01
Predict the attack
CHEETaH™ anticipates the techniques and paths an adversary is most likely to use against your system. Analysts refine them into attack paths, test "assume breach" variants, and export to MITRE Attack Flow and ATT&CK Navigator.
CSRMC-ready · Authorization · Tabletop · DevSecOps · Defense
Hunt the
hunters.™
Context is the new signature.
Signatures catch what has been seen before. CHEETaH™ reads your system's own context to anticipate how an adversary would move through it, then carries that prediction into the authorization package, the release pipeline and your live alerts.
The problem
Security work happens in three rooms that never talk.
Authorization
The SSP, the POA&M and the control narratives are assembled at the end of the cycle from whatever evidence can be found, and go stale the day they're signed.
Tabletops
Exercises run on generic scenarios and end in a readout. The gaps they find rarely become requirements, tickets or detections.
Detection
The SIEM ranks alerts by rule severity, with no idea which asset carries the mission or which path an adversary would actually take.
CHEETaH™ gives all three the same source of context, and a prediction of how your system would be attacked.
How it works
Predict how they would get in. Know the moment they try.
The Heuristic Predictor is the core engine. Everything else in CHEETaH™ either feeds it context or acts on what it predicts. It works from a graph specific to your enclave and forecasts where risk is heading.
02
Find the break points
CHEETaH™ finds the single fixes that break a whole attack path, so effort goes where it stops the most. Each path becomes security requirements with NIST 800-53 controls.
03
Escalate in real time
Works with the SIEM/SOAR you already run and re-prioritizes incoming alerts by mission impact, with the reason shown for every change.
Capabilities
One workspace. Six capabilities. One source of context.
Heuristic Predictor
The core engine: enclave-specific prediction and forecasting of likely attack techniques, with a rationale for every finding.
Authorize
Drafts SSPs, RARs and IR plans from your artifacts. NIST 800-53 mapping; POA&M with eMASS sync.
Tabletop
Runs cyber tabletops and records what was mitigated, detected or missed, so gaps become tracked work.
DevSecOps with MBSE traceability
Turns attack paths into security requirements for the backlog, traced to controls and evidence. SysML v2 export.
Defend
An enclave-specific picture of your network, assets and controls, with alert priorities tuned in the SIEM/SOAR you already run.
Chester AI chat
Chat on every page: explain a finding, draft a control narrative or walk an attack path.
DevSecOps
Every commit ships with its compliance evidence.
Your pipeline already runs STIG, SCAP and vulnerability scans. CHEETaH™ turns those results into control status, a gap list and a release decision, so the authorization package grows with the code.
buildYour pipeline, unchanged
›
scanThe scanners you already run
›
cheetahFindings become control status
›
decideA clear release decision, with the reason
›
deployEvidence stays with the release
01
Map evidence to controls
Reads the scan results you already produce and maps each finding to DISA CCIs and NIST 800-53 controls. Every control gets a status and a reason.
02
Catch what slipped
Compliance that slips is caught before release, not at the next assessment. Developers see the result where they already work.
03
Keep the evidence
Every release carries its own control status, gap list and evidence, so assessors spend their time on the gaps.
Cyber Tabletop
A tabletop that ends in work, not slides.
Start from attack paths predicted for your system, record what was mitigated, detected or missed as you walk them, and carry every gap into the places where it gets fixed.
01
Start from your context
The Heuristic Predictor proposes likely attack paths for your system. Pick one or build your own.
02
Draw the attack path
Build the path visually, from first foothold to mission effect. Run "assume breach" variants.
03
Walk it with the team
Record what was mitigated, detected or missed at each step. CHEETaH™ shows where one fix stops the path.
04
Leave with the outputs
Requirements, POA&M items and alert priorities come straight from the results. The exercise is saved for next time.
ExportsMITRE Attack FlowATT&CK Navigatordraw.ioSysML v2Step table CSVPrint-ready PNG / SVG
Deployment and trust
Built for the enclave, not the cloud.
Your analystsA web app in the browser; nothing to install on the desktop
‹›
CHEETaH™ serverOn your hardware, with your certificates. Nothing leaves your enclave.
‹›
Your toolsLocal AI models, your SIEM/SOAR, eMASS
‹›
Your pipelineThe CI/CD you already run
On-prem firstRuns inside your enclave; fully air-gapped with local models. No telemetry, no update checks.
Human in the loopEvery finding and level change is explained and reviewable. No AI in the pipeline's pass/fail decision.
Customer-approved modelsLocal open-weight models from U.S. developers, or approved cloud frontier models under your account.
Standards-nativeReads and writes the formats your assessors and red team already use.
CSRMC-readyNIST SP 800-53DISA CCISTIG / SCAPeMASSMITRE ATT&CKAttack Flow 2.0SysML v2CycloneDX SBOM
Pilot program
Start with one system.
A fixed-scope pilot puts CHEETaH™ on your hardware and proves it on real work. Success criteria are agreed in writing at kickoff. You keep every output whether or not you license.
Phase 1
Install and ingestCHEETaH™ on your hardware. Load existing scans, topology and authorization artifacts. First control status matrix and gap list.
Phase 2
Gate the pipelineCHEETaH™ added to one pipeline, with results posted to your developers.
Phase 3
Tabletop and tuneFacilitated exercise on predicted attack paths. Requirements and POA&M items generated. SIEM/SOAR priorities tuned.
Phase 4
Measure and decideA report against the success criteria you set, and a clear basis for the licensing decision.
Questions we hear first
Straight answers.
What does the AI model see, and where does it run?
With local models, nothing leaves your enclave: the model runs on your hardware and CHEETaH™ sends nothing outside it. Cloud frontier models are used only if you approve them, under your own account. Your data is never used to train anything.
Is the pipeline gate making decisions with an LLM?
No. The release decision is deterministic, and every result carries its reason. Language models help where they add value, such as explaining findings and drafting narratives, and a person reviews before anything is acted on.
Does it replace our SIEM, scanners or eMASS?
No. CHEETaH™ reads the scan results you already produce, works with the SIEM/SOAR you already run, and syncs POA&M items with eMASS. It adds the context and the prediction those tools don't have.
What do we need to run it?
One on-prem server or workstation to start, with a GPU for local AI models. Larger deployments scale to a dedicated server, and we size it with you during the pilot.
Is the demo on real data?
Never. Demonstrations use synthetic systems and synthetic scan results. We don't bring customer or CUI data to a demo, and we ask that you don't either.
Request a demo or a pilot
Context is the new signature.
Tell us a little about your system and we'll set up a demo on synthetic data, or scope a pilot.
Phone
(256) 836-4550
(256) 836-4550
Capstone Research Corporation
6723 Odyssey Drive NW, Suite 320
Huntsville, AL 35806
6723 Odyssey Drive NW, Suite 320
Huntsville, AL 35806