Probative
Plan
P-01
Rev.
Nov 2026
Drawn for
Security leadership
Request access

Run the fire drill before the fire.

Probative attacks a replica of your environment, proves every route an attacker could take with captured evidence, and verifies the fix that closes each one. Production is never touched.

Early access for security teams. We reply personally; no newsletter.

Ground floorIllustrative environment
Floor plan of an illustrative network. A proven attacker route runs from the internet through the edge proxy, web tier, corridor and CI runner into the secrets vault. A fire door between the web tier and the corridor is the chokepoint.FittedEdge proxynginx 1.24IdentitySSO + MFAWeb tierapp-web-01App tierapi-02 · patchedServer VLAN · corridorCI runnerci-02Secrets vaultkv/prod/*Internet?Suspected,not reproduced1234Not to scale · one room per network zoneN

Drag sideways to see the whole plan.

Route P-01 · Internet to secrets vault · 4 hops proven in the replica · evidence attached to each

  • Proven route
  • Suspected, not reproduced
  • Hop with evidence
  • Fire door: the fix that breaks the route

A scanner rings every alarm. Probative shows you the fire.

What a scanner hands you

  • app-web-01CVE-2024-6387opensshcritical
  • app-web-01CVE-2023-44487nginxhigh
  • ci-02CVE-2024-3094xz-utilscritical
  • api-02CVE-2023-38545curlhigh
  • vault-01CVE-2024-24790go stdlibcritical
  • …and thousands more, none ranked by whether anyone can reach them.

What Probative hands you

  1. 1Path traversal on the edge proxy reads the app’s config.
  2. 2A deploy key in that config opens the web tier.
  3. 3The same key logs into the CI runner over SSH.
  4. 4The runner’s token reads production secrets.

Four hops, each proven in a replica. One fire door breaks the route.

Illustrative findings and environment.

How a drill runs

Eight steps, three zones. Offence happens only inside the replica, and nothing reaches production without a person signing it off.

  1. 1

    Survey the building

    Collectors read your virtualization platform, Kubernetes, firewalls, edge and identity every night. Disk snapshots are scanned offline; nothing is installed.

    Control plane · reads, never attacks

  2. 2

    Draw the plan

    Every asset, vulnerability, credential and network rule becomes one graph of what can reach what.

    Control plane · reads, never attacks

  3. 3

    Plan the routes

    An AI planner ranks the routes an attacker would actually take, by what they reach rather than by CVSS.

    Control plane · reads, never attacks

  4. 4

    Build the replica

    Systems on a route are cloned into an isolated network with no egress. Real secrets are swapped for canaries.

    Replica · no egress, canary secrets

  5. 5

    Walk the route

    AI agents exploit each hop in the replica. A hop counts only when the harness sees the canary fire.

    Replica · no egress, canary secrets

  6. 6

    Record everything

    Packets, process trees, file changes and every command are captured and mapped to MITRE ATT&CK.

    Replica · no egress, canary secrets

  7. 7

    Fit the fire door

    Fixes are written as reviewable playbooks, applied to the replica, and the exploit runs again. It has to fail.

    Replica · no egress, canary secrets

  8. 8

    Sign off

    You approve. Production is snapshotted, the proven fix is applied, and anything unhealthy rolls back on its own.

    Production · you approve

Every door has evidence behind it.

A hop is proven when the harness observes it, not when a model says so. Each one ships as a bundle a reviewer can check without trusting the AI.

  • Full packet capture of the detonation network, with Zeek logs.
  • Process and syscall traces from eBPF sensors in the replica.
  • Disk diff against the replica’s clean snapshot.
  • Detection rules in Sigma, compiled to Splunk SPL and Sentinel KQL, replayed against the recording until they fire.
  • A SHA-256 manifest so the bundle is tamper-evident for auditors.
Evidence bundle EB-0412Hop 2 · Web tierIllustrative
  1. attackerGET /export?file=../../srv/app/.env → 200
  2. targetapp[1190] open("/srv/app/.env")
  3. attackerssh -i deploy_key [email protected]
  4. targetsshd[2204] accepted publickey for ci
  5. harnesscanary key cnry-7f3a used · hop proven
ATT&CK
T1552.001 Credentials in files
Captured
pcap 3.1 MB · 214 process events · 0 files changed
Manifest
sha256 9c1e04…b2a07f

Detection · SigmaFires on replay

title: Config read via web path traversal
logsource: { category: webserver }
detection:
  sel:
    cs-uri-stem|endswith: '/export'
    cs-uri-query|contains: '../'
  condition: sel
INTERNETVPNPARTNER LINKSECRETSVAULTFIRE DOOR
One fire door, three proven routes broken. Illustrative.

Fit fire doors, not more alarms.

Probative ranks fixes by how many proven routes they break, so the first change you make is the one that matters most. Each fix carries its own paper trail.

  1. Proposed

    Remove the deploy key from app-web-01 and issue a short-lived token from your secrets manager.

  2. Proven

    Replica re-run: the exploit failed at hop 2 and the app health check passed.

  3. Awaiting you

    Diff, replica result and rollback plan attached for your approver.

  4. Applied

    Production snapshotted, playbook applied, rescan clean. The route closes on the plan.

  5. Rolled back

    Only if health checks fail, automatically, and the route reopens so nothing is hidden.

Nothing burns in production.

The drill runs in a replica. These rules are how Probative is built, not settings someone can forget to turn on.

  • No route to production

    Agents run on an isolated network, hold no production credentials and cannot reach your systems.

  • No egress from the replica

    Callbacks land in a recording sink. Nothing leaves the detonation network.

  • Real secrets never enter

    Keys and tokens in cloned systems are swapped for canaries before any agent connects.

  • A person approves

    Every drill and every production change waits for a named approver.

  • Every action recorded

    Agent commands, approvals and changes are logged and kept off the box.

Assembly point.

Probative is in early access. Tell us about your environment and we’ll be in touch as the first drills open, starting with what security leaders need to show their boards.

Early access for security teams. We reply personally; no newsletter.