4.3 — Scenario generator

Workshop 4.3: build operational scenarios from the actual state of your system, rather than from a generic catalogue.

Principle

An operational scenario describes the attack path a risk source follows to reach an essential asset, as a chain of actions phase by phase:

KNOW → GET IN → FIND → EXPLOIT → OBJECTIVE

Each action corresponds to a real attack technique (Simple library or MITRE ATT&CK). The generator only proposes techniques made possible by the vulnerabilities detected in your installation.

The deduction chain

Step	Content
1. Detected vulnerabilities	Audit non-conformities (ISO 27001, ANSSI…) or entered vulnerabilities (weak authentication, unpatched CVEs, missing segmentation…)
2. Canonical vulnerabilities (VUL-xxx)	Central pivot: group ground-level vulnerabilities by family (F01 Auth, F02 Patching, F03 Network…) and declare the techniques they make possible
3. Authorised techniques	Union of the techniques from all active vulnerabilities
4. Scenarios	For each phase, selection among the authorised techniques, within the configured number of actions

The result is an attack graph you can refine before validation.

Unconditional techniques

OSINT, basic phishing and similar techniques are always included: they don't require any specific flaw. A system with no known vulnerability remains attackable through these avenues.

Two source modes

Mode A — from audit / frameworks. Uses the assessment from workshop 1.4. Each non-compliant article is mapped to ISO 27002 controls, which are themselves linked to canonical vulnerabilities. When to use it: you've carried out a full audit and want scenarios anchored in your actual non-conformities.

Mode B — classic vulnerabilities. Manual selection of standard categories (injection, weak authentication, unpatched CVEs, supply chain, OT/ICS…). When to use it: no formal audit, or exploring a specific threat type.

With or without supporting assets

With — each supporting asset carries its own vulnerabilities. Result: one scenario per supporting asset, with techniques adapted to each component.

• If the 1.5 assessment exists → effective score: score 1-2 = confirmed vulnerability, score 3-4 = no vulnerability.
• Otherwise → potential score: the supporting asset's category determines the applicable vulnerabilities.

Without — the installation is treated as a whole, all active vulnerabilities are aggregated. Result: one scenario per targeted essential asset.

Quality depends on upstream work

The generator does not create information: it recombines the information from workshops 1.4 and 1.5. An unassessed baseline produces poor or generic scenarios.