MITRE ATT&CK coverage
Every technique QPen can express, and which of them have been triggered by an engagement so far. A technique lights up when a finding or a red team action in its category has landed at least once.
Technique coverage
Establish sessions with a hybrid group so a recorded transcript cannot be unwound once quantum capability arrives.
Restrict management listeners to an allow listed source range and retire services that carry no current owner.
Terminate remote desktop and remote framebuffer access inside a quantum safe tunnel rather than on the public interface.
Remove unauthenticated administrative paths from the public origin and place a policy aware proxy in front of it.
Set Secure, HttpOnly and SameSite on every session cookie and scope the cookie to the narrowest path that works.
Move credential material into a hardware backed store, rotate on exposure and require a second factor on every administrative login.
Pin the issuing authority and require hybrid key agreement so an interposed relay cannot substitute its own public key.
Suppress server, framework and build version banners at the edge so reconnaissance yields no version specific target list.
Category to technique map
A finding carries a category, and the category resolves to the techniques that category can express. The scanner uses the same map the Rust engine does.
| Category | Techniques |
|---|---|
| Web | T1190 T1592 T1539 T1557 |
| Network | T1046 T1133 |
| Cryptography | T1040 T1557 |