in place.
• Right-click a node → context-aware actions (view source, copy id, drill in).
• Click an edge → if it’s a MATRIX_CHAIN, a floating panel pops with the catalogue technique chain. For other edges, the endpoints’ inspector panels show the evidence.
• Scroll / pinch → zoom. Drag → pan.

Layout

The default layout is cose-bilkent (a force-directed algorithm). It runs once on load and settles within a second or two for graphs up to ~1000 nodes. The All View uses a looser variant with more repulsion so you can read large graphs.

The bottom-left legend explains the node colours (by kind) and the edge styles (by confidence). Toggle it open/closed with the chevron.