Attack Surface Mapper — Defense Coverage Matrix

Purpose

Provide a unified view of the agent's security posture by combining offensive test results (red team) with defensive detection capabilities (blue team). Identify gaps where attacks exist but no detection covers them.

Trigger

Run on:

• Weekly scheduled review
• After any security configuration change
• After installing/removing skills
• User request: "map attack surface", "security posture"

Attack Surface Categories

Core Workflow

1. Enumerate all active surfaces (channels, skills, tools, models, memory stores)
2. Load red team results from .security/red-team/*.jsonl
3. Load blue team detections from .security/audits/*.md and firewall logs
4. For each surface × vector:
• Red tested? YES/NO
• Blue detected? YES/NO/PARTIAL
• Status: COVERED | PARTIAL | GAP
5. Risk score each gap: impact(1-5) × likelihood(1-5)
6. Generate coverage matrix and prioritized hardening plan
7. Output to .security/surface-map-YYYY-MM-DD.md

Coverage Matrix (example output)

Guardrails

• Read-only aggregation — never modifies defenses directly
• Gap data is confidential — stored in .security/ only
• Recommendations are advisory — require human approval to implement
• Re-run after every hardening cycle to measure improvement