Adversary ↔ Victim needs, intent, persistence, and victimology. Never inferred from technical overlap alone.
SECURITY THROUGH VISIBILITY · KNOWLEDGE THROUGH UNDERSTANDING
MAKE THE SYSTEM
VISIBLE ENOUGH
TO DEFEND.
GlassCastle(S) is a Security and Education Company. We build evidence-first security systems and learning experiences that make complex environments visible enough to inspect, understand, defend, and teach.
STATEINITIALIZING
INDEXED SURFACES--
MODEPUBLIC // EVIDENCE-FIRST
LOCAL CLOCK--:--:--
01 // SHATTEREDCASTLE(S) SECURITY FABRIC
SCOPE. DISCOVER. ASSESS. VALIDATE. IMPACT. REMEDIATE.
ShatteredCastle(s) is the umbrella security suite. The six stages govern defensive research; the UKC lens below models attacker paths separately.
SCOPE
SCOPESENTINEL
Compile program rules, structured scope, exclusions, rate limits, and ambiguities into a fail-closed execution contract.
DISCOVERKORK
Pin artifacts, map relationships, preserve provenance, and build an inspectable investigation topology.
ASSESSSHATTERASSAY
Bounded outside-in assessment and static research under explicit scope, evidence, and claim boundaries.
VALIDATEGLASSWITNESS
Turn controlled baselines, confirmations, negative controls, and evidence hashes into deterministic validation receipts.
IMPACTBLASTRADIAL
Model downstream propagation and identify the relationship paths carrying the greatest consequence.
CONTROLINVESTIGATION CONSOLE
Bring evidence, findings, impact, claims, and remediation into one local-first investigation surface.
02 // CASTLE FABRIC
THE CASTLE IS A SYSTEM, NOT A CATALOG.
Towers exchange typed artifacts through explicit handoffs. Provenance, confidence, integrity, and scope travel with the artifact. Authority does not.
FABRICINITIALIZING
ARTIFACT TYPES--
HANDOFF EDGES--
PRODUCT CONTRACTS--
01 // SCOPEGATEHOUSEscope-contract02 // DISCOVEROBSERVATORYevidence-bundle03 // ASSESSASSAY TOWERassessment-findings04 // VALIDATEWITNESS TOWERvalidation-receipt05 // IMPACTWAR ROOMimpact-model06 // REMEDIATECASE TOWERcase-record
OPERATIONS BRANCHSECRET TUNNEL / SEC-TP
audit-record can enter Case Tower review. Pairing and grants never inherit through the artifact.
INTELLIGENCE BRANCHTORUS OSINT / MARKET SIEM
intelligence-handoff transfers observations, findings, chronology, and provenance deliberately into a case.
RESOURCE BRANCHGLASSCASTLE MINING CO.
No implicit evidence-road handoff is declared. Resource authority stays local to the mine and owner policy.
ARTIFACTS MOVE. AUTHORITY DOES NOT. Transport is not acceptance. Acceptance is not execution authority. Every envelope carries producer identity, provenance, evidence references, payload integrity, and a structurally non-transferable authority context.
FROMTOARTIFACT
LOADING CONTRACTED HANDOFFS...
03 // ATTACK MODEL LENS
UNIFIED KILL CHAIN · POLS 2017
Canonical tactical order is a reference, not a mandatory progression. Phases may be bypassed, repeated, branched, or revisited. Pivoting is modeled as a choke point.
INITIAL FOOTHOLD
01 Recon02 Weaponization03 Delivery04 Social Engineering05 Exploitation06 Persistence07 Defense Evasion08 C2
PIVOT / CHOKE POINT
09 Pivoting
NETWORK PROPAGATION · REPEATABLE
10 Discovery11 Privilege Escalation12 Execution13 Credential Access14 Lateral Movement
ACTION ON OBJECTIVES
15 Collection16 Exfiltration17 Target Manipulation18 Objectives
02B // INTRUSION RELATIONSHIP LENS
DIAMOND MODEL OF INTRUSION ANALYSIS
An event relates Adversary, Infrastructure, Capability, and Victim. Missing features remain knowledge gaps. Confidence stays attached to supplied evidence. Diamond Phase can reference explicit UKC phases without collapsing the two models.
