GlassCastle Security banner

SECURITY THROUGH VISIBILITY

MAKE THE SYSTEM
VISIBLE ENOUGH
TO DEFEND.

GlassCastle Security builds evidence-first security, connectivity, edge, and analytical systems. We separate observation from interpretation, expose uncertainty, and prefer reproducible evidence over opaque conclusions.

EXPLORE THE CASTLE →EVALUATE SEC-TP

01 // OPERATING MODEL

ONE HUMAN. MULTIPLE AI DEPARTMENTS. ONE ACCOUNTABILITY LINE.

GlassCastle Security uses specialized AI departments to research, build, protect, teach, communicate, and operate. The human Founder/Owner remains the accountable company authority for consequential decisions.

OPERATING CADENCE

10 DEPARTMENTS

10 recurring tasks. One per department, every 2 hours, with starts staggered 12 minutes apart. Cycles begin on even hours in America/New_York (Eastern time).

AUTHORITY

CAPABILITY ≠ PERMISSION

Schedules, credentials, tools, and Slack messages do not create authority. Delegated AI action stays inside explicit, reversible boundaries.

SEPARATION OF DUTIES

CREATE ≠ REVIEW ≠ APPROVE

Builders do not silently self-approve releases, finance analysis does not move money, and proposals do not become contracts by automation.

PUBLIC GOVERNANCE

INSPECT THE MODEL

See the department map, human approval boundary, organizational domains, and transparency rules.

READ OPERATING MODEL →
OBSERVATION→EVIDENCE→MEANING→BOUNDARY→ACTION

02 // SHATTEREDCASTLE(S) SECURITY FABRIC

SCOPE. DISCOVER. ASSESS. VALIDATE. IMPACT. REMEDIATE.

ShatteredCastle(s) is the umbrella security suite. The six stages govern defensive research; the UKC lens below models attacker paths separately.

SCOPE

SCOPESENTINEL

Compile program rules, structured scope, exclusions, rate limits, and ambiguities into a fail-closed execution contract.

 DISCOVER

KORK

Pin artifacts, map relationships, preserve provenance, and build an inspectable investigation topology.

 ASSESS

SHATTERASSAY

Bounded outside-in assessment and static research under explicit scope, evidence, and claim boundaries.

 VALIDATE

GLASSWITNESS

Turn controlled baselines, confirmations, negative controls, and evidence hashes into deterministic validation receipts.

 IMPACT

BLASTRADIAL

Model downstream propagation and identify the relationship paths carrying the greatest consequence.

 CONTROL

INVESTIGATION CONSOLE

Bring evidence, findings, impact, claims, and remediation into one local-first investigation surface.

02A // TACTICAL PROGRESSION

UNIFIED KILL CHAIN · POLS 2017

A progression lens for locating activity across an intrusion without pretending every intrusion follows one rigid path.

ANSWERSWHERE IS THE ACTIVITY IN THE PROGRESSION?
DOES NOT PROVETHAT PHASES MUST OCCUR IN ORDER
01–08INITIAL FOOTHOLD
ReconWeaponizationDeliverySocial EngineeringExploitationPersistenceDefense EvasionC2
09PIVOT / CHOKE POINT
Pivoting
10–14NETWORK PROPAGATION
DiscoveryPrivilege EscalationExecutionCredential AccessLateral Movement
15–18ACTION ON OBJECTIVES
CollectionExfiltrationTarget ManipulationObjectives

Phases may repeat, branch, be bypassed, or be revisited. Pivoting stays visible as a choke point.

INSPECT MODEL →MODEL AUDIT

02B // INTRUSION RELATIONSHIPS

DIAMOND MODEL OF INTRUSION ANALYSIS

An event-centric relationship lens connecting Adversary, Infrastructure, Capability, and Victim while keeping missing features visible.

ANSWERSHOW ARE THE CORE INTRUSION ELEMENTS RELATED?
DOES NOT PROVEATTRIBUTION OR CAUSALITY FROM OVERLAP
WHOADVERSARY
WHEREINFRASTRUCTURE
HOWCAPABILITY
AGAINSTVICTIM
EVENTtime · phase · result
EXTENDED AXISSOCIAL-POLITICAL

Intent, needs, persistence, and victimology.

