C2M2 — Cybersecurity Capability Maturity Model v2.1

Enumerates every reachable host and service from the attacker perspective — often surfacing assets the inventory doesn't track.

Infers which assets carry the most business risk and prioritises attack paths to them — supporting input to the documented asset-prioritisation criteria this practice asks you to define and apply.

First AI to solve GOAD in 14 minutes (Horizon3-reported); audits password strength and reuse on privileged, service, and break-glass accounts — it is not uncommon for NodeZero to crack more than 50% of the passwords it tests on a first audit.

Takes a phished credential and demonstrates its blast radius — what an attacker reaches when a single factor is enough — surfacing higher-risk access where a stronger or multifactor credential is not actually required.

Proves end-to-end paths from initial access to domain compromise — evidence of whether least-privilege is actually enforced.

Built-in attack-graph visualisation — surfaces the higher-risk, over-privileged relationships ACCESS-2g (MIL2) requires extra scrutiny on.

Extends privileged-credential validation into cloud IAM and tests whether those credentials are tightly scoped across on-prem and cloud.

Returns proof of which vulnerabilities are actually exploitable in your environment — vulnerability information interpreted for the function, not theoretical CVSS lists.

Rapid Response tests are delivered often within hours of disclosure, and in some cases ahead of the public patch — attacker-first assessment inside the detection window.

Ingests existing scanner exports and classifies each CVE-asset pair as Confirmed Exploitable, Contextually Exploitable, or Threat Actor Pressure — attacker-first prioritisation of the scanner backlog.

Maps your real attack paths to MITRE ATT&CK and named threat-actor behaviour — produces environment-specific threat intelligence alongside external sources.

Findings flow to Jira and ServiceNow through existing integrations, tracked through an Open → Mitigated → Regressed lifecycle, with Quick Verify to confirm a mitigation actually held.

Concentrates discovery and exploitation effort on the assets that carry the most business risk — vulnerability information that explicitly addresses the higher-priority subset.

Re-tests the exact attack chain after a remediation is applied and reports whether the action actually closed the vulnerability — direct effectiveness review built into the workflow.

Honeytoken decoys on high-risk assets alert the moment an attacker interacts — routed via Splunk, Sentinel, or webhook into the same monitoring programme SITUATION-2 expects.

Every NodeZero action is timestamped with proofs and commands — correlate with your SIEM to validate whether your defined indicators actually fire.

Per-host and per-vendor EDR block/allow data mapped to MITRE ATT&CK — concrete effectiveness metrics for the monitoring layer.

Proves whether a supplier-side compromise would be contained at the interconnect or cascade into your critical assets — direct evidence that the controls protecting against third-party risk actually hold.

Where a supplier credential or interconnect can be tested, proves how far that access reaches into your environment — one input to your supplier risk assessment, not the assessment itself.

Discovery + High-Value Targeting flag third-party connections that carry privileged reach into critical assets — direct evidence of which suppliers warrant the escalated-prioritisation tier.

Enumerates IPs, ports, services, and applications across the network to prove whether the security-zone boundaries hold the way the architecture says they should.

Proves end-to-end attack paths that cross architectural boundaries — evidence that the boundary-enforcement controls are not holding in practice. Whether a cybersecurity architecture is documented and maintained remains governance work.

Hybrid architectures are where pentesters find the most gaps; cloud pentesting tests privilege-escalation paths between on-prem and AWS/Azure/K8s boundaries.

Attack-graph visualisation surfaces every over-privileged user and service account — the gap between policy and practice that ARCHITECTURE-3c (MIL2) requires you to close.

Reports per-host EDR and host-firewall block/allow outcomes across 40+ vendors — direct evidence of which assets actually have the required security applications enforced.

Runs the penetration-testing element of this practice against in-house-developed and in-house-tailored applications — OWASP Top 10 weaknesses, access-control failures and business-logic flaws, in pre-production and production, on a periodic or change-triggered cadence. Static, dynamic-code and fuzz testing remain separate activities.

Exercises internet-facing applications and services from the attacker's perspective, on a continuous cadence and after changes — the perimeter half of the security testing this domain expects, alongside the application-layer testing above.