SPECTRE is 313SEC’s offensive exposure validation and adversary intelligence platform. It discovers external attack surface, validates whether exposures are real, preserves forensic-grade evidence, models attack paths, fuses live threat context, and monitors drift over time. It is not a scanner clone. It is not an exploit toy. It is built to answer what matters and prove every answer.
SPECTRE is structured as a platform, not a pile of scanners. Each module has a clear boundary and a specific responsibility. The orchestration layer can swap tools behind adapters without breaking the platform model. The outcome is cleaner code, safer execution, and evidence that survives scrutiny.
The platform’s core value appears when findings stop being isolated rows in a table. Click each stage to see how a discovered exposure becomes a threat-contextualised, attack-path-aware decision with preserved evidence.
Subdomains, services, APIs, certificates, and cloud assets are mapped into a unified external graph.
Screenshots, HTTP evidence, TLS artefacts, and safe checks show whether the exposure is real.
EPSS, KEV, ATT&CK, and exploit maturity provide the current threat lens around the weakness.
The finding is connected to assets, services, logins, trust edges, and credentials to model attacker routes.
Artefacts, manifest, hashes, and reproducibility notes become a tamper-aware evidence package.
Drift, re-opened findings, new assets, and threat changes trigger the next assessment cycle.
Discovery starts with authorised scope targets and expands outward into domains, CT intelligence, DNS, ports, services, headers, APIs, and cloud clues. The point is not raw volume. The point is a reliable perimeter model that downstream modules can trust.
SPECTRE treats evidence as a first-class object. The platform constitution is explicit: if it cannot be proved, it does not exist. Explore the evidence views below to see how artefacts, manifests, and reporting fit together.
Captured web interfaces with timestamp watermark and target URL overlay so the visual state can be tied to a specific validation point.
Headers, bodies, and replayable request context stored so reviewers can understand exactly what was sent and what came back.
Certificate chains, handshake details, cipher observations, and expiry evidence retained for protocol validation and future comparison.
Step-by-step instructions that let a reviewer or engineer reproduce the validated finding from the preserved record.
DOSSIER does not just dump technical output. It explains what was found, how strong the evidence is, where it sits in an attack path, and what the organisation should do next.
Severity is weighed with exploit maturity, attacker targeting, graph reachability, and client-specific environmental context.
Findings can be aligned to Cyber Essentials, CE Plus, ISO 27001 Annex A, GDPR-UK Article 32, NIS2, and NCSC guidance to make remediation useful to leadership as well as engineers.
Point-in-time output is not enough for a modern external estate. WATCHTOWER exists because the question is never just what was exposed last week. It is what changed, what re-opened, what new asset appeared, and what threat context shifted since the last time you looked.