Reachability Reasoning Turns CTI Reports Into Executable Attack Graphs
Every SOC has the same drawer: quarterly threat reports from vendors, ISACs, and government bodies, all describing attacker behavior in prose. Analysts read them. Detections rarely change.
Reachability Reasoning Turns CTI Reports Into Executable Attack Graphs
Every SOC has the same drawer: quarterly threat reports from vendors, ISACs, and government bodies, all describing attacker behavior in prose. Analysts read them. Detections rarely change. A July 2026 paper on arXiv proposes a fix that treats each CTI narrative as a compilable artifact rather than a document — extracting reachable attack chains automatically, then reasoning about which goals a given intrusion could actually accomplish in your environment.
From prose to preconditions
The framework models each attacker step as an attack unit with three fields: precondition (what must already be true), behavior (the technique performed), and postcondition (what becomes true after). An LLM-assisted multi-stage pipeline extracts these units from unstructured CTI text, then compiles them into Datalog-style rules. Backward search from a hypothetical goal — say, domain_admin_obtained — walks the rule set to find which chains are actually reachable given known starting conditions.
The reported numbers are modest but meaningful: successful inference on 19 of 20 reports, yielding 34 reachable attack paths across the corpus. The value is not raw volume; it is that a report describing five techniques can now be queried like a knowledge base rather than skimmed like a PDF.
% Compiled attack unit from CTI report §3.2
reachable(post_exploit_ad_recon, Host) :-
reachable(initial_foothold_phishing_macro, Host),
has_capability(Host, powershell_v5_or_higher),
not(has_control(Host, amsi_enforced)).
?- reachable(domain_admin_obtained, workstation_042).
true. % path length: 6 unitsThis maps cleanly onto MITRE ATT&CK’s technique lattice, which already publishes tactic-technique-procedure decompositions in machine-readable STIX (ATT&CK STIX). What the paper adds is closing the loop between narrative reports and the ATT&CK graph — a gap NIST flagged explicitly in SP 800-150 on CTI sharing as the reason most consumed CTI never triggers a control change.
Why this matters for NIS2-scope operations
Directive (EU) 2022/2555 (NIS2) obliges essential and important entities to demonstrate risk-based cybersecurity measures proportionate to threat exposure. “We read the ENISA threat landscape” is no longer sufficient documentation. Reachability analysis produces an auditable artifact: given this CTI, given our current controls, these specific goals are reachable — here are the compensating detections we deployed. ENISA’s cyber threat intelligence guidance points at the same evidentiary standard.
The pipeline also composes with intrusion-detection work that avoids payload inspection entirely — see our note on pattern-level network detection under encryption in the AEGIS pillar — and with graph-based agent-safety reasoning we cover in the IRIS pillar on topology-driven safety.
The CAI position
Extracting attack units is the easy 40%. Keeping the rule base consistent across weekly CTI intake — deduping units, resolving contradictory postconditions, versioning as attacker TTPs drift — is where the engineering weight sits. In our AEGIS deployments we treat the Datalog store as a first-class asset with the same review discipline as detection-as-code: signed commits, replay against last quarter’s incidents, mandatory regression on the reachable-goal set before merge. If your CTI budget currently ends at “read and file”, talk to us about turning it into queryable ground truth.