Brindwell & Partners · Cyber Defense Division

Platform Technical
Design Document

Architecture, detection models, adversary simulation frameworks, forensic pipelines, hunt methodologies, and human risk systems across five interconnected cyber defense platforms comprising 40 AI engines — from real-time detection through proactive hunting to human resilience.

Platforms
5 — Defense / Siege / Wraith / Vanguard / Phantom
Engines
40 AI Detection & Response Systems
ATT&CK Coverage
201 Techniques Across 14 Tactics
Classification
Confidential
Contents
Five Platforms. Forty Engines.
Defense-in-depth architecture: detect, validate, investigate, hunt, fortify.
DEF
Citadel Defense
SIEM · XDR · SOAR · CTI · Vulnerability · Identity · Cloud · Incident Response
SIG
Citadel Siege
CART · BAS · ATT&CK Simulation · Purple Team · Control Validation · Red Team AI
WRA
Citadel Wraith
DFIR · Memory Forensics · Malware Analysis · Timeline · Evidence · Attribution
VAN
Citadel Vanguard
Hypothesis Hunts · LOTL Detection · Behavioral Analytics · Dark Web · Managed Ops
PHN
Citadel Phantom
Phishing Sim · Deepfake Defense · OSINT · Human Risk Score · Culture Measurement
CORE
Unified Telemetry Lake
Shared data layer ingesting endpoint, network, cloud, identity, email, and SaaS
FLOW
Cross-Platform Intelligence
Bi-directional data flows enabling detection flywheel and continuous improvement
MITRE
ATT&CK & ATLAS Mapping
201 ATT&CK techniques + 84 ATLAS AI-specific techniques coverage
Executive Summary
Unified Defense Architecture
The Citadel platform family implements a defense-in-depth architecture across five interconnected platforms, each serving a distinct operational role in the cyber defense lifecycle. Citadel Defense detects and responds to threats in real time through AI-powered SIEM, XDR, and SOAR. Citadel Siege validates defenses proactively through continuous adversary simulation and breach-and-attack simulation (BAS) mapped to 201 MITRE ATT&CK techniques. Citadel Wraith investigates post-breach through AI-powered digital forensics, memory analysis, malware reverse engineering, and court-admissible evidence preservation. Citadel Vanguard hunts — proactively, continuously, hypothesis-driven — for adversaries who have evaded every automated defense. Citadel Phantom fortifies the human layer through AI-powered social engineering simulation, deepfake voice training, and behavioral risk scoring.
The five platforms share a unified telemetry lake that ingests security data from six domains — endpoint, network, cloud, identity, email, and SaaS — enabling cross-platform intelligence flows that create a continuous improvement flywheel. When Vanguard hunts discover a new adversary technique, the finding automatically generates a Sigma detection rule deployed to Defense's SIEM, a simulation scenario added to Siege's BAS library, and a training vignette incorporated into Phantom's awareness program. This closed-loop architecture ensures that every threat discovered anywhere in the ecosystem strengthens defenses everywhere else. The projected $11 trillion in annual global cyber losses underscores the existential nature of this domain — organizations with CTI-enriched AI achieve 65% faster triage, 40% fewer false positives, and block 80% more zero-day attacks.
<4min
Mean Time to Detect (Defense)
201
ATT&CK Techniques Simulated (Siege)
99.7%
Evidence Admissibility (Wraith)
241→24h
Dwell Time Reduction (Vanguard)
73→4%
Phishing Click Rate (Phantom)
Citadel Defense
Detect · Correlate · Respond · Contain
PLATFORM 01 — DEFENSE
Threat Detection, XDR & Autonomous Response
1M+ events/second ingested — sub-4-minute mean time to detect — 92% MTTR reduction

Citadel Defense collapses the SOC tool stack into a unified detection and response platform. The AI-powered SIEM ingests security telemetry from every source — endpoints, network devices, cloud workloads, identity providers, email gateways, and SaaS applications — applying ML behavioral analytics to detect multi-stage attacks that rule-based systems miss. XDR cross-domain correlation reconstructs complete attack chains automatically: phishing email (email domain) → credential theft (identity domain) → lateral movement (network domain) → privilege escalation (endpoint domain) → data exfiltration (cloud domain). The SOAR engine executes 500+ automated response playbooks in real time — isolating compromised endpoints, disabling accounts, blocking IPs, and collecting forensic artifacts within seconds of detection.

