This page is for the people who will be asked "but how does it actually do that." It describes the digital-twin loop as we would describe it in an engineering conversation: what is built, what is executed, what counts as a result, and where the limits are.
1. Build the twin
Monolith is in-line, so it discovers the estate passively: hosts, services, identities (human and machine), trust relationships, segments, egress paths, and the administrative layer of DNS, registrars, certificates and mail authentication.
From that it generates a masked replica: the same topology, the same control configuration, the same detection rules, synthetic data. Masking replaces identifiers with stable pseudonyms, so the twin is structurally faithful but contains nothing sensitive.
The twin runs as a set of isolated workspaces on the device, the disposable, snapshot-able workspaces of the runtime. Every run starts from a known snapshot and is thrown away afterwards. Nothing that happens in the twin touches production.
2. Ingest intelligence
TTPs, IOCs, ISAC bulletins, CVE disclosures, vendor advisories. The model reads them continuously and decomposes each into an attack profile: an ordered chain of concrete techniques, from initial access through persistence, discovery and movement to the objective, each with its preconditions and its expected observables, mapped to MITRE ATT&CK.
A headline becomes a sequence of things an adversary would actually do, against an estate shaped like yours.
3. Execute the profile against the twin
An agent plays adversary inside the twin and walks the chain, using the real tooling the technique would use. Preconditions are checked against the twin's actual state at each step. The result is therefore "would this work against you," not "is this technique theoretically possible."
4. Score silence
The defender side of the twin runs your real detection stack. For every step of the chain the question is the same: did an alert fire?
If yes, coverage holds for that technique and the result is recorded. If nothing fires, that step is a confirmed blind spot, evidenced with the exact technique, the exact host class, and the exact telemetry that was present but went undetected. Silence is the finding.
5. Write the detection, verify it on the twin
The model writes the detection logic, or the control change, for that specific gap. It deploys it into the twin, re-runs the chain, and confirms the alert now fires. It also confirms the detection does not fire against the twin's clean baseline, which is the false-positive check.
Only then is the change staged for production, under your approval policy: pre-approved classes deploy automatically; everything else arrives as one decision with the change already written and already proven.
6. Continuous control validation
The same loop, pointed at your controls instead of at a threat. Known-safe probes exercise the firewall rule, the EDR heartbeat, the egress policy, the MFA gate on the administrative console, on a schedule, against the twin and, where it is safe to do so, against the live estate.
A control that silently stopped working is a finding with a timestamp, not a surprise discovered during an incident.
7. Every incident becomes a simulation
After a real event, the observed chain is replayed against the twin. The detection is written and verified, the control change is applied, and the re-run confirms the same path no longer completes. That is the "never again" promise, made mechanical rather than aspirational, and recorded in the evidence chain.
The honest caveat
Fidelity depends on what the twin can see. Network-level discovery gives topology, identities and flows. Deeper host-state fidelity, such as installed software, local configuration and endpoint telemetry, needs read access to configuration management, EDR and identity-provider APIs.
The right way to think about it: the twin is as faithful as the integrations you grant it, and it tells you where it is guessing. Every finding carries a confidence level and the source of the evidence behind it, so a gap found with full host-state visibility and a gap inferred from network behaviour are never presented as the same thing.
What this gives you
A continuously tested answer to "would this work against us," with the fix written and proven before anyone is asked to approve it, and a record of every run that nobody on the team can edit. It replaces the annual engagement, the quarterly tabletop and the detection backlog with a loop that runs every day, and it starts in week one against a representative slice of your estate.
Frequently asked questions
Does the simulation ever touch production systems?
Attack profiles run only against the twin. Continuous control validation uses known-safe probes, and only against the live estate where that is safe and you have allowed it. Detections and control changes reach production only after they have been verified on the twin and approved under your policy.
How is the digital twin kept current?
Discovery is continuous because Monolith is in-line. Changes in topology, identities, controls and configuration are reflected in the twin as they are observed, and integrations you grant to configuration management, EDR and identity providers keep host state current.
What does "silence is the finding" mean?
If an attack step executed against the twin raises no alert from your real detection stack, your production estate would have raised nothing either. That missing alert is treated as a confirmed, evidenced blind spot rather than as an absence of data.
How are false positives avoided?
Every new detection is run against the twin's clean baseline as well as the attack chain. A detection that fires on the baseline is not shipped; it is refined until it fires on the attack and stays silent on normal activity.
How much integration is required to get value?
Network-level discovery alone gives a faithful twin of topology, identities and flows, which is enough for the first findings in week one. Host-state fidelity improves with read access to configuration management, EDR and identity-provider APIs, and the twin marks where it is inferring rather than observing.