The problem
A fix that looks right in a diff is not the same as a fix that closes the path. Plenty of remediations narrow a policy on paper while the dangerous reachability survives through a route nobody checked. Counter-Factual compares the attack path before and after the proposed change, so you merge only once you have seen the path actually go dark.
What you get
Outcomes you can take to a skeptical security team.
- Compare the attack path before and after the proposed fix, side by side
- Confirm the path is severed — not merely narrowed on paper
- Catch fixes that look right but leave the reachability alive
- Decide with evidence, before the change ever reaches production
How it works
Three steps, no surprises.
01
Propose the fix
A remediation arrives as a change that claims to close a specific attack path.
02
See before and after
The path is shown as it stands today and as it would stand once the fix lands.
03
Merge with proof
You approve only after watching the path go dark — never on faith in the diff.
Continue the platform