CitadelX
Know your attack surface. Understand the attack. Respond with intelligence.
CitadelX connects exposure, threats, vulnerabilities, telemetry, attack paths, detection, investigation and DFIR into one cyber-defence intelligence operating model.
11
Source-defined capability modules
7
Connected defence stages
6
Core evidence families
1
Defence-to-assurance loop
Cyber defence breaks when every team sees a different fragment.
External exposure, vulnerability queues, threat feeds, SOC alerts, and incident evidence live in disconnected tools.
Before — Fragmented operating model
- External assets, ownership and business criticality are split across tools.
- Vulnerability queues default to severity without complete exposure, exploitability or control context.
- Threat intelligence is consumed as feeds and reports instead of being tied to the environment.
- SOC alerts are reviewed as events, while attack relationships are reconstructed later.
- Incident evidence is fragmented across endpoint, identity, cloud, network, email and applications.
With CitadelX
- External exposure is enriched with ownership, technology, criticality, vulnerability, identity, data and control context.
- Prioritization combines severity with exposure, exploitability, threat activity, asset impact and compensating controls.
- Threat intelligence is correlated to assets, vulnerabilities, detections and incidents.
- Detections become connected cases with entities, timelines, evidence and MITRE ATT&CK context.
- IR and DFIR preserve evidence and reconstruct the incident as a connected, time-aware model.
Five Questions CitadelX Is Designed To Answer.
1. What can an attacker see?
Discover domains, subdomains, IPs, certificates, ports, services, technologies, cloud exposure and external applications; validate ownership and monitor change.
2. Which weaknesses matter first?
Prioritize vulnerabilities using exposure, exploitability, asset criticality, threat activity, identity privilege and compensating controls—not severity alone.
3. What threat activity is relevant to us?
Normalize strategic, operational, tactical and technical intelligence, then connect IOCs, TTPs, actors, campaigns and malware to your own environment.
4. Are we seeing an alert—or an attack?
Correlate telemetry into incidents with entity context, risk context, case management, detection engineering and MITRE ATT&CK mapping.
5. Can we reconstruct and prove what happened?
Coordinate incident response and DFIR across endpoint, identity, network, cloud, email, applications, databases and containers to produce an evidence-backed timeline and root-cause narrative.
Seven Stages. One Continuous Defence Loop.
From visibility to learning, each stage preserves context for the next so security teams do not have to rebuild the attack story manually.
Discover and enrich externally exposed assets.
Discover domains, subdomains, IPs, certificates, ports, services, technologies, cloud exposure and external applications with ownership and criticality context.
Built For The Teams That Carry The Responsibility
Six key stakeholders. Six completely connected experiences. One platform.
CISO
A connected view of exposure, threat, detection, incident evidence and security improvement.
SOC / MDR Leader
Richer triage context with entities, risk, ATT&CK techniques, evidence and case timelines.
Security Engineer
Prioritized exposure and vulnerability work based on credible attack paths and remediation context.
Threat Intelligence / Hunting
Operationalize threat intelligence against internal assets and telemetry; convert findings into detections.
Incident Response / DFIR
Preserve evidence, coordinate containment and reconstruct incidents across technical domains.
CIO / Technology Leadership
Connect cyber-defence activity to business-critical assets, ownership, resilience and remediation priorities.
Every Workflow Should Leave Behind Something Provable.
Six core provable evidence families automatically generated.
The Next Step Should Demonstrate The Operating Model—Not Only The Interface.
Your environment. Your assets. Your cyber defence—demonstrated live.
CitadelX Demo
Walk through exposure → threat → detection → investigation → reconstruction → response using representative assets and telemetry.
Attack Surface Discussion
Scope externally exposed assets, ownership, criticality, vulnerability and threat context to bring together first.
IR / DFIR Discussion
Review evidence sources, investigation workflows and the target incident digital twin.