The behavioral analytics engine baselines normal activity for every user, device, and service using UEBA (User and Entity Behavior Analytics), surfacing anomalies that indicate compromise. Threat intelligence aggregation from commercial feeds, OSINT, dark web forums, and information-sharing communities provides real-time IOC enrichment with adversary context mapped to MITRE ATT&CK. Vulnerability management uses risk-based prioritization to reduce actionable vulnerabilities by 85% — because a critical vulnerability on an air-gapped test server is not the same risk as a medium vulnerability on an internet-facing server with production data access.

1M+
Events per second with sub-second ML correlation
<4min
Mean time to detect across all threat categories
92%
Reduction in mean time to respond via SOAR automation
80%
More zero-days blocked with CTI-enriched AI detection
500+
Pre-built automated response playbooks
85%
Reduction in actionable vulnerabilities via risk-based prioritization
Detection & Response Pipeline
STAGE 01
Telemetry Ingestion
Real-time streaming from EDR, NDR, cloud APIs, identity providers, email gateways, and SaaS connectors. Normalized into unified schema.
EDRNDRCloud
STAGE 02
ML Correlation
Behavioral analytics baseline every entity. Graph analytics map lateral movement and privilege escalation paths. ATT&CK technique classification on every event.
UEBAATT&CK
STAGE 03
XDR Attack Chain
Cross-domain correlation stitches signals across endpoint, identity, network, email, cloud into complete attack narratives with timeline and impact scoring.
XDRKill Chain
STAGE 04
SOAR Execution
Automated playbook execution: endpoint isolation, account disable, IP block, forensic artifact collection, SOC notification, management escalation.
SOARPlaybooks
STAGE 05
Cross-Platform Dispatch
Incidents route to Wraith (forensics). IOCs feed Vanguard (hunting). Gaps inform Siege (simulation). Vectors update Phantom (training).
WraithVanguardSiege
UEBA Architecture

The behavioral analytics engine constructs per-entity behavioral profiles across 140+ dimensions for every user, device, and service account. Baseline profiles capture normal patterns: login times, source locations, application usage, data access patterns, network communication peers, and authentication methods. The anomaly detection model uses an ensemble of isolation forests (for point anomalies), LSTM autoencoders (for sequential anomalies), and graph-based community detection (for relational anomalies). Multi-signal compound anomaly scoring weights individual anomalies by severity, entity criticality, and temporal clustering — a single unusual login is noise; an unusual login followed by unusual file access followed by unusual network communication is a compound signal that demands investigation.

ATT&CK-Mapped Detection

Every detection rule in Citadel Defense is mapped to one or more MITRE ATT&CK techniques, enabling quantitative coverage measurement. The platform provides detection coverage across 201 of ATT&CK's 200+ techniques (14 tactical categories), with coverage depth scored per technique: Level 1 (signature-based detection for known IOCs), Level 2 (behavioral detection for technique patterns), Level 3 (AI-based detection for novel variations). Coverage heatmaps visualize gaps against specific threat groups — "APT29 uses these 47 techniques; Citadel detects 46 with Level 2+ coverage; one gap identified in T1055.012 (Process Hollowing variant) — escalated to Siege for validation and Vanguard for hunt campaign."

Citadel Siege
Simulate · Validate · Test · Prove
PLATFORM 02 — SIEGE
Adversary Simulation & Control Validation
201 ATT&CK techniques simulated autonomously — proving what works, exposing what doesn't

Citadel Siege continuously attacks your environment to validate every detection rule, every response playbook, and every security control. The platform executes autonomous adversary simulation mapped to 201 MITRE ATT&CK techniques across 14 tactical categories, running breach-and-attack simulation (BAS) campaigns that replicate the exact TTPs used by real threat groups — APT29, Lazarus Group, FIN7, Conti, and 200+ additional adversary profiles. Each simulation produces a detailed validation report: which attacks were detected, which were missed, which were contained by automated response, and which reached their objective. The gap analysis feeds directly into Defense's detection engineering pipeline, creating a closed-loop validation cycle where every identified gap becomes a new detection rule.

201
ATT&CK techniques in autonomous simulation library
200+
Threat group adversary profiles with complete TTP chains
Continuous
Automated validation — not annual penetration tests
BAS Architecture

Siege's BAS engine deploys safe-to-execute attack simulations that replicate adversary behavior without causing operational damage. Each simulation follows a complete attack chain: initial access (phishing payload delivery, credential spraying, exploit execution), execution (PowerShell, WMI, scheduled tasks), persistence (registry modifications, startup folder, service creation), privilege escalation (token manipulation, UAC bypass), lateral movement (PsExec, WinRM, RDP hijacking), and exfiltration (DNS tunneling, HTTP POST, cloud upload). The simulation agent validates at each stage whether Defense detected the activity, whether SOAR triggered an automated response, and whether the response was effective — producing a technique-by-technique scorecard that quantifies actual defensive coverage.

