Threat+Constellation
Live— UTC

Observation-to-Disclosure Model

Four stages. No matched conversion rates.

  1. 01

    ACTUAL ATTACK ACTIVITY

    The underlying activity that may be incompletely observable. It is not recovered by counting alerts.

    • Sensor coverage gaps
    • Detection uncertainty

  2. 02

    OBSERVED SIGNALS

    Events captured by sensors, logs, and monitoring systems. Coverage and detection shape this layer.

    • Sensor coverage gaps
    • Detection uncertainty
    • Investigation delays

  3. 03

    CONFIRMED COMPROMISE

    Cases where investigation establishes successful unauthorized access or impact.

    • Verification constraints
    • Investigation delays

  4. 04

    PUBLIC DISCLOSURE

    Incidents made visible through public reporting. Disclosure is a selection process, not a census.

    • Disclosure selection effects
    • Reporting latency

  5. Constraints

    • — Not every attack signal corresponds to a unique attack.
    • — Not every compromise produces a public disclosure.
    • — Not every public disclosure represents a single attack.
    • — This pathway is conceptual. It is not a conversion funnel and has no numerical rates unless matched cohorts exist.
Synthetic illustration of coverage versus observed signals
Underlying5000Observed1224
  • Underlying: 5000 · MODELLED
  • Observed: 1224 · OBSERVED

Synthetic illustration of coverage versus observed signals

Unit: synthetic attack_attempts

Time window: scenario C closed-form

Measurement scope: Reduced monitoring coverage illustration

Data origin: SYNTHETIC

SYNTHETIC — NOT REAL-WORLD OBSERVATION