Map your blast radius before the breach does.
Twenty-seven incidents landed in forty-eight hours. Most of them cannot touch you. Ferroscope takes the stack you actually run and shows the two that can — then ranks the fixes by risk removed per minute.
- 0
- Incidents
- 0
- In your path
- 0
- Safety score
- 0 min
- First fix
2 incidents intersect this stack.
Nothing is confirmed breached. Two things are inside the blast path.
Largest contributors
01The wave
Fourteen disclosures in forty-eight hours.
02Section
Three questions, one instrument.
Most breach dashboards answer a question you did not ask. Ferroscope answers the three that decide what you do next.
What actually touches me?
A headline is not an exposure. Declare your browser, runtimes, hosts, CAs, and accounts; the matcher only fires on intersection.
Open the blast radius →02How far does it spread?
One compromised root becomes a browser session, then a CI token, then a deploy. The cascade simulator makes the path visible.
Run a cascade →03What do I fix first?
Rank by risk removed per minute, not by severity. A three-minute certificate refresh can outrank a two-hour audit.
Open the planner →03Section
The files that matter.
Six of the twenty-seven, chosen because each one teaches a different failure mode. The atlas holds the rest.
04Blast radius
A graph, not a headline.
The default laptop touches two incidents. One is a certificate authority that browsers blocked but Python still trusts. The other is a bank breach that turns a password into a money problem. The graph is the shortest honest explanation of why.
- Nodes are only the components you declared.
- Edges are intersections, not guesses.
- Near misses are shown one step away, not hidden.
17
Stack
2
Matched
23
Near miss
05Section
The fix order is the product.
Ranked by risk removed per minute. Completing an action recalculates the residual risk multiplicatively, so the numbers cannot lie.
Refresh the Python CA bundle
certifi is a vendored trust store. It does not follow Windows Update, so a compromised root can survive there for months.
Rotate SBI credentials and UPI PIN
A confirmed bank breach means the old password and PIN should be treated as public. Change both from the official app, never a link.
Turn on phishing-resistant 2FA
An authenticator app or passkey turns a stolen password into a dead end. SMS is better than nothing but is not phishing-resistant.
06Section
Built to be inspected.
No black box, no API key, no telemetry. The whole instrument is a repository you can read in an afternoon.
Deterministic
The matcher, the graph layout, and the cascade are pure functions. Same profile, same numbers, every run.
Offline seed
All 27 incidents live in git with sources and timelines. No feed, no key, no network call required.
Zero keys
There is no LLM in the loop. Explanations come from the model, not a prompt, and they are reproducible.
Private by default
Your stack is stored in localStorage. The API computes a report and keeps nothing on the server.
The instrument is ready