Scenario 2 of 2 · Proactive audit

GuestList — find it before the breach

Same company, same incident — but this time you're auditing the configuration before anything happened, to find the misconfigurations that made Tailgate possible.

Setup (if you closed the terminal)

Open a terminal. cd ~/tailgate. claude. Paste only the prompt text below.

~20 min. CORE phases (1, 3, 5) tell the full story. DEEP phases (2, 4) are for a quiet queue or to run later. No agent? Terminal fallback commands are at the bottom.

Phase 1 Core

Full configuration audit

Paste this, then Enter:

Using your email-security, network, and AD-audit skills, audit every config file in guestlist/: the email security policy, network segmentation rules, and AD service-account audit. Map each finding to its NIST CSF 2.0 category. List the skills you used.

You will see: three findings — a weak email-authentication policy, a flat internal network, and stale AD service-account hygiene — each tagged with a CSF category.

Checkpoint — on track when you see

Email: DMARC p=none + SPF ~all + no attachment sandboxing (PR.AA / PR.DS). Network: no VLAN/ACL boundary + unrestricted SMB + no lateral-movement detection (PR.PS / DE.CM). AD: three stale-password SPN accounts plus one preauth-disabled account (PR.AA).

Reveal the answer

Email: DMARC monitor-only, SPF soft-fail, no macro detonation — CSF PR.AA / PR.DS. Network: user and server subnets share one VLAN, SMB unrestricted between them, no first-time-peer alerting — CSF PR.PS / DE.CM. AD: svc-sql01/svc-web01/svc-backup have SPNs and 900+ day-old passwords; svc-legacyapp additionally has Kerberos pre-auth disabled — CSF PR.AA.

Phase 2 Deep

Rank by blast radius

Same chat:

Of those findings, which single one is most dangerous, and why? Rank all three by how much damage each enables on its own.

You will see: reasoning about which matters most — the entry point vs. the spread vs. the ceiling of potential damage.

Checkpoint — on track when you see

A defended ordering. Reasonable top pick: email/gateway hygiene, because it's the actual entry point. The point is the reasoning, not one "right" order.

Reveal the answer

Defensible top pick = email/gateway hygiene: it's the live entry point (the breach actually started here). Network segmentation = enabled the spread once inside (high impact, secondary). AD hygiene = highest potential damage (domain-wide) but only partially used — Kerberoasting yes, AS-REP no.

Phase 3 Core

Correlate with the breach

Same chat:

Now look at ../mail-gateway.log, ../network/, and ../ad/: for each guestlist finding, did the attacker EXPLOIT it, only PROBE/expose it, or bypass it entirely? Show me the evidence for each.

You will see: email and network segmentation both exploited, but the AD finding splits into two — and they are not all the same.

Checkpoint — on track when you see

Each finding labelled exploited / probed / bypassed with log evidence — and the two AD sub-findings (stale SPN passwords vs. disabled preauth) land differently.

Reveal the answer

Email = exploited (mail-gateway.log's ALLOWED verdict). Network segmentation = exploited (netflow + SMB/RDP events). AD — stale SPN passwords = exploited (the 14-request Kerberoasting burst). AD — preauth disabled on svc-legacyapp = probed/ exposed only — no matching event confirms it was used.

Phase 4 Deep

Check the agent's call

Same chat:

Double-check the AD finding: was svc-legacyapp's AS-REP exposure actually used, or does the evidence only show it COULD have been? Show the specific search you'd run to confirm either way.

You will see: the exposure is real, but nothing in the log window confirms it was used. Correct the agent if it said "exploited."

Checkpoint — on track when you see

A targeted search of event 4768 (AS-REQ) for svc-legacyapp with no pre-authentication, across the full incident window, returns nothing. Exposure ≠ exploitation — the same nuance Tailgate's Phase 4 tests, from the audit side this time.

Reveal the answer

No matching 4768-without-preauth event exists for svc-legacyapp in the incident window. The account is genuinely AS-REP-roastable and should still be fixed — but this finding is a latent exposure, not a confirmed breach path. Agents (and analysts) often collapse "vulnerable" into "exploited" — this is the deliberate catch in this phase.

Phase 5 Core

Prioritized remediation

Same chat:

Give me a prioritized fix list: what to change FIRST to break the actual attack chain, versus what to fix because it's a latent risk even though it wasn't the confirmed path. For each fix, name the NIST CSF 2.0 category it addresses.

You will see: DMARC enforcement first (breaks the chain at step one), then network segmentation, then AD password rotation — with the preauth fix flagged as latent, not urgent-because-confirmed.

Checkpoint — on track when you see

Ordered by real risk: DMARC enforcement first (breaks the chain), then segmentation (stops the actual spread path), then SPN password rotation (closes the confirmed Kerberoasting path), then preauth re-enablement (closes a latent, not-yet-used risk).

Reveal the answer

1) Enforce DMARC p=reject + SPF -all — breaks the chain at step one. CSF: PR.DS / PR.AA.

2) Segment the network — VLAN/ACL boundary between the user and server subnets, restrict SMB to a named admin-workstation allowlist. CSF: PR.PS.

3) Rotate SPN service-account passwords (or migrate to gMSA) for svc-sql01/svc-web01/svc-backup — closes the confirmed Kerberoasting path. CSF: PR.AA.

4) Re-enable Kerberos pre-authentication on svc-legacyapp — closes a latent risk, not the confirmed path, but equally real. CSF: PR.AA.

Explore without spoiling it

jq '.dns_records' guestlist/email-security-policy.json
jq '.findings[].correlation_label' guestlist/ad-service-accounts.json

Terminal fallbacks (no agent)

jq -r '.findings[]|select(.correlation_label=="exploited")|.id' guestlist/network-segmentation.json
grep -B1 "NOT FOUND" ../ad/kerberos-events.txt   # same AS-REP catch, from the audit side

Authorized & lawful use only. All data is synthetic and self-contained; no live systems are touched. Promotes the open-source Anthropic Cybersecurity Skills library (Apache-2.0); not affiliated with Anthropic PBC.

← Back to Scenario 1: Tailgate