glasscastles.vercel.app · Public assets · Operating model · Canonical URLs · Security policy · Sec-TP RC1

GlassCastle Security makes complex systems visible enough to inspect, understand, and improve.

We build evidence-first security, connectivity, and analytical systems for people who need to know what their environments are actually doing. Our work emphasizes observable relationships, provenance, uncertainty, explicit boundaries, and operational state instead of opaque conclusions.

Evidence before assertion. Visibility before assumption.

GlassCastle Security is a one-human, multiple-AI security research and product company. One human Founder/Owner remains the accountable company authority; specialized AI departments support strategy, research, engineering, security operations, finance, customer work, education, communications, and infrastructure under explicit approval boundaries.

We do not present AI activity as human headcount or tool access as corporate authority. Consequential legal, financial, security-scope, identity, destructive-production, regulatory, and material public decisions remain behind human approval gates.

10 departments · 10 recurring tasks · every 2 hours · starts staggered 12 minutes apart. Cycles begin on even hours in America/New_York (Eastern time). Growth & Partnerships brings together sales and marketing; Education & Customer Success brings together learning and customer support.

Read the public operating model →

ShatteredCastle(s) is the umbrella name for GlassCastle Security's security tool and SaaS suite.

Scope → Discover → Assess → Validate → Impact → Remediate

• ScopeSentinel · Scope — https://glasscastles-scopesentinel.vercel.app/ Compile program prose, structured scope, exclusions, rate limits, asset-identity mismatches, and unresolved ambiguities into a fail-closed execution contract.
• Kork · Discover — https://glasscastles-kork.vercel.app/ Pin artifacts, map relationships, preserve provenance, and build an inspectable investigation topology.
• ShatterAssay · Assess — https://glasscastles-shatterassay.vercel.app/ Perform bounded outside-in assessment and static research while enforcing the current scope envelope.
• GlassWitness · Validate — https://glasscastles-glasswitness.vercel.app/ Turn controlled baselines, independent confirmations, negative controls, and evidence hashes into deterministic validation receipts.
• BlastRadial · Impact — https://glasscastles-blastradial.vercel.app/ Model downstream propagation and identify relationship paths carrying the greatest consequence.
• Investigation Console · Remediate — https://glasscastles-investigation-console.vercel.app/ Bring scope, evidence, findings, validation, impact, claims, and remediation into one local-first investigation surface.

The fabric is intentionally fail-closed: unknown policy does not become permission, scanner output does not become proof, and proof does not silently rewrite impact.

ShatteredCastle(s) also exposes the final 2017 Unified Kill Chain developed by Paul Pols as a separate tactical attack-path model. The UKC does not replace the six-stage defender workflow. It describes attacker paths using 18 tactical phases and explicitly permits bypassed, repeated, branched, and out-of-order phase occurrence. Pivoting is modeled as a choke point.

• Public model/API: https://glasscastles.vercel.app/api/v1/ukc
• Offline utility: node tools/ukc-engine.mjs model
• Model audit: UKC-AUDIT.md

The UKC implementation is versioned as Pols-2017-final. Current MITRE ATT&CK mappings are intentionally not silently merged into this historical model.

ShatteredCastle(s) also implements the original 2013 Diamond Model of Intrusion Analysis by Sergio Caltagirone, Andrew Pendergast, and Christopher Betz. Diamond complements UKC rather than replacing it: UKC models explicit tactical progression while Diamond models the relationships among Adversary, Infrastructure, Capability, and Victim within evidence-bearing intrusion events.

• Public model/API: https://glasscastles.vercel.app/api/v1/diamond
• Offline utility: node tools/diamond-engine.mjs model
• Model audit: DIAMOND-AUDIT.md

Unknown Diamond features remain knowledge gaps, per-feature confidence is preserved as supplied, Phase may explicitly reference UKC, and v1 does not auto-attribute, auto-cluster Activity Groups, infer causality, or alter impact scores.

