Bus-level attack classes fired at a live detection stack and scored honestly - including the ones nothing on the bus can see. The evidence a program office asks for, built as a working console.
The real DOWNRANGE readout, recreated - summary, operator, readiness, threat intel, PNT/EW, and provenance. Every program, bench, and score here is fictional; the engine, the scoring, and the honesty are real. Scroll the panel - each view is a working screen.
The headline read: multi-domain detection proven on a real pen-test range, grounded in real benign telemetry. Thirty-three attack techniques across eight families, ten control overlays, four alert dialects - and the honest framing that a program office needs before it spends a dollar.
Scope the rounds by attack class, toggle the control overlays, and fire down the bus against the detection engine. Green intercepts stop at PICKET; red escapes run through to egress. Every caught round emits its alert record - ECS, TAK CoT, or a program format - from one canonical event.
Two truths side by side. Layered defense climbs from ~75% to ~94% as rule layers stack - every gain data, not code. Ground truth shows the network tier carries ~95% of real alert volume, the avionics bus the smallest slice. Capability says what can be caught; proportion says what to fund first.
The unit under test runs the same stack this range exercises - the avionics IDS on the 1553/429 bus, Snort and Zeek on the network, Sagan on logs. The fleet alert picture, severity-ranked, in one live feed.
The strategic where-and-when of GPS interference, and the tactical per-attack EGI: figure-of-merit jump, nav-mode fallback, drift rate, and time-to-detect - per case, per tail. The console shows the honest residual too: attacks with no on-bus signal, scored missed rather than faked.
Thirty-three validated, zero modeled. Real benign telemetry, zero false alarms. Every value on every screen is labeled - validated, computed, or modeled - and a hash-chained, append-only audit journal lets a test director replay the ledger and get the same numbers. That is what keeps it honest.
Every escape is a specification for the rule that would have caught it. DOWNRANGE turns that into a workflow - and points at real-time threat mitigation at the edge.
Cyber survivability language now sits in platform RFPs, and government test organizations expect bus-level evidence - what happens on the MIL-STD-1553 bus under attack, not what the enterprise scanner found - before a systems-integration-lab slot gets scheduled. Most companies pursuing that work show up with policy binders and network scan reports. Neither answers the question the test director is going to ask.
The evidence that moves a program forward looks different: named attack classes executed against the actual data bus, a detector whose scoring is independent of the product being scored, and an audit trail somebody else can verify. That is instrumentation, and it has to be engineered.
The bearing: Downrange is that instrumentation, end to end - attack cases, clean-room detection, control-overlay scoring, a hardware-arm interlock, a tamper-evident audit chain. It sits here so a company pursuing DoD platform work can see the standard of evidence before a program office asks for it.
Nineteen attack classes across the MIL-STD-1553 threat surface - bus injection, spoofed remote terminals, timing manipulation, PNT interference - executed as live rounds against the detection stack. Intercepts flare green. Escapes stay red, because a range that hides its misses isn't a range.
Eight clean-room analyzers - bus conformance, timing, command policy, content, PNT integrity, terminal fingerprinting among them - read the monitor stream and decide caught or missed from the traffic itself. Attacks that emit no on-bus signal score as “missed, undetectable on-bus,” never as a fake catch. That honesty is the product.
Bus-level test cases crossed with security-control overlays and recomputed into a per-overlay readiness score. Stack an overlay, watch the detection rate move - the readiness argument becomes arithmetic instead of adjectives.
One canonical event model with thin serializers outward: Elastic Common Schema for the SIEM, Cursor-on-Target for TAK operational pictures, program alert formats for the command side. Detection is computed once; the paperwork is a serializer.
No case fires at real hardware without a named, authenticated operator, a software arm scoped to the hazard tier, and a physical transmit-inhibit interlock that reads fail-safe to unarmed. Every execute, arm, disarm, and refusal lands in a hash-chained, append-only audit journal a test director can verify offline.
The console is self-contained: inline assets, embedded data, no external requests, CSP-safe. The bench runs mock-first, so the full attack suite executes with zero hardware. Detection is standards-only - no vendor code, no signatures - and the audit journal is verifiable with no network and no vendor tooling.
A self-contained single page: inline CSS and JS, embedded data, no build step, no external requests, CSP-safe. Tabbed views for summary, operator, readiness, threat intel, PNT/EW, and provenance, in a dark cockpit-MFD idiom. It renders with no server running - the model view is a working artifact, not a demo shell.
A Python 3.12 + FastAPI backend executes attack cases against a real or simulated MIL-STD-1553 / ARINC 429 bench. Built mock-first: the full suite runs with zero hardware, and COTS 1553 interface cards drop in behind a driver seam without touching case or UI code.
Bus monitor words normalize into an ordered, seekable message stream; the analyzers fuse to a verdict; windowed scoring grades captured, escaped-unexpected, and escaped-by-design against a ground-truth inject ledger. A golden-corpus replay gate - baseline, verify, diff - blocks any engine change that moves the numbers unexplained.
An authenticated gateway checks the operator before a driver even resolves; real hardware additionally requires the physical transmit-inhibit arm signal. The audit journal behind it is standard-library only - hash-chained, crash-tolerant, verifiable with no network and no vendor tooling.
One canonical detection event serialized to Elastic Common Schema, CoT/TAK, and downstream alert formats; readiness rolls up per control overlay. The audit journal stays a separate, sealed stream from the detection feed - evidence and telemetry never share a channel.
One conversation, one written summary, no commitment. The bearing comes first.
Schedule a call - 30 min