SAMPLE · illustrative & redacted · not a real engagement · every figure below is fictional
01What an attacker reached
Starting from a single internet-facing exposure, the red engine chained four steps across the twin to reach the crown jewel. Every step was executed against a digital twin — never the live estate.
- STEP 1 · RCEFoothold on an exposed AI-orchestration serviceKnown CVE, reachable from the DMZ — remote code execution as the service account.
- STEP 2 · LOOTRecovered cached service credentialsCredentials to the internal application tier, found on the compromised host.
- STEP 3 · PIVOTMoved east-west across the app segmentA path the perimeter and signature tooling are structurally blind to.
- STEP 4 · REACHRead access to the payments databaseReached the crown jewel and confirmed reachability with a planted marker.
Crown jewel reached
Payments database — 2.4 million cardholder records reachable (marker exfiltrated)
02How reachability was proven — two independent witnesses
No model judged success. Two deterministic, un-fakeable witnesses fired together: the target marker was exfiltrated, and the firewall's own hit-counter on the out-of-scope path moved.
● Before — path open
Firewall ACL hit-counter0 → 5
Planted marker (honeytoken)exfiltrated
Records reachable2,400,000
✔ After fix — path closed
Firewall ACL hit-counter0 (blocked)
Planted marker (honeytoken)never leaves
Records reachable0
03The fix, and the re-proof
Containment applied a firewall deny rule on the out-of-scope segment path and patched the exposed service. The exact same attack was then re-run: the pivot no longer crossed the firewall (counter stayed at 0), the marker never exfiltrated, and the payments database was unreachable. Closure is verified, not assumed.
04Executive attestation
On 17 Apr 2026, an attacker path from an internet-facing service to the payments database was demonstrated on an air-gapped twin of the Meridian Bank payments environment. A containment fix was applied and the identical attack re-run and proven to fail. Residual risk on this path: closed. This record is cryptographically signed and independently verifiable.
05Signature — verify it yourself
This dossier is hash-chained and Ed25519-signed at generation time, on your own hardware. Anyone can verify it with the public key alone — no trust in vExpertAI required. Alter a single character and verification fails.
algorithm Ed25519
content sha256:9f2c…a71e (illustrative)
previous sha256:41b0…c88d (illustrative)
public_key ed25519:MCowBQYDK2Vw…AKq3 (illustrative)
signature sig:7d3e…f0a9 (illustrative — sample document, not a live signature)
verify $ vx-verify por-2026-0417.json --pubkey meridian.pub