Purple Team Automation

Siege automates the purple team methodology — the iterative collaboration between red team (attacking) and blue team (defending) that produces the fastest defensive improvement. For each simulated technique, the system simultaneously executes the attack and monitors the SOC's detection and response capability. Results are classified into four categories: Detected and Contained (green), Detected but Not Contained (yellow), Not Detected but Logged (orange), and Neither Detected nor Logged (red). Red-category results trigger immediate detection engineering sprints. Yellow-category results trigger SOAR playbook enhancements. The system runs 24/7, ensuring that new detection rules are validated within hours of deployment rather than waiting for the next annual penetration test.

Citadel Wraith
Investigate · Reconstruct · Attribute · Preserve
PLATFORM 03 — WRAITH
Digital Forensics & Incident Investigation
AI reconstructs breaches from millions of data points — 99.7% evidence admissibility rate

Citadel Wraith provides AI-powered digital forensics that reconstructs breaches from millions of data points, preserves court-admissible evidence with chain-of-custody integrity, and attributes attacks to specific adversary groups with 94% confidence. The platform covers the complete DFIR lifecycle: volatile memory acquisition and analysis (detecting fileless malware, injected code, and credential artifacts that exist only in RAM), disk forensics (timeline reconstruction, artifact extraction, deleted file recovery), network forensics (packet capture analysis, lateral movement reconstruction, C2 communication identification), malware reverse engineering (automated static and dynamic analysis with behavioral classification), and evidence management (cryptographic hashing, tamper-evident storage, court-ready reporting).

99.7%
Evidence admissibility rate in legal proceedings
94%
Attack attribution confidence using TTP fingerprinting
Minutes
Automated timeline reconstruction (vs. days manually)
Memory Forensics Architecture

Wraith's memory forensics engine acquires and analyzes volatile memory from compromised systems, detecting fileless malware, injected code, credential artifacts, and in-memory encryption keys that leave no trace on disk. The analysis pipeline uses Volatility framework integration enhanced with custom ML classifiers that identify malicious process injection patterns (process hollowing, DLL injection, reflective loading) with 96% accuracy. Memory analysis is particularly critical for modern attacks: approximately 40% of advanced threats now operate entirely in memory, leaving no disk-based artifacts for traditional forensic tools to discover.

Attribution Engine

Attack attribution uses a multi-dimensional TTP fingerprinting model that compares observed adversary behavior against 200+ threat group profiles. The model analyzes tooling signatures (specific versions of Cobalt Strike, Metasploit, custom implants), infrastructure patterns (domain registration patterns, hosting providers, SSL certificate characteristics), operational timing (working hours adjusted for suspected timezone), and tactical preferences (preferred initial access vectors, lateral movement techniques, exfiltration methods). The ensemble model produces a ranked list of most-likely attributions with confidence scores. A 94% confidence attribution to APT29, for example, informs fundamentally different response strategies than attribution to a financially motivated ransomware group — because the adversary's objectives, persistence, and escalation patterns differ entirely.

Citadel Vanguard
Hunt · Discover · Convert · Defend Forward
PLATFORM 04 — VANGUARD
Proactive Threat Hunting
Dwell time from 241 days to 24 hours — finding what your SIEM cannot see

Citadel Vanguard conducts proactive, hypothesis-driven threat hunting to find adversaries living undetected inside your network. The median attacker dwell time across the industry is 11 days, with 57% of compromises discovered by external parties rather than internal security teams. Mature threat hunting programs reduce the breach lifecycle from 241 days to under 24 hours. Vanguard's eight engines span the complete hunting lifecycle: AI-suggested hunt hypotheses based on threat intelligence and coverage gap analysis, living-off-the-land binary (LOLBin) detection through behavioral baselines for 40+ legitimate tools commonly abused by attackers, cross-domain hunt telemetry spanning six data domains with natural language querying, and the hunt-to-detection flywheel that automatically converts validated findings into Sigma/YARA/KQL detection rules deployed to Defense's SIEM.

241→24h
Dwell time reduction with mature hunt program
40+
LOLBin behavioral baselines for living-off-the-land detection
Auto
Sigma/YARA/KQL rule generation from validated hunt findings
Hunt-to-Detection Flywheel

The flywheel is the most architecturally significant innovation in the Citadel platform family. Every time a hunter validates a finding that automated detection missed, the system answers two questions: "What did we find?" and "Why didn't our SIEM catch it?" The flywheel engine automatically generates a detection rule in the appropriate format (Sigma for cross-platform, YARA for file/memory, KQL/SPL for SIEM-specific), tests the rule against 90 days of historical data to measure false positive rate, and deploys the validated rule to Defense's SIEM. Over time, the flywheel continuously expands automated detection coverage based on real-world hunt findings — making each successive hunt less likely to discover previously huntable threats because they have been converted to automated detections.