EXTENDED AXISTECHNOLOGY

Protocols, platforms, and enabling mechanisms.

ANALYTIC STATEUNKNOWN = KNOWLEDGE GAP

A possible pivot remains a lead until evidence supports it.

INSPECT MODEL →MODEL AUDIT

02C // ADVERSARY REPLACEMENT BURDEN

PYRAMID OF PAIN · BIANCO 2014

An ordinal lens for how costly an explicitly typed detection indicator is for an adversary to replace or change.

ANSWERSWHICH INDICATORS ARE HARDER FOR THE ADVERSARY TO CHANGE?
DOES NOT PROVESEVERITY, ATTRIBUTION, OR A DOLLAR COST
06 · HIGHEST BURDENTACTICS, TECHNIQUES & PROCEDURES
05TOOLS
04 · SHARED TIERNETWORK + HOST ARTIFACTS
03DOMAIN NAMES
02IP ADDRESSES
01 · LOWEST BURDENHASH VALUES

The rank is ordinal. Explicit UKC and Diamond bindings add context but never change the Pyramid tier.

INSPECT MODEL →MODEL AUDIT

02D // ADVERSARY BEHAVIOR

MITRE ATT&CK® · v19.2

The explicit behavior taxonomy: tactics describe why, techniques describe how, and sub-techniques describe lower-level behavior.

ANSWERSWHAT ADVERSARY BEHAVIOR IS BEING REPRESENTED?
DOES NOT PROVEACTOR IDENTITY, OCCURRENCE, OR SEVERITY
ENTERPRISE15 / 222 / 475tactics · techniques · sub-techniquesMOBILE12 / 77 / 47tactics · techniques · sub-techniquesICS12 / 79 / 18tactics · techniques · sub-techniques
RECONNAISSANCERESOURCE DEVELOPMENTINITIAL ACCESSEXECUTIONPERSISTENCEPRIVILEGE ESCALATIONSTEALTHDEFENSE IMPAIRMENTCREDENTIAL ACCESSDISCOVERYLATERAL MOVEMENTCOLLECTIONCOMMAND & CONTROLEXFILTRATIONIMPACT

Exact IDs or exact catalog names only. Free text, scanner output, topology labels, and telemetry are not silently classified.

INSPECT MODEL →MODEL AUDIT

© 2026 The MITRE Corporation. Used with permission. MITRE does not endorse GlassCastle Security or ShatteredCastle(s).

02E // DEFENSIVE TECHNIQUES

MITRE D3FEND™ · ONTOLOGY 1.6.0

A defensive countermeasure knowledge graph. Its ATT&CK relationships are candidates for analysis, not automatic prescriptions.

ANSWERSWHAT DEFENSIVE TECHNIQUES RELATE TO EXPLICIT BEHAVIOR?
DOES NOT PROVETHAT A CONTROL IS DEPLOYED OR EFFECTIVE
TECHNIQUES271TOP-LEVEL FAMILIES30DEFENSIVE TACTICS7INFERRED PAIRS4,133
MODEL→HARDEN→DETECT→ISOLATE→DECEIVE→EVICT→RESTORE
01 · ATT&CK v19.2EXPLICIT BEHAVIOR
→
02 · D3FEND 1.6.0INFERRED CANDIDATES
→
03 · SHATTEREDCASTLEEXPLICIT SELECTION

D3FEND’s mapping substrate uses ATT&CK v19.0. ShatteredCastle joins by exact current ATT&CK ID and leaves missing mappings unknown.

INSPECT MODEL →MODEL AUDIT

© 2025 The MITRE Corporation. MITRE D3FEND™ is used subject to MITRE's Terms of Use. No MITRE endorsement is implied.

02F // DETECTION MATURITY

DETECTION MATURITY LEVEL · STILLIONS 2014

A maturity lens for the semantic level a detection can actually demonstrate inside an explicit scope.

