Proof-of-Control\u2122

Standard Breach and Attack Simulation (BAS) platforms like Prelude, AttackIQ, and SafeBreach run synthetic attacks against the endpoint. They tell you whether the endpoint blocked the attack. MDRwatchdog Proof-of-Control™ is different: it runs synthetic attack probes directly against the live detection engine function itself — the same function that evaluates every real event. This is not a simulation layer. It is a direct test of the detection logic. The result proves the detection engine was capable of detecting a specific attack technique at a specific moment in time, with a cryptographic timestamp.

Each probe sends a synthetic event to the live evaluate_event() function. The function returns a verdict: DETECTED or NOT DETECTED. That verdict, the probe name, the technique it simulates, the timestamp, and the compliance controls it maps to are immediately sealed to the MDRwatchdog Quantum Audit Chain™ with Ed25519 and ML-DSA-87 (NIST FIPS 204) signatures. The record is tamper-evident and independently verifiable. An assessor can query the chain and see that, for example, at 02:00 UTC on September 8, 2026, your system detected a simulated T1059 Command and Scripting Interpreter attack — with a cryptographic timestamp they can verify themselves.

The continuous BAS results directly evidence CMMC CA.L2-3.12.1 (periodically assess security controls to determine their effectiveness), NIST SP 800-171 3.12.1 (periodically assess the security controls in organizational systems), and CA-2 (security assessments). The probes also generate evidence for AU.L2-3.3.1 (audit logging) because every probe result is sealed to the audit chain. For SOC 2, CC4.1 (monitoring controls) is satisfied by the continuous nature of the testing.

Existing BAS platforms test endpoint behavior. They do not test the detection engine itself. The novelty of Proof-of-Control™ is: (1) the probe targets the detection logic function directly, not the endpoint; (2) the pass/fail result is sealed as part of the same atomic operation that produces compliance evidence; (3) the sealed record maps the probe result to specific compliance controls simultaneously; (4) the entire sequence is PQC-signed and tamper-evident. No prior BAS platform performs these operations atomically or produces cryptographically sealed compliance evidence as a native output.

36 synthetic probes run every 6 hours automatically, covering 40 MITRE ATT&CK techniques. This means an assessor asking for proof of detection capability for a 12-month period can receive 1,460 sealed verification records per technique. The continuous cadence eliminates the point-in-time limitation of traditional penetration testing.

Yes. The Proof-of-Control™ results are sealed to the same Quantum Audit Chain™ as all other MDRwatchdog events. The assessor receives the public key and the verification endpoint. They query the chain, filter for control test events, and verify the cryptographic signatures. No MDRwatchdog access is required. The verification is mathematical, not an attestation.