Living-off-the-Land Detection

The most dangerous adversaries do not use custom malware — they use your own tools against you. PowerShell, WMI, PsExec, certutil, mshta, regsvr32, and 30+ additional legitimate Windows binaries are routinely weaponized for lateral movement, persistence, and data exfiltration. Vanguard's LOTL detection engine builds behavioral baselines for each LOLBin in each environment: which users invoke PowerShell, what scripts they run, what parameters they use, what time of day, from which systems. When an attacker uses PowerShell in a pattern that deviates from any established user baseline — even though the individual command is legitimate — the behavioral anomaly surfaces as a hunt lead. This approach catches the attacks that signature-based detection cannot: every command is "legitimate," but the pattern is adversarial.

Citadel Phantom
Simulate · Train · Measure · Fortify the Human
PLATFORM 05 — PHANTOM
Social Engineering Defense & Human Risk
80% of breaches begin with a person — Phantom click rates: 73% → 4%

Citadel Phantom addresses the dimension that every other platform in the ecosystem treats as an external variable: the human. Approximately 80% of breaches begin with a person, not a machine — through phishing, vishing, social engineering, credential harvesting, or insider actions. Phantom transforms the workforce from a vulnerability into an active defense layer through AI-powered adaptive phishing simulation, deepfake voice defense training, OSINT exposure analysis, human risk scoring, multi-channel attack simulation, security culture measurement, insider threat behavioral intelligence, and compliance automation. AI phishing agents now out-perform elite human red teams at scale, with AI performance versus humans improving by 55%. Organizations implementing behavior-based training see a 50% reduction in phishing incidents over 12 months.

73→4%
Phishing click rate reduction after Phantom training
55%
AI phishing performance improvement vs. human red teams
50%
Reduction in phishing incidents over 12 months with behavioral training
Deepfake Voice Defense

The deepfake vishing module trains employees to recognize AI-generated voice calls that impersonate executives. The training system generates realistic deepfake voice samples from publicly available audio (conference recordings, podcast appearances, social media) using voice cloning models that require as little as 90 seconds of source audio. Employees experience simulated vishing calls — a CFO receiving a call that sounds exactly like the CEO requesting an urgent wire transfer — and are trained on verification procedures: callback to a known number, out-of-band confirmation, and challenge-response protocols. In deployment, a CFO who had completed Phantom's vishing training recognized the pattern and verified through callback procedure, preventing $1.8M in wire fraud.

Human Risk Scoring

Phantom generates a continuous human risk score for every employee based on simulation performance (phishing click rates, vishing susceptibility, physical security testing), behavioral indicators (password reuse detection, MFA adoption, shadow IT usage), training completion and comprehension, reporting behavior (whether employees report suspicious emails and how quickly), and role-based exposure (executives with financial authority, IT administrators with privileged access, new employees in onboarding). The risk score is dynamic — it improves with demonstrated security behavior and degrades when risky patterns are detected. High-risk individuals receive targeted, adaptive training rather than generic awareness modules, while the aggregate organizational risk score informs the CISO's human risk reporting to the board.

Cross-Platform Intelligence
The Closed-Loop Defense Flywheel
DEF→WRA
Incidents trigger forensic investigation. Wraith receives full attack chain context, endpoint images, and network captures from Defense's SOAR evidence collection.
WRA→DEF
Forensic IOCs and detection rules pushed to SIEM. New adversary TTPs discovered during investigation become automated detection signatures.
SIG→DEF
Validated detection gaps improve coverage. Every Siege simulation that bypasses detection generates a priority detection engineering task.
VAN→DEF
Hunt findings become automated detections. Sigma/YARA/KQL rules generated from validated threats are deployed to the SIEM within hours.
WRA→SIG
Forensic TTPs become simulation scenarios. Real-world adversary behavior discovered in investigations is replicated for continuous validation.
SIG→PHN
Validated attack patterns inform training. Social engineering vectors validated by Siege simulations become Phantom training vignettes.
PHN→VAN
Human reports feed hunting hypotheses. Employee-reported suspicious emails and activities become hunt campaign triggers for Vanguard.
DEF→VAN
Alert context enriches hunt campaigns. Low-confidence alerts that do not trigger automated response become Vanguard investigation leads.