ANSWERSAT WHAT LEVEL CAN THIS DETECTION DEMONSTRATE CAPABILITY?
DOES NOT PROVELOWER-LEVEL COVERAGE OR ORG-WIDE MATURITY
DML-8 → DML-7INTENTWhat they want
DML-8GOALS
DML-7STRATEGY
DML-6 → DML-3BEHAVIORHow they operate
DML-6TACTICS
DML-5TECHNIQUES
DML-4PROCEDURES
DML-3TOOLS
DML-2 → DML-1OBSERVABLESEvidence left behind
DML-2HOST + NETWORK ARTIFACTS
DML-1ATOMIC INDICATORS
DML-0NONE / UNKNOWNExplicit state, never a parser default.
EVIDENCE GATEPRESENT ≠ DEMONSTRATED
STATUSVALIDATED / DEPLOYED+01CONSUME+02DETECT+03ACT=IN SCOPEDEMONSTRATED

ATT&CK and Pyramid may suggest candidate levels. Only explicit evidence demonstrates one, and demonstrated levels are non-cumulative.

INSPECT MODEL →MODEL AUDIT

03 // BUG BOUNTY OPERATIONS

SCOPE. DISCOVER. ASSESS. VALIDATE. IMPACT. REPORT.

HUNT / DISCOVER

BOUNTY CASEWORK

Compile the program boundary in ScopeSentinel, map hypotheses and evidence in Kork, assess the fracture in ShatterAssay, validate the proof in GlassWitness, then model consequence in BlastRadial.
CASE CONTRACT

ONE CASE ID

glasscastles.bounty.case.v2 preserves program, scope, confidence, evidence, status, and next action across the suite.

AUTHORIZATION

SCOPE FIRST

The bounty layer requires an explicit authorized / in-scope state. Public bounty rules and owned labs define the testing boundary.

DOCTRINE

BLEED OR DIE

Reproduce it, strengthen it, or retire it. Scanner output is not exploitation and dead hypotheses do not become reports.

04 // BUILD + EVALUATE

TOOLS WITH BOUNDARIES.

SECURE CONNECTIVITY

SEC-TP v0.6.0rc1

Capability-scoped secure tunnel research with default-deny policy, bounded sessions, auditable actions, TCP/QUIC carriers, and 162-test RC1 packaging gate.

CONTROLLED EVALUATION → WEB3 EVIDENCE

LAUNCH READINESS

Non-destructive, outside-in evidence snapshots for public launch surfaces. Reproducible observations instead of “looks good.”

VIEW OFFER → ECONOMY

GLASSCASTLE(S) MINING CO.

Measured, budgeted conversion of genuinely idle resources into useful output without allowing the mine to own the machine.

ENTER THE MINE →

05 // SECURITY KITS PILOT

EVIDENCE-FIRST KITS. PRICING UNDER VALIDATION.

VALIDATION / DIGITAL KIT

WALLET INVESTIGATION STARTER KIT

Public-chain investigation intake, transaction and counterparty ledgers, claim-confidence discipline, findings structure, and a fictional worked case.

REQUEST PILOT ACCESS → VALIDATION / DIGITAL KIT

WEB3 SECURITY INCIDENT TRIAGE PACK

Incident intake, evidence register, wallet review, counterparty mapping, confidence tracking, findings reporting, and analyst handoff.

REQUEST PILOT ACCESS →
COMMERCIAL BOUNDARY

PILOT STATUS

Package integrity and listing metadata are verified. Pricing remains under validation. No payment is accepted from this page; buyer interest is measured separately from publication.

OBSERVE BEFORE SCALING.

06 // OPERATING PRINCIPLES

THE CASTLE DOES NOT ASK YOU TO TRUST THE FOG.

EVIDENCE BEFORE ASSERTION.

Claims should be traceable to observations and provenance.

LATEST ≠ CANONICAL.

Recency does not silently replace authority or source of truth.

UNKNOWN ≠ FALSE.

Missing evidence remains uncertainty, not a convenient negative.

BOUNDARIES STAY VISIBLE.

Experimental, inferred, privileged, and human-authority edges are stated explicitly.

GLASSCASTLE SECURITY

A MORE VISIBLE SYSTEM IS A MORE DEFENSIBLE SYSTEM.

INSPECT THE WORK →START WITH EVIDENCE