What the bench measures
Security programmes report a control count, and a control count says nothing about whether the doors that matter are closed. The bench reports open paths to the crown jewels, how many of them cross no logged edge, and how many tables survive an attacker with the admin login. Two of the three can move without the first one moving at all, which is the whole reason to report three.
★ What you walk out with tonight. A defended graph you have scored path by path instead of asserted. The measured effect of the most popular single purchase, a perimeter firewall, which closes one of nine doors and leaves seven open and unseen. And the honest end state: one path remains, it is the insider's own legitimate read, no control can remove it without stopping the work, and it is logged.
LiveWhy the finished design has one path, not zero3 min▶
A support agent at Ironwood reads customer records to answer tickets. That is a path from a human to the crown jewels, and every prevention control either leaves it open or stops the tickets. The only defence against it being misused is that every read is recorded and somebody reads the record.
So zero is not the target. The target is that every path that remains is one the business chose to keep, and that none of them is dark. A programme that reports zero paths has either stopped the work or stopped counting insiders.
Ironwood's questionnaire answer for three years was "customer data is protected by role-based access and a firewall". The graph says that state has seven open paths and no log on any of them. Nobody had lied; nobody had counted.
Self-studyWhat is real here3 min▶
- The estate is the inventory from session 1: twelve nodes, the edges an attacker could use, and for each edge the control that closes it or the log that sees it. It is visible on the widget as the paths themselves.
- The counting is a real path enumeration over whatever graph remains after your controls, from two starting points. The warehouse-to-table edge is role-specific, so a path only counts if it arrived through a role that can actually read the table.
- Undetected means a path that crosses no logged edge. Query logging sees every path through the warehouse; it cannot see the export bucket, which never touches the warehouse.
- Recoverable is whether the admin login, if reached, can also reach the backups. Twelve tables, all or nothing, because time travel and snapshots are deleted with the account.
- Nothing is modelled. There is no human behaviour to estimate here, unlike the observability bench next door. Every number is a count.
The ladder, with the numbers it actually produces
10 min liveEvery row is computed by the bench on this page. Two rows leave the path count untouched and are the most important rows on the table.
| Controls on | Paths to crown jewels | Undetected | Recoverable tables of 12 |
|---|---|---|---|
| Nothing | 9 | 9 | 0 |
| + MFA on every human login | 6 | 6 | 0 |
| + rotate service keys, expire the old ones | 5 | 5 | 0 |
| + export bucket private | 4 | 4 | 0 |
| + pinned, verified dependencies | 3 | 3 | 0 |
| + query logging and egress alerting | 3 | 0 | 0 |
| + immutable, restore-tested backups | 3 | 0 | 12 |
| + least privilege on the analyst role | 1 | 0 | 12 |
| Perimeter firewall only | 7 | 7 | 0 |
| All prevention, no detection | 1 | 1 | 12 |
Rows six and seven are the argument for reporting three numbers. Logging changes nothing about how many ways in exist and everything about whether you would know. Immutable backups change nothing about ways in and everything about whether Monday exists. A control-count report would list both as "one more control"; a path-count report alone would show them doing nothing.
Run the ladder yourself
★ 25 min · everyone buildsThe bench is live below. Every open path is listed, start to crown jewels; hover a hop for the attacker's move, and red means nobody would see it. Work the steps in order.
Start from nothing. Nine paths, nine unseen, zero recoverable tables. Read the list: five from the internet, three from an insider, one through a bucket that never touches the warehouse.
Press "identity only". MFA and key rotation. Nine paths become five: phishing is closed for analysts and admins, the key in git history has expired. This is the cheapest three-path reduction on the board and it is almost always the right first purchase.
Add the private bucket, then pinned dependencies. Five becomes three. Notice which three remain: two insider paths and the analyst who was granted admin on a Friday. Nothing you have done so far touches an account that is supposed to exist.
Add query logging and egress alerting. The path count does not move. Unseen drops from three to zero. Every remaining path now crosses an edge somebody would read about in the morning.
Add immutable backups. Again the path count does not move. Recoverable goes from zero to twelve, because the admin login, however it was reached, can no longer delete the copy you would restore from.
Add least privilege. Three becomes one: the Friday admin grant is gone and the analyst role can no longer read customers with a broad SELECT. The path that stays is the support session, logged. That is the finished design.
Now press "nothing on" and tick "perimeter firewall only". Seven paths, seven unseen, zero recoverable. It really did close a door: a leaked key can no longer authenticate from outside. Phishing walks in through the user's own laptop, the malicious package runs inside, the bucket sits outside the perimeter altogether, and both insiders were never outside it.
Finally press "prevention, no detection". One path, unseen. Every door you could close is closed, and the one legitimate read left is dark. Write down which of the last two states your own estate is closer to.
The number missing from this bench, deliberately. Every path counts the same, so a path to a marketing extract would score like a path to national IDs. A real scoreboard weights by what the path reaches and by how many records. Add that first when you build your own; it reorders the middle rungs and rescues neither over-correction.
Closing the track
45 min- Score your own inventory file from session 1 the way the bench does: count paths, count the ones that cross no log, and answer the backup question honestly.
- For every control you already own, write down which edge it removes or logs. A control that maps to no edge is a line on a checklist and nothing else.
- Find the path in your estate that no warehouse control can see. There is nearly always an export, a share or a replica. Give it its own log.
- Rewrite the security paragraph in your customer questionnaire as three numbers. If you cannot, that is the finding.
Three questions
Query logging and egress alerting leave the path count at three. What do they change?
Detection does not remove a path. It makes using one visible, which is the only defence available for reads the business has chosen to allow.
A perimeter firewall on its own leaves seven of nine paths open. Which door did it actually close?
A phished user logs in from their own laptop inside the allowlist, a malicious package runs on your runner, the bucket sits outside the perimeter altogether, and insiders were never outside it.
Why does the finished design report one open path rather than zero?
Zero is not the target. A programme that reports zero has either stopped the work or stopped counting insiders. The target is that every remaining path is chosen and none is dark.