001 CTEM: attack paths + real detection

Which attack paths would your detection miss?

Bonanza maps who can reach your crown jewels and ranks every path by whether your own monitoring would see it. Read-only.

Talk to the founders See how it works

Deterministic engine, ranked remediation and what-if testing. Now working with design partners.

002 The problem

A path can be open and invisible at the same time.

Security teams keep two views of risk. One maps how an attacker could get in. Another tunes what the SOC detects. Almost nobody checks whether the two agree.

Red team view: attack paths

What an attacker could reach, based on network topology, identities and privileges.

Attack-path tools, penetration testing

Blue team view: detections

What is detected right now, based on logs, detection rules and incident response.

SIEM, EDR
  • Which attack paths would our SOC actually see?
  • Which paths are not defended?
  • How critical is that exposure?
Your environment as a box. The attack-path circle and the detection circle slide together, but even overlapping they leave a blind spot and a part of the environment no one checks. YOUR ENVIRONMENT ATTACK PATHS DETECTION BLIND SPOT SEEN NOISE NO ONE LOOKS HERE

Two separate views. Watch them move together, then tap any area.

003 How it works

From connection to fixed blind spots in four steps.

TopologyAttack pathsDetectionFixes
  1. 01

    Build the environment graph

    Ingest or create your on-prem, hybrid or cloud environment: users, groups, computers, permissions and trust relationships.

  2. 02

    Load detection data

    Import your real detection rules and log sources from your SIEM and EDR.

  3. 03

    Analyze every attack path

    Check each step against your detection rules and classify it, so the paths you cannot see rise to the top. No attacks are run.

  4. 04

    Fix and re-check

    See the fixes ranked by how many invisible steps each one closes: a detection rule, a log source or a permission change. Try a fix on the map first, then re-check once it is live.

004 Every step gets a state

Defended

Covered by at least one detection rule.

Partial

Some activity on this step is detected.

Invisible

No detection coverage. These rise to the top.

Dark data

Collected, but no rule uses it.

005 Remediation

Fix the few things that close the most paths.

For every invisible step, Bonanza lists the fixes that would make it seen or remove it, then ranks them by how many invisible steps each one closes across all your paths. One good fix often closes many paths at once.

+

Add a detection rule

Cover the technique behind an invisible step, so the SOC sees it.

⊞

Add a log source

Collect the log a step needs, or put dark data you already collect to work.

×

Remove a permission

Cut the access that creates the step, so the path no longer exists.

Every fix comes with its reason: the step it closes and the paths it affects. Try any of them as a what-if first.

006 What if

Test the change before you make it.

Pick a planned change. Bonanza adds it to a copy of your graph, finds the new attack paths it opens, and re-ranks everything by whether your detection would see them. Nothing changes in production.

1Pick a change 2

Hover or tap any node or hop to see the math behind it.

Paths to the crown jewel, ranked

    Rank order: worst hop first, then more unseen hops, then shorter path. Same input, same ranking.

    Illustrative example, not customer data.

    007 Under the hood

    A deterministic engine. Answers you can prove.

    Bonanza's deterministic engine runs graph algorithms over your real permissions and detection rules. Every verdict traces back to a specific rule, log source or permission, so your SOC can verify it, your auditor can check it and your board can act on it. No probabilities, no black box.

    =

    Deterministic

    Same input, same result. Run it twice and you get the same paths in the same order.

    0%

    No probability

    A step is covered by a rule or it is not. Nothing is estimated or sampled.

    →

    Traceable

    Every path is shown step by step, with the rule that sees it or the gap that hides it.

    008 What Bonanza models

    Your whole environment, on one map.

    • Users, groups and identities
    • Computers, servers and cloud resources
    • Domains, containers and trust relationships
    • Permissions, access paths and sessions
    • Entry points and high-value assets
    • Certificates and certificate authorities
    • Network devices and firewalls
    Environment topologyUsers, systems, relationships
    Attack pathsAll possible paths to critical assets
    Detection coverageDefended, partial, invisible

    009 Data and trust

    Read-only. By design.

    The first question security teams ask is a fair one: why should we trust a new tool with our detection rules? These are our answers today, stated plainly.

    What it does with your data

    • Read-only. Bonanza retrieves; it does not change, delete or write to your systems.
    • Runs in your environment. No data leaves your network.

    Where we are today

    • A working demo with a results scoreboard; click an incident to open its attack path.
    • Works with common SIEM and detection-rule formats. Ask us about yours.
    • Working with a small number of design partners.

    010 Who is behind it

    Two founders, one problem.

    Rona Oran, PhD

    Co-founder, product and algorithms

    Algorithms and data science; computational science and space physics. Computational scientist at MIT; worked on NASA science missions.

