Under the hood · the runtime pipeline

One question, six reads

The same data flows through six stages — each a read over the one before it. IP Fabric is ground truth on both ends: inventory in, reachability proof in the middle. Nothing is ever executed against any network.

▸ Click any stage to open the exact mechanism — the call made, what goes in, what comes out.
Live — proven, read-only Concept — logic exists, integration is the build Describe-only — written, never executed
the ranking · Beat 6

A score that collapses to zero

Exposure isn't a sum — it's a product. If any one factor is zero (no path, feature off, firewall drops it), the whole finding falls to zero and drops off the list. That is how a scary CVE with no route gets demoted, from data — not asserted.

severity
KEV → 1.0
SSVC / EPSS otherwise
never raw CVSS
×
reachability
all → 1.0
some → 0.5
no path → 0
×
exploitability
feature on → 1.0
abstain → 0.5
not enabled → 0
×
firewall
clear → 1.0
blocked → 0
any zero factor ⇒ the finding collapses to 0 ⇒ deprioritised
4
CVSS said critical
→
1
your network confirms

the scoreboard is computed from the data, never hardcoded — a KEV + reachable item must outrank a CVSS-9.8 with no path

◆
Every value carries where it came from
Each object in the pipeline is tagged LIVE, CONCEPT, or MIRROR — and that tag drives the badges you see. The honesty is baked into the data model, not the marketing. The whole stack also runs offline on recorded fixtures (MIRROR) that are the exact recorded live responses — so mirror equals live by construction, and a single shared parser reads both.