▸ Detection lab · live
AI scales old attacks.
Nine in ten attack types predate AI. SecureAEye maps all 657 and proves, in a live detection lab, which defenses actually catch them — then hunts the AI-native few.
657 types / 91% pre-AI / 176 lab runs / 25 facets
0
Attack types
0
AI-native · 9%
0
Lab detonations
0
Attacks measured
0
Detections fired
~25s
Median time-to-detect
The threat landscape 657 · 10 categories
657 attack types across 10 categories. The indigo cluster is the 57 AI-native — the frontier.
AI readiness AI 57 vs classic 600
Mitigations exist, but detection and testing are nearly absent for AI-native attacks.
Has a mitigation AI 44 · cls 372
Has detection content AI 4 · cls 357
Has a test AI 1 · cls 171
Lab-measured AI 0 · cls 43
AI-nativeClassic
Lab detection outcomes 176 runs
47%detected
Detected 82
Partial / noise-only 93
0 graded “missed” — every no-match run still fired incidental noise, so partial is the real gap. 614 of 657 attacks are not yet measured.
Recent lab detonations LIVE
| When | Attack | Platform | Outcome |
|---|---|---|---|
| 11-02 | Bring-your-own-vulnerable-driver (BYOVD) | windows | detected |
| 11-02 | Certificate theft | windows | detected |
| 11-02 | PsExec / service execution | windows | detected |
| 11-02 | Credentials from password stores / vaults | windows | detected |
| 11-02 | Password spraying | windows | detected |
Kill-chain × category attacks per phase
Where each category lives in the kill chain. Columns are the 10 categories (same colours as the census); darker = more attack types.
| Reconnaissance | · | · | · | · | · | · | 1 | · | · | 3 |
|---|---|---|---|---|---|---|---|---|---|---|
| Resource Development | 4 | · | 1 | · | · | · | 7 | 3 | 5 | 7 |
| Initial Access | 8 | 5 | 15 | 4 | 5 | 20 | 7 | 4 | 8 | 17 |
| Execution | 5 | 4 | 1 | · | · | 10 | 12 | 5 | 1 | 4 |
| Persistence | 5 | 2 | 7 | 3 | 12 | 12 | 9 | 9 | 2 | 2 |
| Privilege Escalation | 2 | 1 | 1 | 1 | 9 | 9 | 4 | 1 | 2 | · |
| Stealth | 2 | · | 1 | 4 | 2 | 4 | 1 | 13 | 4 | 12 |
| Defense Impairment | · | · | · | · | 8 | 4 | · | 1 | 4 | · |
| Credential Access | 13 | 4 | 6 | 4 | 51 | 8 | 2 | 5 | 3 | 2 |
| Discovery | 3 | · | 2 | 1 | 1 | 2 | · | 1 | · | · |
| Lateral Movement | 4 | · | 6 | · | 8 | 1 | 4 | 2 | 1 | · |
| Collection | 10 | 1 | 6 | 2 | 5 | 5 | 3 | 5 | 2 | 1 |
| AI Attack Staging | · | · | · | · | · | · | 7 | · | · | 1 |
| Command and Control | 9 | · | · | · | · | 3 | · | 6 | · | 2 |
| Exfiltration | 4 | · | · | · | · | 3 | 9 | · | · | · |
| Impact | 35 | 1 | 11 | 2 | · | 1 | 7 | 9 | 9 | · |
| Inhibit Response Function (ICS) | · | · | 4 | · | · | · | · | 1 | · | · |
| Impair Process Control (ICS) | · | · | 8 | · | · | · | · | · | · | · |
Severity × detectability 657
Exposure matrix. Red = severe and hard to see; grey = severe but unassessed — the enrichment backlog.
| High | Med | Low | None | Unassessed | |
|---|---|---|---|---|---|
| Critical | · | · | · | · | · |
| High | 105 | 28 | 30 | 53 | 141 |
| Medium | 15 | 3 | 16 | 10 | 75 |
| Low | 3 | 2 | 5 | 3 | 21 |
| Very low | · | · | · | · | 1 |
| Unrated | 50 | 5 | 10 | 23 | 58 |