What is a digital twin in cybersecurity?

A continuously updated virtual model of your IT environment — systems, users, access, data flows, and dependencies — built from live telemetry. It stays in sync with reality so you can simulate attacks, measure blast radius, and quantify risk against your actual environment rather than a static diagram.

What is cyber risk quantification?

Cyber risk quantification expresses security risk in financial terms instead of qualitative ratings. Onek.ai uses Value at Risk (VaR) and Monte Carlo loss modeling to produce a dollar-denominated loss distribution, so leaders can compare risks, justify investment, and report to the board in business language.

What is Value at Risk (VaR) in cybersecurity?

Value at Risk estimates the potential financial loss from cyber events over a period at a given confidence level. Onek.ai rolls per-asset revenue, cost, and customer exposure into a portfolio VaR and models tail risk (CVaR) so you see both expected and worst-case losses.

How does cyber attack simulation work?

Onek.ai runs probabilistic simulations using agent-based modeling, discrete-event simulation, and Monte Carlo methods, with attacker and defender agents. Instead of a single guess, it produces outcome distributions, surfacing single points of failure, blast radius, weak points, and an overall resilience score.

How is Onek.ai different from a SIEM?

A SIEM collects and correlates logs to detect events after they occur. Onek.ai maintains a live, simulatable model of your environment, so you can test attacks before they happen, quantify business impact in dollars, and prioritize remediation — complementing detection rather than replacing it.

Can Onek.ai help with NIST 800-171 and CMMC compliance?

Yes. Onek.ai includes a NIST 800-171 control catalog (110 controls across 14 families) with evidence-backed self-assessment and CMMC preparedness gap analysis, mapping your live environment to control status and generating POA&M candidates.

How does Onek.ai prioritize remediation?

By money and blast radius, not severity color. Every finding is scored against the live twin for how much value-at-risk it carries and how far it would spread, so the list you work from is already in the order that reduces the most risk first. Changes come with a preview and a risk score, consequential ones wait for an approval, and everything lands in a hash-chained audit trail.

Can Onek.ai show me who has access to what?

Yes. Onek.ai imports grants from your identity provider and HR system, then compares them with the access it actually observes in auth logs and telemetry. The result is an access graph that separates three things most tools blur together: access that is granted and used, access that is granted but dormant, and access that is being used without any grant behind it — shadow access. Each is reviewable per person and per asset.

Does Onek.ai check device configuration, not just controls on paper?

Yes. Golden-config and benchmark policies — CIS, PCI DSS, NIST 800-171 — are written as rules and evaluated against the configuration Onek.ai pulls from each device. A failing policy points at the exact line on the exact asset, raises an event, and shows up as drift until it is fixed.

Does Onek.ai use my data to train AI models?

No. Onek.ai has no model of its own to train. Onek.ai Assist is bring-your-own-AI: you connect the provider you already trust — OpenAI, Anthropic, Google, Azure, Mistral, or a local model via Ollama or LM Studio — and your key is stored encrypted, server-side, write-only. Privacy-preserving analysis (pseudonymization, k-anonymity, differential privacy) runs on the server, so raw sensitive data never reaches a browser or a third party.

How is Onek.ai deployed?

In your infrastructure. Onek.ai ships as a containerized stack — Docker Compose with Postgres as the system of record, Apache NiFi as the optional aggregator, and a documented go-live runbook. Health and readiness endpoints, a fail-fast environment check and a CI gate come with it. Connectors are read-only, and you bring your own AI provider, so models and data stay under your control.

Does Onek.ai only do security, or operations too?

Both, deliberately. The same twin that models a ransomware path also models an availability-zone outage, a database failover or a data-center cooling failure, and prices each the same way. Security and infrastructure teams share one model, one map and one set of numbers instead of arguing from different tools.

CISOs who need a defensible number for the board; IT and infrastructure teams who need one live map of what they run; and executives, CFOs and risk committees who need cyber exposure expressed like every other risk on the balance sheet. Each gets a view built for them, all reading from the same model.

Learn

Shadow access

Shadow access is access that is observed in practice — a login, a query, a file read — but has no corresponding grant in the systems that are supposed to govern it. It arises from shared credentials, local accounts created on a device and never registered, trust relationships nobody documented, or grants that were removed in the directory but not on the target.

It is the most consequential finding an access review can produce, because policy-based review is blind to it by construction: you cannot certify a grant that does not exist. Detecting shadow access requires comparing observed authentication and usage data with configured grants, and treating the two as independent facts rather than assuming one implies the other.

Related terms

Dormant privilege
Blast radius

Go deeper

Identity & access review

Explore the live demo Talk to the team Back to Learn