ShatteredCastle(s) implements David J. Bianco's revised Pyramid of Pain as a third orthogonal lens. It ranks explicitly supplied detection-indicator categories by relative adversary replacement burden, from hashes through TTPs. The rank is ordinal only: it is not a severity score, dollar estimate, attribution signal, or permission to act.

• Public model/API: https://glasscastles.vercel.app/api/v1/pyramid
• Offline utility: node tools/pyramid-engine.mjs model
• Model audit: PYRAMID-AUDIT.md

The composition follows Bianco's own kill-chain guidance: indicators can be explicitly bound to UKC phases to build a detection plan, while explicit Pyramid-to-Diamond bindings preserve event context. ShatteredCastle(s) never guesses an indicator type from its value and never converts a Pyramid tier into a numeric adversary-cost claim.

ShatteredCastle(s) integrates MITRE ATT&CK® v19.2 as a separate behavior taxonomy. ATT&CK tactics represent adversary goals, techniques represent how those goals are pursued, and sub-techniques provide lower-level behavior descriptions. The local compact catalog covers Enterprise, Mobile, and ICS while preserving exact ATT&CK identifiers, tactic membership, platforms, parent relationships, object versions, modification times, and source hashes.

• Public model/API: https://glasscastles.vercel.app/api/v1/attack
• Offline utility: node tools/attack-engine.mjs model
• Model audit: ATTACK-AUDIT.md

ATT&CK selectors are exact-only. ShatteredCastle(s) does not classify free text, scanner findings, topology labels, or telemetry into ATT&CK techniques automatically. Cross-model bindings to UKC, Diamond, and Pyramid are explicit-only; ATT&CK context does not change authorization, proof thresholds, severity, or BlastRadial impact scores.

© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE does not endorse GlassCastle Security or ShatteredCastle(s). See the MITRE ATT&CK Terms of Use for license details.

ShatteredCastle(s) integrates MITRE D3FEND™ ontology 1.6.0 as the defensive countermeasure knowledge-graph lens. Its seven defensive tactics are preserved in ontology order: Model → Harden → Detect → Isolate → Deceive → Evict → Restore. The compact catalog contains 271 defensive techniques across 30 top-level technique families.

• Public model/API: https://glasscastles.vercel.app/api/v1/d3fend
• Offline utility: node tools/d3fend-engine.mjs model
• Model audit: D3FEND-AUDIT.md
• License/trademark notice: D3FEND-NOTICE.md

D3FEND's downloadable full mappings are explicitly treated as inferred knowledge-graph relationships. ShatteredCastle(s) returns them as defensive candidates, never automatic prescriptions or effectiveness claims. D3FEND 1.6.0's ATT&CK mapping substrate is v19.0 while ShatteredCastle ATT&CK is v19.2, so cross-version joins require an exact current ATT&CK external ID. Mobile has no rows in the D3FEND 1.6.0 full inferred mapping file and remains an explicit knowledge gap.

ShatteredCastle(s) implements Ryan Stillions' original Detection Maturity Level (DML) model as the detection-abstraction and evidence-backed maturity lens. The original ladder contains DML-0 through DML-8: None/Unknown, Atomic Indicators, Host & Network Artifacts, Tools, Procedures, Techniques, Tactics, Strategy, and Goals. The later DML-9 Identity extension is deliberately excluded from this v1 so detection maturity never becomes automatic actor attribution.

• Public model/API: https://glasscastles.vercel.app/api/v1/dml
• Offline utility: node tools/dml-engine.mjs model
• Model audit: DML-AUDIT.md

A DML number is never accepted as an organization-wide maturity claim by itself. ShatteredCastle only marks a detection record demonstrated=true when its supplied evidence shows that the stated scope can consume the relevant threat information, detect it, and act on it, with validated/deployed status. Assessments are input-bound and non-cumulative: one DML-6 analytic does not prove DML-6 organizational maturity or complete DML-1 through DML-5 coverage.

