IoPE · DETER
Exposure
What exploitable privilege condition already exists?
Defender Intelligence Continuum · MVP
See privilege risk before it becomes attack consequence.
Defender Intelligence connects known privilege exposure to runtime contact, warning, and defensive response without allowing the application to invent relationships that the data does not declare.
The continuum
Latent → Contact → Warning → Spent
Each stage answers a different defender question. Contact does not prove consequence, and catalog relationships do not create runtime state.
IoPC · CONTACT
Contact
What observed activity has intersected that known exposure?
WoPE · DISRUPT
Warning
What contact now satisfies a declared warning pattern?
ATT&CK / IoC · HUNT
Spent
What evidence shows authority was exercised after contact?
Defender Intelligence · Canonical v3.2 baseline
Explore Defender Intelligence
Select an exposure to see its declared warning relationships and defensive response. The explorer reads the canonical JSON at runtime.
Runtime boundary
Contact Point is an event, not a catalog node.
A Contact Point exists only when an observation carrying a valid iope_ref intersects a known exposure or a Path to Privilege it sits on. The baseline ships with no observations, so the site must render no runtime contact state.
Baseline runtime state
0 observations
No Contact Point is being inferred from catalog data.
Operational use
From exposure intelligence to Privilege Disruption.
Govern
Use IoPEs to identify authority that should not persist in the environment.
Hunt
Look for Contact Points where observed activity intersects known privilege exposure.
Disrupt
Act on WoPEs and other high-consequence contact before inherited authority becomes control.
Retire
Remove the privilege debt and path conditions that allowed the contact to matter.
Intelligence → Evidence
See how latent conditions become attack leverage.
Cyber Prologue attack stories show the same privilege conditions under real campaign pressure.
Explore Attack Stories →