COREADVERSARYoften unknown
COREINFRASTRUCTUREphysical / logical
CORECAPABILITYtools / techniques
COREVICTIMpersona + assets
EVENTTimestamp · Phase · ResultDirection · Methodology · Resources
Capability ↔ Infrastructure enabling technologies such as protocols, platforms, and communication mechanisms.
Pivot from known features to possible connected evidence. A possible pivot is not a successful pivot, attribution, or causal proof.
04 // BUG BOUNTY OPERATIONS
SCOPE. DISCOVER. ASSESS. VALIDATE. IMPACT. REPORT.
HUNT / DISCOVER
BOUNTY CASEWORK
Compile the program boundary in ScopeSentinel, map hypotheses and evidence in Kork, assess the fracture in ShatterAssay, validate the proof in GlassWitness, then model consequence in BlastRadial.
CASE CONTRACT
ONE CASE ID
glasscastles.bounty.case.v2 preserves program, scope, confidence, evidence, status, and next action across the suite.
AUTHORIZATION
SCOPE FIRST
The bounty layer requires an explicit authorized / in-scope state. Public bounty rules and owned labs define the testing boundary.
DOCTRINE
BLEED OR DIE
Reproduce it, strengthen it, or retire it. Scanner output is not exploitation and dead hypotheses do not become reports.
05 // BUILD + EVALUATE
TOOLS WITH BOUNDARIES.
SECURE CONNECTIVITY
SEC-TP v0.6.0rc1
Capability-scoped secure tunnel research with default-deny policy, bounded sessions, auditable actions, TCP/QUIC carriers, and 162-test RC1 packaging gate.
CONTROLLED EVALUATION → WEB3 EVIDENCELAUNCH READINESS
Non-destructive, outside-in evidence snapshots for public launch surfaces. Reproducible observations instead of “looks good.”
VIEW OFFER → INTELLIGENCETORUS OSINT / MARKET SIEM
Collect, normalize, correlate, and inspect intelligence while keeping provenance attached and analyst conclusions distinct from source observations.
ENTER INTELLIGENCE → ECONOMYGLASSCASTLE MINING CO.
Measured, budgeted conversion of genuinely idle resources into useful output without allowing the mine to own the machine.
ENTER THE MINE →06 // SECURITY KITS PILOT
EVIDENCE-FIRST KITS. PRICING UNDER VALIDATION.
VALIDATION / DIGITAL KIT
WALLET INVESTIGATION STARTER KIT
Public-chain investigation intake, transaction and counterparty ledgers, claim-confidence discipline, findings structure, and a fictional worked case.
REQUEST PILOT ACCESS → VALIDATION / DIGITAL KITWEB3 SECURITY INCIDENT TRIAGE PACK
Incident intake, evidence register, wallet review, counterparty mapping, confidence tracking, findings reporting, and analyst handoff.
REQUEST PILOT ACCESS →COMMERCIAL BOUNDARY
PILOT STATUS
Package integrity and listing metadata are verified. Pricing remains under validation. No payment is accepted from this page; buyer interest is measured separately from publication.
OBSERVE BEFORE SCALING.07 // OPERATING PRINCIPLES
THE CASTLE DOES NOT ASK YOU TO TRUST THE FOG.
EVIDENCE BEFORE ASSERTION.
Claims should be traceable to observations and provenance.
LATEST ≠ CANONICAL.
Recency does not silently replace authority or source of truth.
UNKNOWN ≠ FALSE.
Missing evidence remains uncertainty, not a convenient negative.
BOUNDARIES STAY VISIBLE.
Experimental, inferred, privileged, and human-authority edges are stated explicitly.
08 // SYSTEM INSPECTION
INSPECT THE CASTLE.
Search the canonical GlassCastle product and contract model. Inspect purpose, archetype, surfaces, authority, outputs, failure boundaries, and handoffs without leaving this page.
INSPECTORINITIALIZING
PRODUCTS--
MATCHES--
SOURCECANONICAL CONTRACT SET
INITIALIZING SYSTEM INSPECTOR...
GLASSCASTLE SECURITY