Cyberattack Consequences

Fracture the path from compromise to consequence.

An attacker can gain access, credentials, and new routes without gaining any authority over your organization. Authority Control can interrupt the attack path when progression requires a consequential result that is outside organizational authority.

Changing attack paths

New routes do not create new authority.

An attacker may chain tools, reuse credentials and change applications while pursuing a disclosure, transfer or privileged change. AC evaluates the proposed result on integrated paths, even when the technical route looks familiar. Detection and containment remain with security controls.

The Scale, Scope and Pace thesis →

The distinction

Reach and authority are different things.

Valid credentials, added privilege, and familiar workflows describe what an attacker can reach. The authority to create a consequential result on the organization's behalf comes only from the organization.

What compromise can produce

Valid credentials and sessions
Additional privilege or capability
Movement through connected systems
Use of familiar applications and workflows

What still requires organizational authority

Movement of value
Production and configuration changes
Release of sensitive information
Changes to trust, limits, or permissions

Compromise of a technical path does not establish authority for the consequential result.

Alongside the security stack

Two different questions about the same activity.

Security tools keep governing identities, access, endpoints, networks, detection, and response. Authority Control adds one question about the result.

Security tools ask

Is this activity compromised, anomalous, or unsafe?

Authority Control asks

Is this result within the organization's authority?

A determination says nothing about intent. The result is evaluated whether or not the activity looks malicious.

In the real world. A July 2026 agent incident shows the reached side of this question: the writes an intrusion needed to create consequences.

See both sides of the incident ↗Full case on the Evidence page →

Coverage

Movement stays with the network.
Consequence stays with authority.

Network controls govern movement. Authority Control interrupts attack-path progression when the consequential result is one the organization has placed under Authority Control's coverage.

Start with a workflow Operating during a breach

Part of one architecture

Six applications.
One organizational question.

Your organization's authority

Authority Control applies your established limits to covered consequential results.

Connects with other solutions. Identity establishes access context; Data applies when publication would disclose protected information; Post-breach Operations applies once trust has degraded.