Walk through a sample incident lifecycle and explore how common security layers fit together. Every event and diagram here is illustrative — no live systems are monitored or changed.
01 Trace a response02 Choose a profile03 Toggle protection layers
IDENTITYDETECTIONRECOVERYSECURITY MODEL / NODE 01
01 / INCIDENT LIFECYCLE
One alert. A controlled response.
Choose a scenario and step through a common response pattern. This is a demonstration workflow, not a live SOC feed or a substitute for your incident plan.
◉
Scenario simulatorIllustrative event data · No connection to live infrastructure
DEMO
Demo status: Alert received/1 of 5
DETECT / EXAMPLE 0101
Validate the initial signal.
Correlate the suspicious sign-in with the reported message, identity context and available logs. Preserve the timestamps and source of the alert.
DISCUSSION CHECKPOINT
What evidence confirms the activity, and who is authorised to lead the response?
02 / ARCHITECTURE EXPLORER
Build a layered defence.
Select a sample environment and toggle security layers. The model updates to show a discussion-ready stack, not a complete reference architecture or a certification of coverage.
CHOOSE AN ENVIRONMENT
A maintainable baseline focused on identity, endpoint controls, perimeter exposure and recoverability.
SECURITY LAYERS
ILLUSTRATIVE CONTROL MAP
SMB / Core protections
MODEL VIEW
ORGANISATION
◈
5 of 8 layers selected
Treat these as discussion areas to validate, assign owners to and test regularly.
SUGGESTED DISCUSSION START
Start with identity hardening, endpoint protection, network exposure and a tested recovery path.
ⓘ
Real architectures must be tailored to asset inventory, threat model, regulatory duties, existing controls, operational capacity and a formally agreed scope. This configurator stores nothing and does not connect to your systems.
TURN THE MODEL INTO A PLAN
Start with your actual environment.
Use the guided assessment to organise a first conversation, or explore Shield InfoSec's services.