• GlassCastle Security — https://glasscastles.vercel.app/
• GlassCastle(s) Mining Co. — https://glasscastles-mining.vercel.app/
• ScopeSentinel · Scope — https://glasscastles-scopesentinel.vercel.app/
• Kork · Discover — https://glasscastles-kork.vercel.app/
• ShatterAssay · Assess — https://glasscastles-shatterassay.vercel.app/
• GlassWitness · Validate — https://glasscastles-glasswitness.vercel.app/
• BlastRadial · Impact — https://glasscastles-blastradial.vercel.app/
• Investigation Console · Remediate — https://glasscastles-investigation-console.vercel.app/
• Sec-TP RC1 · Secure capability transport — https://glasscastles-sectp.vercel.app/
• Web3 Launch Readiness · Bounded evidence service — https://glasscastles-web3-launch-readiness.vercel.app/
• Torus OSINT · Public OSINT/OSR research surface — https://glasscastles-torus-osint.vercel.app/

The public visual system uses Roboto Mono, void-black surfaces, emerald signal (#35ff95), violet boundary (#9a6cff), and evidence-first hierarchy across the live product family.

The shortest path from curiosity to a real GlassCastle artifact:

• $3 Outside-In Launch Readiness Mini Kit — a repeatable self-service workflow plus machine-readable evidence template. Buy with Stripe · Ko-fi
• $25 Real-Device APK Smoke Test — one bounded test pass on GlassCastle-owned physical Android hardware. You provide the APK URL and what you want tested; fulfillment begins when a compatible reviewed Android node is online. Book the smoke test
• $50 Web3 Launch Readiness Evidence Snapshot — one bounded public launch surface reviewed and packaged by GlassCastle Security. Book the Snapshot · View the offer

For larger work: $250 Surface Survey · Book | $750 Evidence Expedition · Book

Compare the evidence ladder

• Security visibility — bounded observations, evidence packaging, relationship maps, and investigation workflows
• Secure connectivity — capability-scoped tunnels, routing, translation, and protocol boundaries
• Edge + device systems — endpoint runtimes, orchestration, field nodes, and human/device interfaces
• Analytical systems — search, discovery, representation, provenance, and relationship-centric security analytics
• Technical services — clearly scoped assessments and evidence-driven reviews with limitations stated up front

Prospect → Ore → Assay → Survey → Expedition

Each step increases evidence depth without silently expanding authority.

• Prospect · Free — Outside-In Launch Readiness Quick Scan — inspect one public surface yourself in about five minutes. Run the Quick Scan
• Ore · $3 — Outside-In Launch Readiness Mini Kit — repeatable self-service workflow with a machine-readable evidence template. Get the Mini Kit · Ko-fi
• Assay · $50 — Web3 Launch Readiness Evidence Snapshot — one bounded public launch surface reviewed and packaged by GlassCastle Security. Book the Snapshot · View the offer
• Survey · $250 — GlassCastle Surface Survey — up to five related public targets examined together with a compact evidence map. Review scope · Book with Stripe
• Expedition · $750 — GlassCastle Evidence Expedition — one bounded investigation objective across multiple public evidence sources. Review scope · Book with Stripe

• Sec-TP v0.6.0rc1 — research/reference secure capability tunnel with TCP/QUIC carriers, pinned identity, default-deny authorization, bounded sessions, tamper-evident audit chaining, and HHT-informed defensive telemetry. RC1 passed 162 automated tests before packaging. It is not an audited production VPN. Evaluate Sec-TP RC1 · Download release

Publication is exposure, not demand. GlassCastle Security reports revenue only when a payment provider verifies a completed payment.

A GlassCastle result should make five things visible:

Observation → Evidence → Meaning → Boundary → Next useful action

We say when something is experimental. We distinguish hypotheses from measurements. We do not present estimates as realized value, and we do not hide uncertainty because it makes a slide look cleaner.

• GlassCastle Fabric — secure connectivity, translation, routing, and protocol normalization
• GlassCastle Edge — endpoint runtimes, device orchestration, and human/device boundaries
• GlassCastle Intelligence — search, discovery, representation, and security analytics
• GlassCastle Economy — external value, revenue experiments, and economic truth
• GlassCastle Control Plane — governance, evidence, reconciliation, and execution boundaries

Evidence before assertion. Latest != canonical. Unknown != False. Security Through Visibility.