Threat Sphere by Clan Security
Know what’s covered. Find what only looks covered.
Security coverage intelligence and detection engineering for satellites, ground systems and communication links.
Illustration: a synthetic mission with a satellite, a communication link, a ground station, an identity boundary, a command path, and a user terminal that the satellite serves over a user link.
Evidence-Grounded Threat Analysis
Threat Sphere draws on mission architecture, telemetry and security tools, and keeps every source attributed.
Observed threats come from that evidence; architecture-inferred threats follow from the design. Techniques align with MITRE ATT&CK and SPARTA.
Illustration: three labeled evidence sources feed the mission: telemetry into the ground station, mission architecture into the identity boundary, and security tools into an observed threat on the communication link. An architecture-inferred threat on the command path has no source line, because it comes from the design.
Security Coverage Intelligence
See which detections and controls genuinely protect each asset, which only appear to, and where real gaps remain.
Covered means a detection and a control; partial means only one of them. False coverage is a detection that depends on telemetry the asset does not produce.
Illustration: the identity boundary is covered, with both a detection and a control; the satellite is partial; the communication link has false coverage; and the command path has a security coverage gap.
Attack-Path Understanding
See how an adversary could move through the mission, and where a route is blocked or stays open.
Routes are computed deterministically from the modeled architecture and its coverage, not generated by an AI model.
Illustration: the command path runs from mission control inside the identity boundary to the ground station, and from the ground station up to the satellite. From external entry, a route through the ground station toward mission control is blocked at the identity boundary, while a route through the ground station goes straight up the command path to the satellite and down the user link to the user terminal, the mission objective: a viable route.
Human-Governed Detection Engineering
Specialized agents each do one job (discover, model, map, validate, draft) in a fixed, checked sequence. For the gaps that matter, they draft grounded detection rules from the telemetry that exists.
Nothing reaches your security tools until a person approves it.
Illustration: a new detection rule for the command-path gap is drafted from the ground station’s telemetry and awaits a decision. Once a person approves it, the rule reaches the security tools and the gap is marked detection approved.
Continuous Mission Assurance
As assets, telemetry and threats change, Threat Sphere reassesses coverage. Meaningful change can trigger renewed analysis through the same governed workflow.
Illustration: a new asset joins the mission, a sweep reassesses coverage and the new asset is marked reassessed.