    Tal Poremba

    Co-founder, product and go-to-market

    Cybersecurity and product leadership, enterprise solutions, customer experience and partnership relations.

    011 Design partners

    Help us test Bonanza on a real environment.

    We are looking for a small group of security teams. It is free during the pilot.

    • You connect a read-only source; we show you the blind paths we find.
    • Your feedback shapes what we build next.
    • A short conversation first, no obligation.

    Opens your email app with a message to the founders. We use what you send only to reply to you.

    012 FAQ

    Straight answers.

    How it works

    What exactly does Bonanza do?
    It builds one view of your environment, its attack paths and your detection coverage, then ranks each path by whether your own detection would see it. The paths you cannot see come first.
    What do Defended, Partially defended, Invisible and Dark data mean?
    Defended: at least one detection rule covers the step. Partially defended: some activity is detected. Invisible: no detection coverage. Dark data: the data is collected but no rule uses it.
    How does the engine reach its results?
    Bonanza runs a deterministic engine: graph algorithms over your real permissions and detection rules. There is no probability in the results, so the same environment always gives the same answer, and every path, fix and what-if result can be traced step by step.
    Does Bonanza tell us how to fix what it finds?
    Yes. For each invisible step it lists the fixes that would close it: add a detection rule, add a log source, or remove the permission that creates the step. Fixes are ranked by how many invisible steps each one closes across all your paths, so you start with the few changes that matter most. Each fix shows the step it closes and the paths it affects.
    Can I see why a path was ranked the way it was?
    Yes. Open an incident to see the path step by step and which steps your detection would or would not catch.
    Can I test a change before I make it, like a what-if simulation?
    Yes. Bonanza's what-if simulator is one of its unique features. It gives your teams the power to test a change to your security rules before you make it and see how it changes your detection coverage across every attack path, all in one holistic view. It works for environment changes too, like a new group member, a new permission or a new deployment, and for any suggested fix: try it as a what-if, see which paths it closes, then make the change in production.

    Data and access

    Is it read-only?
    Yes. Bonanza retrieves permissions and configuration. It does not change, delete or write to your systems.
    Does it send our data, or our detection rules, to anyone?
    No. Bonanza runs inside your environment and no data leaves your network.
    How do we know the tool itself is not a risk?
    It only needs read access, so a compromise of the tool would not let anyone change your systems. We answer security reviews directly with each design partner.

    Deployment

    Is it agentless, and how fast to a first result?
    Nothing is installed on your endpoints. We will give you an honest time to first map for your environment when we talk.
    Is it SaaS, in our cloud, or on-prem?
    It runs inside your environment. Tell us your deployment needs and we will walk through them with you.

    Time, money and your team

    How does Bonanza save my team time?
    Today, checking whether a SOC would catch a given attack path means pulling attack-path output, reading detection rules one by one and matching them by hand. Bonanza does that cross-check for every path at once and hands you a ranked list, so analysts start with the invisible paths instead of building the picture first.
    How does it save money?
    It shows where security spend actually closes risk. You see which single rule, log source or permission fix would close the most invisible paths, so you fix those first. It also flags dark data: logs you already pay to collect and store that no detection rule uses, so you can put them to work or stop paying for them.
    What changes day to day for the SOC and the CISO?
    The SOC and the CISO work from one vertical view of your network, top to bottom: the whole company, each department, every attack path and the detection that covers it. The CISO sees every department's score in one view. The security research team saves money with simulation: they test planned changes as what-ifs on a model of your network, so paid pen tests go only where they are needed.

    Pricing

    How is it priced? Is there a pilot?
    The design-partner pilot is free. Pricing after the pilot is set with each partner.

    Who is behind it

    Who are you, and who backs you?
    Two founders, introduced above. We are working with a small number of design partners.

    Compared with others

    How is this different from attack-path and exposure tools I already use?
    Those tools show how an attacker could move. Bonanza asks a different question: for each path, would your own detection actually see it? It is meant to sit alongside them.
    Where does Bonanza fit in our exposure management (CTEM) program?
    It is the detection view of your exposure program. For every path your exposure tools find, Bonanza checks whether your own detection would see each step, then ranks the paths and the fixes. That gives the prioritization and validation stages of CTEM a list your SOC can act on.
    We already run attack simulation (BAS). Why add Bonanza?
    Keep it. Simulation proves whether the attacks you chose to run were caught, from the places your simulators sit. Bonanza covers every step of every path to your crown jewels and shows which ones your detection would miss, without running any attack. Use them together: Bonanza finds the invisible steps, and your simulation confirms the top ones.