What you are evaluating
Graph output is an inference about paths, not proof of a live exploit. Twin fidelity, production safety, and operational-technology or industrial-control path claims must be demonstrated on representative systems. Continuous exposure management here is a graph program, not a scanner replacement.
A useful evaluation context
A plausible evaluation context is a hybrid estate that already has scanners and wants to test whether attack-path choke points are faithful enough to change remediation order.
Documented capabilities
The vendor describes these capabilities in the linked sources. Availability depends on the product edition and supported environment.
- Attack Graph Analysis that chains CVEs, misconfigurations, and identities toward named assets.
- Digital-twin style modeling of hybrid environments for choke-point inspection.
- Vendor-described mapping of cloud and artificial-intelligence related attack surfaces as of March 2026.
Where it fits in the work
- Name crown-jewel lab assets and the identity and network context XM Cyber is allowed to model; exclude unowned systems.
- Review attack paths as hypotheses. Record which edges come from inventory, which from configuration, and which from inferred identity.
- Fix or mitigate a choke point, then refresh the graph and keep a separate authorized exploit test if you need proof beyond inference.
APPLY THE IDEA / ILLUSTRATIVE EXERCISE
Make the outcome observable.
In a lab you own, plant a reachable identity misconfiguration and a CVE on a path to a synthetic crown-jewel dataset. Point XM Cyber only at that lab. Do not treat graph edges as authorization to exploit production.
Evidence to look for
The planted path appears as a choke point with inspectable ingredients, a control change removes or reduces that path on refresh, and no collection leaves the lab boundary.
Use synthetic data and an authorized test environment. Agree the scope and recovery steps before enabling enforcement.
Questions for your evaluation
- How closely does the twin match actual identity, network, and software state on sampled assets?
- What production-safety controls stop graph collection or validation from disrupting operations?
- Which operational-technology or industrial-control path claims are demonstrated versus marketed?
Names you may encounter: XM Cyber Attack Graph Analysis. Historical names do not establish current availability or feature equivalence.