Unified Security Fabric

All spans · one posture
Unified Security Posture
82/100
+6 vs last month
Signals correlated (30d)1,284
Cross-span incidents7
Mean time to verdict4.2 min
23
AttackIQ · open vulnerabilities
2 critical · 71% remediated
14
FraudShield · open investigations
3 high-risk · 1 SAR draft
97.1%
CyberWatch · alerts auto-triaged
2 containments awaiting approval
91%
ComplianceOS · POPIA posture
1 reportable incident logged

One signal, every span — incident INC-2026-0142

booking-phish campaign · resolved in 38 min
CyberWatch detects
Lookalike domain sending mail
acacia-grove-bookings.com flagged on DNS + EDR telemetry, verdict SUSPICIOUS, risk 74.
FraudShield investigates
Refund-diversion typology
3 guest refunds rerouted to a mule account; verdict MALICIOUS, risk 96. Payments frozen.
AttackIQ validates
Exposure confirmed
Authorised re-scan confirms the spoofed booking portal path is closed; no secondary foothold.
ComplianceOS records
POPIA-ready evidence
Hash-chained audit trail + SAR drafted; reportability assessed — no guest PII exfiltrated.

AttackIQ

Open dashboard

Open vulnerabilities

Remediation progress

this assessment cycle
External perimeter78%
Internal network64%
Web applications71%

Latest engagement

ScopeExternal + internal VAPT
Findings81 (2 crit · 9 high)
MITRE ATT&CK techniques14 mapped
Retest2 crit verified closed
Open full VAPT dashboard

FraudShield

Open dashboard

Investigation queue

verdict + risk by investigation
IDSubjectTypologyVerdictRiskStatus
FR-2291Refund diversion — booking portalAccount takeoverMalicious96Payments frozen
FR-2288Loyalty-points resale ringPoints abuseMalicious91Escalated
FR-2285Supplier invoice — "ProServ Catering"Invoice fraudSuspicious64Under review
FR-2283Card-testing burst — Cape Town propertiesCard testingMalicious88Blocked
FR-2281Guest chargeback cluster — DurbanFriendly fraudSuspicious57Evidence pack
FR-2277New device — finance controller loginCredential misuseClean12Closed
FR-2274OTA commission reconciliation—Clean8Closed

Typology mix (30d)

Risk trend

mean risk of open cases

CyberWatch

Open dashboard

Alert triage feed

last 24h · every verdict explained
TimeAlertSourceVerdictRiskAction
09:41Cobalt Strike-style beacon, 45s jitterEDR · JHB-WS-114Suspicious90Containment proposed — awaiting analyst approval
09:12Macro dropper in mail attachmentEmail gatewaySuspicious78Attachment quarantined (approved 09:20)
08:57Lookalike domain DNS query burstDNS telemetrySuspicious74Linked to INC-2026-0142
07:33QakBot loader hash matchEDR · CPT-WS-052Clean0False positive — signed updater, auto-closed
06:48After-hours admin loginIdentityClean10Verified with on-call rota, auto-closed

Verdict distribution (7d)

Governed response

Auto-contained (policy-approved)31
Proposed, human-approved12
Awaiting approval2
Nothing destructive executes without a human in the loop.

ComplianceOS

Open dashboard

POPIA posture

Control checklist

top items this quarter
Lawful processing register current Pass
Breach-notification runbook tested Pass
Operator agreements — 14/14 signed Pass
Retention schedule — loyalty data review due Due
Information Officer registered Pass
PAIA manual refresh — annual update Due

Hash-chained audit trail

#a91f…c4INC-2026-0142 evidence sealed
#77b2…1eContainment approved — JHB-WS-114
#5c08…d9SAR draft FR-2291 created
#e3d4…60VAPT retest attestation stored
#04aa…7bPOPIA reportability assessed — not required
Every entry cryptographically chained — tamper-evident by design.
Demo environment — all entities, incidents and metrics are synthetic and belong to the fictional Acacia Grove Hospitality Group. No customer data is shown. · Standalone VAPT dashboard