001 FAQ
How it works
What exactly does Bonanza do?
It builds one view of your environment, its attack paths and your detection coverage, then ranks each path by whether your own detection would see it. The paths you cannot see come first.
What do Defended, Blind spot, Invisible, Dark data and Too noisy mean?
Defended: at least one detection rule covers the step. Blind spot: a rule exists but the log it needs has not arrived. Invisible: no rule and no log. Dark data: the log arrives but no rule is turned on. Too noisy: the rule fires so often that the alert gets ignored.
How does the engine reach its results?
Bonanza runs a deterministic engine: graph algorithms over your real permissions and detection rules. There is no probability in the results, so the same environment always gives the same answer, and every path, fix and what-if result can be traced step by step.
Does Bonanza tell us how to fix what it finds?
Yes. For each invisible step it lists the fixes that would close it: add a detection rule, add a log source, or remove the permission that creates the step. Fixes are ranked by how many invisible steps each one closes across all your paths, so you start with the few changes that matter most. Each fix shows the step it closes and the paths it affects.
Can I see why a path was ranked the way it was?
Yes. Open an incident to see the path step by step and which steps your detection would or would not catch.
Can I test a change before I make it, like a what-if simulation?
Yes. Bonanza's what-if simulator is one of its unique features. It gives your teams the power to test a change to your security rules before you make it and see how it changes your detection coverage across every attack path, all in one holistic view. It works for environment changes too, like a new group member, a new permission or a new deployment, and for any suggested fix: try it as a what-if, see which paths it closes, then make the change in production.
Data and access
Is it read-only?
Yes. Bonanza retrieves permissions and configuration. It does not change, delete or write to your systems.
Does it send our data, or our detection rules, to anyone?
No. Bonanza runs inside your environment and no data leaves your network.
How do we know the tool itself is not a risk?
It only needs read access, so a compromise of the tool would not let anyone change your systems. We answer security reviews directly with each design partner.
Deployment
Is it agentless, and how fast to a first result?
Nothing is installed on your endpoints. We will give you an honest time to first map for your environment when we talk.
Is it SaaS, in our cloud, or on-prem?
It runs inside your environment. Tell us your deployment needs and we will walk through them with you.
Time, money and your team
How does Bonanza save my team time?
Today, checking whether a SOC would catch a given attack path means pulling attack-path output, reading detection rules one by one and matching them by hand. Bonanza does that cross-check for every path at once and hands you a ranked list, so analysts start with the invisible paths instead of building the picture first.
How does it save money?
It shows where security spend actually closes risk. You see which single rule, log source or permission fix would close the most invisible paths, so you fix those first. It also flags dark data: logs you already pay to collect and store that no detection rule uses, so you can put them to work or stop paying for them.
What changes day to day for the SOC and the CISO?
The SOC and the CISO work from one vertical view of your network, top to bottom: the whole company, each department, every attack path and the detection that covers it. The CISO sees every department's score in one view. The security research team saves money with simulation: they test planned changes as what-ifs on a model of your network, so paid pen tests go only where they are needed.
Pricing
How is it priced? Is there a pilot?
The design-partner pilot is free. Pricing after the pilot is set with each partner.
Who is behind it
Who are you, and who backs you?
Two founders, introduced above. We are working with a small number of design partners.
Compared with others
How is this different from attack-path and exposure tools I already use?
Those tools show how an attacker could move. Bonanza asks a different question: for each path, would your own detection actually see it? It is meant to sit alongside them.
Where does Bonanza fit in our exposure management (CTEM) program?
It is the detection view of your exposure program. For every path your exposure tools find, Bonanza checks whether your own detection would see each step, then ranks the paths and the fixes. That gives the prioritization and validation stages of CTEM a list your SOC can act on.
We already use an AI security platform. Why add Bonanza?
Keep it. AI platforms score how risky a path or signal is. Bonanza answers a narrower question with a deterministic engine: for every step of every path to your crown jewels, would your own detection see it, and which single fix closes the most invisible steps.
We already run attack simulation (BAS). Why add Bonanza?
Keep it. Simulation proves whether the attacks you chose to run were caught, from the places your simulators sit. Bonanza covers every step of every path to your crown jewels and shows which ones your detection would miss, without running any attack. Use them together: Bonanza finds the invisible steps, and your simulation confirms the top ones.