Information Sharing and Analysis Centres exist because threat intelligence is more valuable shared. A sector ISAC will tell you that a specific actor is targeting organisations like yours, using a specific set of techniques, with specific indicators. That intelligence is accurate, timely and — by design — generic. It describes the threat. It does not describe your infrastructure.
The detection engineering gap
Turning "this actor uses this technique" into "this alert fires when that technique is used here" is detection engineering, and it is slow, skilled work. Someone has to understand the technique, understand how it would manifest on your specific stack, write the logic, test it, tune out the false positives, and deploy it. For a well-resourced team that is days per technique. For most teams it simply does not happen; the bulletin is read, filed and forgotten, and the organisation remains exactly as exposed as it was before the intelligence arrived.
Monolith exists to close that gap, automatically, at the rate intelligence is published.
The loop
Ingest everything. TTPs, IOCs, ISAC bulletins, CVE disclosures, vendor advisories, open and commercial feeds. The agent reads all of it continuously and pulls it into your environment.
Decompose into attack profiles. Each threat is broken down from a headline into the concrete sequence an adversary would execute against an estate like yours — initial access, persistence, discovery, movement, objective — mapped to the techniques and the indicators.
Run it against your digital twin. The profile is executed against a masked replica of your real topology: the same assets, the same controls, the same configuration, none of your production data. It is a safe, exact rehearsal of that attack against you specifically.
Treat silence as the finding. If the twin raises an alert, your detection coverage holds for that technique and the result is recorded. If the twin raises nothing, your real estate would have raised nothing either. That is a blind spot — located, evidenced and dated before an attacker finds it.
Build the detection. Deploy it. Verify. Monolith writes the detection logic and the control change for that specific gap, uploads and configures it, then re-runs the profile against the twin to confirm the alert now fires. You are notified of the outcome: this bulletin, this technique, this gap, now closed.
Why a digital twin
Exercising attack techniques against live production is risky and operationally disruptive; not exercising them means you never learn whether your detections work. A masked replica resolves the tension. It preserves everything that determines whether a detection fires — topology, controls, configuration, service exposure — while holding none of the data an attack would actually be after. Every profile can be run, as often as intelligence changes, without a change window.
Why this is the AI-native approach
Correlation at this level — every feed, every technique, against the specific shape of your infrastructure, at the rate intelligence is published — is beyond what any human team can sustain. It is exactly what an agent that reads everything, simulates everything and acts on its own findings can do before the next bulletin lands. This is not a SIEM with a model attached to the search bar. The model is the operator.
What week one looks like
We do not open with a deck. In the first week, Monolith stands the twin up against a representative slice of your estate and runs the attack profiles from the last month of your sector bulletins through it. We show you the one your controls did not catch, with the evidence, and the detection already written for it. That first finding is the pitch; it is also the first entry in your evidence chain.
For the step-by-step technical account of the loop, including masking, false-positive checks and the fidelity caveat, see how the simulations actually run.
Frequently asked questions
What is a security digital twin?
A masked replica of your real environment — the same assets, network topology, security controls and configuration — containing none of your production data. Attack profiles can be executed against it safely to determine whether your detections and controls would respond, without touching live systems.
Which intelligence sources does Monolith ingest?
Sector ISAC bulletins, CVE and vulnerability disclosures, vendor security advisories, and open and commercial threat feeds containing TTPs and IOCs. Sources are configured per deployment; the agent reads them continuously rather than on a schedule.
What happens if the digital twin shows a detection gap?
Monolith writes the detection logic and any associated control change, deploys and configures it, then re-executes the attack profile against the twin to confirm the alert now fires. The gap, the fix and the verification are all written to the evidence store and you are notified of the outcome.
Does the twin need to be rebuilt when the environment changes?
No. The twin is maintained continuously from the same live model of the estate that drives detection, so it reflects the environment as it is now, not as it was when it was last provisioned.
Can deployed detections be reviewed before they go live?
Yes. Detection deployment is a remediation class like any other: it can require explicit approval, or be pre-authorised for automatic deployment, depending on the autonomy setting you choose. Either way, every deployed detection is recorded with the intelligence that motivated it.