A pentest report is a list. A real attack is a path. Between those two shapes is where most infrastructure maps fail, and closing that gap is the entire point of this view. Below is our reasoning, stated plainly, and what it changes for the person who has to act on the results.
The problem with a flat map
Draw every asset as an equal box on a grid, colour a few red, and you have described inventory, not risk. The reader still has to reconstruct in their head the one thing that matters: which asset an attacker reaches first, and what it costs them to get from there to the data. Two failures dominated our first attempts. Findings piled onto whichever node the crawler anchored on, so one box carried dozens of issues and the rest looked clean, the opposite of the truth. And the layout carried no notion of exposure, so a database of password hashes and a public marketing page sat at the same altitude.
Why an orbital layout, scientifically
A visualisation should encode the variable that drives the decision in the channel the eye reads first, position. We tried three layouts before this one. A force-directed graph never settles the same way twice, so it cannot be reasoned about or demonstrated repeatably. A strict OSI stack is faithful and unreadable. A node-link tree was the thing we were replacing. The layout that held up is concentric, three exposure rings around a centre:
- Outer ring, internet-facing. What an attacker reaches first.
- Middle ring, applications and services. What runs on top.
- Inner ring, data and secrets. What a breach is actually about.
Distance from the centre is exposure. Distance travelled inward is the cost of an attack. The picture now carries the argument before a single label is read, which is the property a good visualisation must have.
Honest data underneath
A layout only helps if the values are true, so attachment is deterministic and computed server-side. Every finding is routed to the asset it actually concerns, by its endpoint and its substance: a password-hash leak to the database, an exposed key to the key service, a config disclosure to the admin endpoint. Each node carries its own severity ring and a count badge, and clicking it opens the real finding list. On top, the MITRE attack path is traced from the findings themselves, ordered into tactics and walked across the real edge graph. We reformulate each step in plain language, and we never invent assets or steps that were not discovered.
Two containers, any browser, and a headset if you want one
The graph is a web scene by design, not by accident. DarkMoon ships as Docker containers and the operator opens the result in a browser, so the visualisation lives there too, with nothing to install and no vendor SDK to accept. Because it is built on WebXR, the same scene renders inside a headset straight from the browser, over HTTPS, with no Meta or Apple SDK anywhere in the stack. If you have no headset, the 2D map is the whole product. If you do, standing inside your own attack surface and following the path an adversary would take is a genuinely different way to reason about exposure than reading a table.
Our vision of security tomorrow
Autonomous testing produces more findings than a human can trace by hand, so the bottleneck moves from finding to understanding. We think the tools that matter next are the ones that let a person reason about a machine-generated attack surface quickly and correctly, brief a non-expert in a minute, and review a proposed fix with the exploit path in front of them. Spatial reasoning about attack paths, guided for non-specialists, delivered in the browser and optionally in VR, with no proprietary runtime, is our bet on that direction.
What it means for you
- Understand exposure in seconds. Position tells you what is exposed and what is close to your data, before you read anything.
- Follow the real attack path. Not a generic diagram, the actual chain from the internet to the finding that matters.
- Brief anyone. The guided narration explains the breach in plain language to an executive or a developer.
- Review in context, and in VR. On Pro, the same finding leads to a remediation pull request, reopened only after the original exploit no longer fires, and the whole surface can be walked in a headset.
It sits on top of the same engine that produced the findings. The 2D graph is the default everywhere, the VR view asks only for a WebXR browser and a secure context, and none of it requires a vendor SDK. Read the longer engineering write-up on the blog.