Breakwater ASOC / Product walkthroughs

Explore ASOC through product demonstrations.

Explore Council investigation, integrated attack paths, network context and cryptographic planning through selected product videos.

Request a demo →Back to the ASOC overview
Agentic AI / See the reasoning

AI investigates.
Humans authorize operational change.

Follow the investigation from competing explanations to a proposal your team can review.

Illustrated scenario / Scripted commentary / No device changes

Recorded product screens / AI narration / English captions available

Breakwater Response / The Council

How the Council challenges an attack scenario.

Watch five reasoning roles examine an attack scenario, challenge an explanation and prepare a response proposal.

  1. InvestigateBring observations and competing explanations into one reviewable case.
  2. ChallengeThe Skeptic examines the explanation and identifies what still needs evidence.
  3. PrepareInspect a proposed next step before authorizing an operational change.
Human authorization

Your team reviews the target, permissions, impact and recovery plan. Execution and fresh verification depend on the supported adapters and selected deployment.

ASOC in practice / Product walkthroughs

Attack paths, network context
and cryptographic planning.

Trace exposure, review network evidence and plan the cryptographic transition. Explore the workflows behind the platform.

Breakwater Discover

Trace an integrated attack path.

Modeled reachability / Simulated environment

Move through a candidate route and inspect the evidence behind each connection.

Breakwater Discover

Explore cryptographic inventory and migration options.

Simulator evidence / Migration planning

Explore cryptographic inventory and unknowns, then examine migration options using the scenario’s planning assumptions.

Breakwater ASOC

Ground the investigation in observed connections.

Recorded network view / Observed pairs and probe results / Silent

Review observed asset–peer relationships, packet counts and cryptographic probe results alongside inferred groupings and gaps in visibility.

How to read this view

What is observed

  • Packet counts per IP come from the top-N aggregates.
  • A line between an asset and a peer is shown only when the learner observed that pair together (service_edges).
  • A probe-result ring on an asset represents an actual ssh -vv key-exchange measurement.

What is inferred

  • Peers are grouped by /24 subnet. An individual bad address can be hidden within a group; an address named by a detection is pulled out and pinned individually.
  • “Known infrastructure” comes from a built-in list, rather than an observation.
  • A dotted ring with “?” means the asset has never been probed; it does not mean unsafe. Probe results match assets by literal IP, so a result recorded under a hostname still appears as never probed in this view.

What is never shown

  • An external-peer-to-asset relationship without an observed pair, traffic direction, or raw packets and payloads.
  • A gap does not establish that traffic stopped. A peer missing from a snapshot is drawn as a gap because it fell out of the top-N aggregate.
  • Flag timestamps are when this browser first saw the flags, not the underlying event times. Flags remain until a person acknowledges them.

Product recordings with narrated walkthroughs. Some screens retain earlier product names.