Concepts

Toxic combinations

Individually-tolerable findings that together open a real attack path — deduplicated and risk-scored by the engine, so you fix the path, not the noise.

A toxic combination is a set of individually-tolerable findings that together open a real privilege-escalation or lateral-movement path. Any one of them might be acceptable in isolation; chained, they become an exploit. The engine deduplicates and risk-scores these combinations so you triage the path, not a flat stream of alerts.

The answer to alert fatigue

Instead of ranking thousands of individual findings, TrustFix surfaces the handful of combinations that actually compose into an attack. Each combination expands to show its attack-path description, the chain of finding types that make it up, and links to the exact contributing finding ids — so you can see precisely which fixes break the path.

One finding away

A companion view flags patterns that are exactly one finding-type short of becoming a CRITICAL combination, tagged to the relevant MITRE ATT&CK techniques. This turns the combination from a post-mortem into a forecast: fix the near-miss before the last piece lands. The same predictive signal also gates issuance — the Issuance Guard refuses to mint a credential that would complete a one-away critical combination.

Where you see it

• Toxic Combinations (/toxic-combinations) reads GET /api/toxic-combos, with a POST /api/toxic-combos/scan to re-scan after new findings land and GET /api/toxic-combos/predicted for the one-away view.
• The same combinations are drawn as crimson dashed toxic edges on the Trust Graph, and you can simulate cutting them in the Counter-Factual blast-radius view.