AI Cyber Defense: Model compressed reconnaissance-to-exploitation windows

Detailed practical guide

Prepare your workspace and inputs

Save the program below as exposure_queue.py. Its embedded CSV is a complete test input. For operational use, replace that CSV with an approved inventory export using the same documented fields and retain the observation timestamp.

Platform context: Python 3.10+; standard library, local CSV export. The script makes no network connection and changes no security policy.

Scenario to reproduce or investigate

A newly public administrative service needs an accountable containment decision before exploit attribution is settled. Recalculating deadlines from each report run would conceal aging exposures.

1. Define the inventory contract and decision policy

   Require asset_id, first_seen_utc, owner, public and admin fields. The lab policy assigns a four-hour decision window to public administrative interfaces and a 24-hour window to other public services. These are example policy values, not an industry-mandated SLA. The deadline is calculated from first observation, not report generation.

   Command, configuration or input

   asset_id,first_seen_utc,owner,public,admin
   edge-admin,2026-11-04T08:00:00+00:00,network-team,true,true
   public-docs,2026-11-04T09:00:00+00:00,web-team,true,false
   orphan-api,2026-11-04T09:30:00+00:00,,true,false

   Expected result · ผลที่ควรเห็น

   Every queue entry has a stable source observation and either an accountable owner or an explicit unassigned-owner escalation.

   If it fails · เมื่อไม่ผ่าน

   Do not replace an unknown first-seen timestamp with the report time. Keep it unknown and investigate the inventory evidence.

2. Run the deterministic queue and deadline test

   The complete program checks field values and timezone-aware timestamps. At 13:00 UTC the administrative endpoint is overdue; the unowned API requires assignment. It also verifies that generating the queue an hour later preserves each deadline.

   Save and run this example

   import csv
   from io import StringIO
   from datetime import datetime, timedelta
   
   DATA = """asset_id,first_seen_utc,owner,public,admin
   edge-admin,2026-11-04T08:00:00+00:00,network-team,true,true
   public-docs,2026-11-04T09:00:00+00:00,web-team,true,false
   orphan-api,2026-11-04T09:30:00+00:00,,true,false
   """
   
   def queue(csv_text, observed_at):
       if observed_at.utcoffset() is None:
           raise ValueError("report time needs a timezone")
       output = []
       seen = set()
       for row in csv.DictReader(StringIO(csv_text)):
           if not row["asset_id"] or row["asset_id"] in seen:
               raise ValueError("missing or duplicate asset ID")
           seen.add(row["asset_id"])
           if row["public"] not in {"true", "false"} or row["admin"] not in {"true", "false"}:
               raise ValueError("public/admin must be true or false")
           first = datetime.fromisoformat(row["first_seen_utc"])
           if first.utcoffset() is None or first > observed_at:
               raise ValueError("invalid observation time")
           if row["public"] == "false":
               continue
           deadline = first + timedelta(hours=4 if row["admin"] == "true" else 24)
           output.append({"asset": row["asset_id"], "owner": row["owner"] or "UNASSIGNED",
                          "deadline": deadline.isoformat(), "overdue": observed_at >= deadline})
       return sorted(output, key=lambda item: (item["owner"] != "UNASSIGNED", not item["overdue"], item["deadline"]))
   
   now = datetime.fromisoformat("2026-11-04T13:00:00+00:00")
   rows = queue(DATA, now)
   assert rows[0]["asset"] == "orphan-api"
   assert next(r for r in rows if r["asset"] == "edge-admin")["overdue"]
   later = queue(DATA, now + timedelta(hours=1))
   assert {r["asset"]: r["deadline"] for r in rows} == {r["asset"]: r["deadline"] for r in later}
   for row in rows:
       print(row["asset"], row["owner"], row["deadline"], "OVERDUE" if row["overdue"] else "OPEN")
   print("PASS: deadlines remain anchored to first observation")
   

   Expected result · ผลที่ควรเห็น

   orphan-api is UNASSIGNED; edge-admin is OVERDUE with a 12:00 UTC deadline. The final PASS confirms that rerunning does not extend deadlines.

   If it fails · เมื่อไม่ผ่าน

   A malformed timestamp or missing field must stop this input from being accepted. Correct the export mapping rather than treating missing public or admin values as false.

3. Turn the report into an operational containment decision

   Import the queue into the work tracker using asset_id plus the exposure observation as the stable finding key. Assign unowned assets to the inventory escalation owner.
   
   For each public administrative endpoint, record the approved access gateway or source restriction, the change owner and a scheduled validation from an external test location and the authorized management zone. Close the finding only when those observations support the intended boundary; a report row is not proof of network isolation.

   Command, configuration or input

   Finding key | asset owner | decision deadline | selected boundary | change record | outside test | authorized-path test

   Expected result · ผลที่ควรเห็น

   The report produces accountable work with evidence-backed closure, while the script itself remains a read-only prioritization tool.

   If it fails · เมื่อไม่ผ่าน

   If the external test times out, distinguish policy denial from DNS, routing or probe failure before declaring the control effective. If authorized access fails, use the recorded rollback.

Recovery and cleanup

The script changes only its console output. A later firewall or access-gateway change must have its original rule recorded and an owner-approved rollback; do not remove the whole management boundary to restore a single required path.

Apply to actual work and known limits

Replace the fixture with a bounded inventory export and set decision windows through your own risk policy. This code is usable for queue generation; actual exposure containment is a separate authorized network change.

The included self-contained Python fixture was executed successfully in this Linux environment. External products and production infrastructure were not exercised.

orphan-api UNASSIGNED 2026-11-05T09:30:00+00:00 OPEN
edge-admin network-team 2026-11-04T12:00:00+00:00 OVERDUE
public-docs web-team 2026-11-05T09:00:00+00:00 OPEN
PASS: deadlines remain anchored to first observation