Configuration & architecture review · from the exports you already have
Upload your firewall, identity and cloud exports. CyberTwin reviews the settings in every file against 1,913 checks, maps the attack paths to your crown jewels, picks the one change that cuts the most, and shows what doing nothing could cost, as a dollar range.
Or Try it on a FortiGate config
No agents. Nothing connects to your network.
The product
Reads exports from supported inputs, not customers
One upload, start to finish
Seven chapters, one sample company. Every frame is the real product.
01 · Upload
Firewall configs, identity exports, cloud posture and OT inventories, sent from your side of the wall. No agent to install, no credentials to hand over. Secrets are redacted before storage.
For the engineer
02 · Every finding graded
Each risk shows its evidence grade and takes an owner and a due date, so you see at a glance what was read from your files and what was modeled. On a FortiGate export, each finding cites the lines it was read from.
For the engineer
03 · Paths to the crown jewels
One graph across your firewall, identity and cloud configs, built from the 14 security tools we support for paths. Each route runs from an entry point to a crown jewel, hop by hop, with the setting that opens each hop.
For the engineer
04 · The one change
Not a long list. The single change that breaks the most paths to your crown jewels: the setting it comes from, the fix, and who should own it.
For the engineer
05 · What it is worth
A dollar range your CFO can question, with every input shown. Never a single number, and never a zero that reads as safe.
$314K – $3.0M /yrrange · MODELEDSample data · fictional company
For the engineer
06 · Frameworks & register
Your score across 24 frameworks with per-control provenance — each one labeled proven, observed or modeled. Each risk sits in one register with an owner and a deadline, ready for the board, the auditor and the insurer.
For the engineer
07 · Next upload closes it
A finding closes only when a later upload shows the fix, never on a checkbox. Each quarter shows what moved between snapshots: what was fixed, what regressed, what is new.
For the engineer
Two readers, one report
For the CISO and the board
For the engineer
Also in the review
From the exports you already have to the one change that cuts the most, drawn by hand on a synthetic sample estate. Captions on; it stops at the end.
Your trust zones, the paths an attacker could take across them and the order to fix them, read from the configs you upload.
Three priced stacks for a company like yours, the architecture they form, and a deployment plan product by product. Designs and prices are labeled modeled.
Paste an agent’s manifest and grants before you approve them: the routes its scopes open to your crown jewels and the one scope to strip.
A CVE is trending. Breach Replay checks whether it reaches your crown jewels through the configs you uploaded, and which controls shut it down.
An upgrade roadmap: what to add, replace or switch on next, with costs and lead times, each pick labeled modeled.
OT inventories go in the same upload as the rest of your stack, and NCA OTCC is among the 24 frameworks mapped.
A supplier is breached. Declare the access it holds and see what that reaches inside you: the routes, the range and the one cut.
Each service account treated as a foothold: what it reaches, the range at stake and the one cut that stops it. No secret material read.
How every number is labeled
Your board, your auditor and your engineers read the same label on every finding, path and dollar figure. Read the methodology
Only for FortiGate, PAN-OS and OPNsense configs, whose bytes re-parse into a check anyone can re-run.
Read from any other export you upload: identity, cloud, endpoint, SaaS.
Your intake answers and your crown jewels, kept apart from what the files show.
Paths and money the files cannot show directly. Money is always a range.
Money is always a range marked range · MODELED, and “not priced yet” is never shown as a zero. Zero paths found holds only within the configs you uploaded, nothing wider. A finding closes only on a later upload.
See a finished review on the sample company. Then upload your own exports.