Risk Hotspots — standing analysis
_Discovery Engine (Phase 3) · miner: gaps · seed 1729 · source DB git_commit 92a83fc · generated from analysis/output/gaps.json._
Candidates, not discoveries — and deliberately tiered. Because detectability and mitigation enrichment are coupled (see below), a single hard "high-impact AND low-detect AND unmitigated" AND is misleading. Items are split into evidence tiers. Only Tier A is a measured signal; Tier B is an enrichment gap and must NOT be acted on as a risk finding.
Definition of high-impact: severity ∈ {high, very-high} OR impact includes a destructive code {availability, financial, safety} OR ≥2 distinct impact values.
Summary
| tier | meaning | count |
|---|---|---|
| — | high-impact total | 87 |
| — | high-impact unmitigated | 60 |
| A | genuine low-detectability + high-impact + unmitigated | 2 |
| B | high-impact + unmitigated + detectability UNKNOWN (not enriched) | 57 |
| C | high-impact + unmitigated but detectable | 1 |
The naive "60 undetectable high-impact attacks" headline collapses to 2 once coverage is controlled — a confirmed methodological negative result. All 57 Tier-B attacks lack a detectability facet and any ATT&CK-family external id, so their "no detection" means "never assessed", not "undetectable" (P(mitigation|has-detectability)=0.976 vs 0.045 without; Fisher p=1.8e-135).
Tier A — genuine (measured) hotspots
| rank | attack | category | impact | detect | mit | risk |
|---|---|---|---|---|---|---|
| 1 | Compute resource hijacking | cloud-container-supply-chain | availability | low | 0 | 0.56 |
| 2 | Cryptojacker | malware | availability | low | 0 | 0.56 |
Harness verdict — REFUTED as a "detection void." Both resolve to a single ATT&CK technique T1496.001 double-listed under two slugs (effectively n=1). The DB also holds the parent resource-hijacking-cryptojacking (T1496) rated detectability=HIGH with 14 detected_by edges — 13+ Sigma cryptomining/pool rules already exist locally. The children's detectability=low is a sub-technique-vs-parent tagging-granularity artifact, not a real void. MITRE's own T1496 page states prevention is impractical and prescribes resource-utilization monitoring (hence 0 mitigations is expected, not a gap). Low-risk data fix: roll parent T1496 detection edges down to the T1496.001 children so they re-rate to high.
Tier B — high-impact + unmitigated but detectability UNKNOWN (do NOT act)
57 attacks, concentrated in categories the detection instrument cannot reach:
| category | count |
|---|---|
| web-application | 37 |
| wireless-mobile-iot-ot | 7 |
| crypto-hardware-side-channel | 5 |
| network-infrastructure | 4 |
| cloud-container-supply-chain | 3 |
| ai-ml-emerging | 1 |
Highest raw risk_score (0.88) Tier-B items: intel-me-amd-psp-exploit, jwt-alg-none, local-remote-file-inclusion, open-source-backdoor, protestware. These are not claims of undetectability — they are attacks keyed to CVE/CWE/CAPEC/OWASP with no ATT&CK mapping, so the Sigma/Elastic-derived detectability facet was never computed for them. The proper follow-up is a cross-corpus detectability source (OWASP CRS/WAF, Suricata/Snort, RASP), not treating this list as a danger ranking.
Tier C — detectable
resource-hijacking-cryptojacking (the well-covered T1496 parent) — high-impact and unmitigated but detectability=high, i.e. detection content exists.
Caveats (standing)
- Curated-dataset selection bias: absence of a facet is missing data, not a measured negative.
- Tier B is an enrichment gap, not a risk signal. This is the single most important caveat here.
- Empirical detectability/exploitability is deferred to Phase 4 (lab detonation, false-positive measurement). No hotspot is asserted confirmed as undetectable.