What is a digital twin in cybersecurity?

A continuously updated virtual model of your IT environment — systems, users, access, data flows, and dependencies — built from live telemetry. It stays in sync with reality so you can simulate attacks, measure blast radius, and quantify risk against your actual environment rather than a static diagram.

What is cyber risk quantification?

Cyber risk quantification expresses security risk in financial terms instead of qualitative ratings. Onek.ai uses Value at Risk (VaR) and Monte Carlo loss modeling to produce a dollar-denominated loss distribution, so leaders can compare risks, justify investment, and report to the board in business language.

What is Value at Risk (VaR) in cybersecurity?

Value at Risk estimates the potential financial loss from cyber events over a period at a given confidence level. Onek.ai rolls per-asset revenue, cost, and customer exposure into a portfolio VaR and models tail risk (CVaR) so you see both expected and worst-case losses.

How does cyber attack simulation work?

Onek.ai runs probabilistic simulations using agent-based modeling, discrete-event simulation, and Monte Carlo methods, with attacker and defender agents. Instead of a single guess, it produces outcome distributions, surfacing single points of failure, blast radius, weak points, and an overall resilience score.

How is Onek.ai different from a SIEM?

A SIEM collects and correlates logs to detect events after they occur. Onek.ai maintains a live, simulatable model of your environment, so you can test attacks before they happen, quantify business impact in dollars, and prioritize remediation — complementing detection rather than replacing it.

Can Onek.ai help with NIST 800-171 and CMMC compliance?

Yes. Onek.ai includes a NIST 800-171 control catalog (110 controls across 14 families) with evidence-backed self-assessment and CMMC preparedness gap analysis, mapping your live environment to control status and generating POA&M candidates.

How does Onek.ai prioritize remediation?

By money and blast radius, not severity color. Every finding is scored against the live twin for how much value-at-risk it carries and how far it would spread, so the list you work from is already in the order that reduces the most risk first. Changes come with a preview and a risk score, consequential ones wait for an approval, and everything lands in a hash-chained audit trail.

Can Onek.ai show me who has access to what?

Yes. Onek.ai imports grants from your identity provider and HR system, then compares them with the access it actually observes in auth logs and telemetry. The result is an access graph that separates three things most tools blur together: access that is granted and used, access that is granted but dormant, and access that is being used without any grant behind it — shadow access. Each is reviewable per person and per asset.

Does Onek.ai check device configuration, not just controls on paper?

Yes. Golden-config and benchmark policies — CIS, PCI DSS, NIST 800-171 — are written as rules and evaluated against the configuration Onek.ai pulls from each device. A failing policy points at the exact line on the exact asset, raises an event, and shows up as drift until it is fixed.

Does Onek.ai use my data to train AI models?

No. Onek.ai has no model of its own to train. Onek.ai Assist is bring-your-own-AI: you connect the provider you already trust — OpenAI, Anthropic, Google, Azure, Mistral, or a local model via Ollama or LM Studio — and your key is stored encrypted, server-side, write-only. Privacy-preserving analysis (pseudonymization, k-anonymity, differential privacy) runs on the server, so raw sensitive data never reaches a browser or a third party.

How is Onek.ai deployed?

In your infrastructure. Onek.ai ships as a containerized stack — Docker Compose with Postgres as the system of record, Apache NiFi as the optional aggregator, and a documented go-live runbook. Health and readiness endpoints, a fail-fast environment check and a CI gate come with it. Connectors are read-only, and you bring your own AI provider, so models and data stay under your control.

Does Onek.ai only do security, or operations too?

Both, deliberately. The same twin that models a ransomware path also models an availability-zone outage, a database failover or a data-center cooling failure, and prices each the same way. Security and infrastructure teams share one model, one map and one set of numbers instead of arguing from different tools.

CISOs who need a defensible number for the board; IT and infrastructure teams who need one live map of what they run; and executives, CFOs and risk committees who need cyber exposure expressed like every other risk on the balance sheet. Each gets a view built for them, all reading from the same model.

Learn

Loss exceedance curve

Also known as: LEC

A loss exceedance curve plots, for every possible loss amount, the probability that losses over a period — usually a year — will exceed it. Read left to right: there might be a 50% chance of exceeding $200K, a 10% chance of exceeding $1M, and a 1% chance of exceeding $5M. The curve is the most complete single picture of a risk, because it shows the whole distribution rather than one point on it.

Exceedance curves are produced from a Monte Carlo loss model and are especially useful for comparing before-and-after states: a control that works should pull the curve down and to the left. They are also how insurers reason, which makes them a natural shared language between a security team and the people pricing its cyber policy.

Related terms

Monte Carlo simulation
Conditional Value at Risk (CVaR)
Value at Risk (VaR)

Go deeper

Cyber risk quantification

Explore the live demo Talk to the team Back to Learn