What is a digital twin in cybersecurity?

A continuously updated virtual model of your IT environment — systems, users, access, data flows, and dependencies — built from live telemetry. It stays in sync with reality so you can simulate attacks, measure blast radius, and quantify risk against your actual environment rather than a static diagram.

What is cyber risk quantification?

Cyber risk quantification expresses security risk in financial terms instead of qualitative ratings. Onek uses Value at Risk (VaR) and Monte Carlo loss modeling to produce a dollar-denominated loss distribution, so leaders can compare risks, justify investment, and report to the board in business language.

What is Value at Risk (VaR) in cybersecurity?

Value at Risk estimates the potential financial loss from cyber events over a period at a given confidence level. Onek rolls per-asset revenue, cost, and customer exposure into a portfolio VaR and models tail risk (CVaR) so you see both expected and worst-case losses.

How does cyber attack simulation work?

Onek runs probabilistic simulations using agent-based modeling, discrete-event simulation, and Monte Carlo methods, with attacker and defender agents. Instead of a single guess, it produces outcome distributions, surfacing single points of failure, blast radius, weak points, and an overall resilience score.

How is Onek different from a SIEM?

A SIEM collects and correlates logs to detect events after they occur. Onek maintains a live, simulatable model of your environment, so you can test attacks before they happen, quantify business impact in dollars, and prioritize remediation — complementing detection rather than replacing it.

Can Onek help with NIST 800-171 and CMMC compliance?

Yes. Onek includes a NIST 800-171 control catalog (110 controls across 14 families) with evidence-backed self-assessment and CMMC preparedness gap analysis, mapping your live environment to control status and generating POA&M candidates.

How does Onek prioritize remediation?

Onek turns a backlog of findings into a ranked remediation plan. It scores each issue by exploitability, blast radius, and dollar impact against your live digital twin, so your team fixes what reduces the most risk first. Change previews, approval gates, and a tamper-evident audit trail keep every action deliberate and accountable.

Does Onek use my data to train AI models?

No. Onek is bring-your-own-AI: you connect your own model provider and key, which is encrypted and used server-side. Privacy-preserving analysis runs on the server, so raw sensitive data is not exposed to the client.

How is Onek deployed?

Onek ships as a containerized stack (Docker / Compose) with a documented go-live runbook, so it can run in your own infrastructure. You bring your own AI provider and keys, keeping models and data under your control.

Security leaders (CISOs), IT and infrastructure teams, and executives or boards. Each gets a tailored view: defensible dollar risk and remediation plans, a live operational map, and business-language risk reporting respectively.

What is a live network map?

A live network map visualizes systems and their connections using real telemetry, updating as traffic changes. Connections reflect what is actually communicating, activity fades over time, and elements highlight when behavior looks anomalous — unlike a static diagram that is drawn once and goes stale.

How does Onek prioritize remediation?

Onek turns a backlog of findings into a ranked plan. It scores each issue by exploitability, blast radius, and dollar impact against the live twin, so teams fix what reduces the most risk first — with change previews, approval gates, and a tamper-evident audit trail keeping every action controlled and auditable.

How does Onek keep remediation controlled?

Every recommended change comes with a preview and a risk score, consequential actions require approval, and each action is captured in a tamper-evident audit trail — so teams move fast on what matters without losing oversight.

Platform

Live network mapping and remediation prioritization

Live network mapping visualizes systems and their connections from real telemetry, so the map reflects what is actually communicating now rather than a hand-drawn diagram. Remediation prioritization ranks findings by risk — scoring each by exploitability, blast radius, and dollar impact so teams fix what matters most first, with change previews and approval gates keeping every action controlled.

Two problems sit at opposite ends of the same workflow. At the start, teams can't see their environment clearly, because the map is stale. At the end, they can't act on what they find fast enough, because remediation is a backlog of disconnected tickets. Live mapping and remediation prioritization address both ends of that loop.

What makes a map 'live'

A static map is drawn once and decays. A live map is driven by telemetry: connections appear because traffic is actually observed between systems, lines fade as activity decays, and elements recolor when behavior looks anomalous. The result is closer to an operations-center view of current reality than to documentation.

Where the data comes from

A live map is only as good as its inputs. Telemetry generally arrives two ways: pushed from systems that stream events, and pulled by collectors that query systems on a schedule. Common collection methods include:

Streaming/push pipelines for high-volume event data.
REST and SSH collectors for application and host data.
SNMP for network device metrics.
osquery for detailed host and endpoint facts.

Prioritizing what to fix first

Seeing a problem is only half the job. Prioritization turns a list of findings into a ranked plan: the system scores each issue by exploitability, blast radius, and dollar impact against the live twin, then shows a preview of the proposed change and its risk. Approvals gate anything consequential, and every action is recorded in a tamper-evident audit trail.

The aim is focus without recklessness — teams spend their time on the fixes that reduce the most risk, while keeping a human in the loop where the stakes are high.

How Onek maps and remediates

Onek's map reads from the same telemetry that builds the twin, and its remediation layer closes the loop with control built in.

Available today

A live map whose connection lines react to observed traffic and recolor on anomalies.
Unified push and pull collectors (streaming, REST, SSH, SNMP, osquery).
Risk-scored remediation prioritization with change previews, approval gates, and policy guardrails on anything consequential.
A hash-chained audit trail of every change.

On the roadmap

Continuous re-ranking of remediation priorities as the twin and threat picture change.

Frequently asked questions

What is a live network map?: A live network map visualizes systems and their connections using real telemetry, updating as traffic changes. Connections reflect what is actually communicating, activity fades over time, and elements highlight when behavior looks anomalous — unlike a static diagram that is drawn once and goes stale.
How does Onek prioritize remediation?: Onek turns a backlog of findings into a ranked plan. It scores each issue by exploitability, blast radius, and dollar impact against the live twin, so teams fix what reduces the most risk first — with change previews, approval gates, and a tamper-evident audit trail keeping every action controlled and auditable.
How does Onek keep remediation controlled?: Every recommended change comes with a preview and a risk score, consequential actions require approval, and each action is captured in a tamper-evident audit trail — so teams move fast on what matters without losing oversight.

Related platform capabilities

Learn the concepts

Explore the live demo Talk to the team Back to platform