What is a digital twin in cybersecurity?

A continuously updated virtual model of your IT environment — systems, users, access, data flows, and dependencies — built from live telemetry. It stays in sync with reality so you can simulate attacks, measure blast radius, and quantify risk against your actual environment rather than a static diagram.

What is Value at Risk (VaR) in cybersecurity?

Value at Risk estimates the potential financial loss from cyber events over a period at a given confidence level. Onek rolls per-asset revenue, cost, and customer exposure into a portfolio VaR and models tail risk (CVaR) so you see both expected and worst-case losses.

How does cyber attack simulation work?

Onek runs probabilistic simulations using agent-based modeling, discrete-event simulation, and Monte Carlo methods, with attacker and defender agents. Instead of a single guess, it produces outcome distributions, surfacing single points of failure, blast radius, weak points, and an overall resilience score.

How is Onek different from a SIEM?

A SIEM collects and correlates logs to detect events after they occur. Onek maintains a live, simulatable model of your environment, so you can test attacks before they happen, quantify business impact in dollars, and prioritize remediation — complementing detection rather than replacing it.

Can Onek help with NIST 800-171 and CMMC compliance?

Yes. Onek includes a NIST 800-171 control catalog (110 controls across 14 families) with evidence-backed self-assessment and CMMC preparedness gap analysis, mapping your live environment to control status and generating POA&M candidates.

What is automated remediation?

Automated remediation closes the loop from finding to fix. Onek generates risk-scored remediation previews, routes them through approvals, and executes via runbooks or infrastructure-as-code within policy guardrails — so fixes are fast but controlled, not unsupervised.

Does Onek use my data to train AI models?

No. Onek is bring-your-own-AI: you connect your own model provider and key, which is encrypted and used server-side. Privacy-preserving analysis runs on the server, so raw sensitive data is not exposed to the client.

How is Onek deployed?

Onek ships as a containerized stack (Docker / Compose) with a documented go-live runbook, so it can run in your own infrastructure. You bring your own AI provider and keys, keeping models and data under your control.

Security leaders (CISOs), IT and infrastructure teams, and executives or boards. Each gets a tailored view: defensible dollar risk and remediation plans, a live operational map, and business-language risk reporting respectively.

One platform, built around the financial decision

Onek unifies the capabilities most teams stitch together from separate tools into a single, continuously updated model of your environment — organized so that dollar-denominated risk drives what you see, simulate, and fix. Explore each capability in depth below.

Digital twin for security

A cybersecurity digital twin is a continuously updated virtual model of an organization's IT environment — systems, identities, access paths, data flows, and dependencies — built from live telemetry. Unlike a static diagram, it stays in sync with reality, so teams can simulate attacks, trace blast radius, and quantify risk against the actual environment rather than an idealized one.

Learn more

Cyber risk quantification

Cyber risk quantification (CRQ) expresses security risk in financial terms instead of qualitative ratings. It uses methods such as Value at Risk (VaR) and Monte Carlo loss modeling to produce a dollar-denominated loss distribution, so leaders can compare risks, justify investment, and report exposure to the board in the same language as the rest of enterprise risk.

Learn more

Attack simulation

Cyber attack simulation models how a breach could unfold against your actual environment, before an attacker does. Probabilistic approaches use agent-based modeling, discrete-event simulation, and Monte Carlo methods to produce distributions of outcomes — surfacing single points of failure, blast radius, weak points, and an overall resilience score rather than a single guess.

Learn more

NIST 800-171 & CMMC

NIST SP 800-171 is a U.S. standard of 110 security controls across 14 families that protect Controlled Unclassified Information (CUI) in non-federal systems. CMMC (Cybersecurity Maturity Model Certification) builds on it to verify that defense contractors actually implement those controls, through self-assessment or third-party certification depending on the level.

Learn more

Mapping & remediation

Live network mapping visualizes systems and their connections from real telemetry, so the map reflects what is actually communicating now rather than a hand-drawn diagram. Automated remediation closes the loop from finding to fix — generating risk-scored previews, routing them through approvals, and executing within policy guardrails so changes are fast but controlled.

Learn more

See the whole platform in action

Explore the live demo against a full sample environment — then let's talk about bringing it to yours.

Explore the live demo Talk to the team