PLATFORM · PROVE

Know the fix works before you merge.

Before a remediation PR lands, confirm it actually severs the attack path it claims to close. No merging on faith — you see the path go dark first.

policy diff · attack path−4+3
1policy "svc-acct-prod" {
2- grant: agent → svc-acct
3- reach: → s3:prod (crown jewel)
4- effect: ALLOW kms:*
5+ grant: scoped — read-only
6+ effect: ALLOW kms:Decrypt
7+ reach: ✕ s3:prod (severed)
8 review: human approver
9}
path severed: agent → s3:prod no longer reachable
previewed & confirmed before the PR merges
The problem

A fix that looks right in a diff is not the same as a fix that closes the path. Plenty of remediations narrow a policy on paper while the dangerous reachability survives through a route nobody checked. Counter-Factual compares the attack path before and after the proposed change, so you merge only once you have seen the path actually go dark.

What you get

Outcomes you can take to a skeptical security team.

  • Compare the attack path before and after the proposed fix, side by side
  • Confirm the path is severed — not merely narrowed on paper
  • Catch fixes that look right but leave the reachability alive
  • Decide with evidence, before the change ever reaches production
How it works

Three steps, no surprises.

01
Propose the fix

A remediation arrives as a change that claims to close a specific attack path.

02
See before and after

The path is shown as it stands today and as it would stand once the fix lands.

03
Merge with proof

You approve only after watching the path go dark — never on faith in the diff.

Continue the platform
Prove · proof anyone can verify

See Counter-Factual on your own estate.

Read-only to start, human-approved for every fix. Bring your clouds and code hosts; we map what’s there and hand you proof you can verify yourself.

Book a demoSee it live →All 20 features
Counter-Factual — Prove | TrustFix