Bus-level attack classes fired at a live detection stack and scored honestly — including the ones nothing on the bus can see. The evidence a program office asks for, built as a working console.
Interface portraits. Every program name, bench tag, operator, and score is fictional — the engineering underneath is real.
Illustrative interface portraits · All programs, benches, operators, and scores are fictional.
Cyber survivability language now sits in platform RFPs, and government test organizations expect bus-level evidence — what happens on the MIL-STD-1553 bus under attack, not what the enterprise scanner found — before a systems-integration-lab slot gets scheduled. Most companies pursuing that work show up with policy binders and network scan reports. Neither answers the question the test director is going to ask.
The evidence that moves a program forward looks different: named attack classes executed against the actual data bus, a detector whose scoring is independent of the product being scored, and an audit trail somebody else can verify. That is instrumentation, and it has to be engineered.
The bearing: Downrange is that instrumentation, end to end — attack cases, clean-room detection, control-overlay scoring, a hardware-arm interlock, a tamper-evident audit chain. It sits here so a company pursuing DoD platform work can see the standard of evidence before a program office asks for it.
Nineteen attack classes across the MIL-STD-1553 threat surface — bus injection, spoofed remote terminals, timing manipulation, PNT interference — executed as live rounds against the detection stack. Intercepts flare green. Escapes stay red, because a range that hides its misses isn't a range.
Eight clean-room analyzers — bus conformance, timing, command policy, content, PNT integrity, terminal fingerprinting among them — read the monitor stream and decide caught or missed from the traffic itself. Attacks that emit no on-bus signal score as “missed, undetectable on-bus,” never as a fake catch. That honesty is the product.
Bus-level test cases crossed with security-control overlays and recomputed into a per-overlay readiness score. Stack an overlay, watch the detection rate move — the readiness argument becomes arithmetic instead of adjectives.
One canonical event model with thin serializers outward: Elastic Common Schema for the SIEM, Cursor-on-Target for TAK operational pictures, program alert formats for the command side. Detection is computed once; the paperwork is a serializer.
No case fires at real hardware without a named, authenticated operator, a software arm scoped to the hazard tier, and a physical transmit-inhibit interlock that reads fail-safe to unarmed. Every execute, arm, disarm, and refusal lands in a hash-chained, append-only audit journal a test director can verify offline.
The console is self-contained: inline assets, embedded data, no external requests, CSP-safe. The bench runs mock-first, so the full attack suite executes with zero hardware. Detection is standards-only — no vendor code, no signatures — and the audit journal is verifiable with no network and no vendor tooling.
A self-contained single page: inline CSS and JS, embedded data, no build step, no external requests, CSP-safe. Tabbed views for summary, operator, readiness, threat intel, PNT/EW, and provenance, in a dark cockpit-MFD idiom. It renders with no server running — the model view is a working artifact, not a demo shell.
A Python 3.12 + FastAPI backend executes attack cases against a real or simulated MIL-STD-1553 / ARINC 429 bench. Built mock-first: the full suite runs with zero hardware, and COTS 1553 interface cards drop in behind a driver seam without touching case or UI code.
Bus monitor words normalize into an ordered, seekable message stream; the analyzers fuse to a verdict; windowed scoring grades captured, escaped-unexpected, and escaped-by-design against a ground-truth inject ledger. A golden-corpus replay gate — baseline, verify, diff — blocks any engine change that moves the numbers unexplained.
An authenticated gateway checks the operator before a driver even resolves; real hardware additionally requires the physical transmit-inhibit arm signal. The audit journal behind it is standard-library only — hash-chained, crash-tolerant, verifiable with no network and no vendor tooling.
One canonical detection event serialized to Elastic Common Schema, CoT/TAK, and downstream alert formats; readiness rolls up per control overlay. The audit journal stays a separate, sealed stream from the detection feed — evidence and telemetry never share a channel.
One conversation, one written summary, no commitment. The bearing comes first.
Schedule a call — 30 min