Detection Tripwire Analysis

16 Tripwires Across 8 Kill Chain Phases — $39,500 Total  |  Shadow313 NEXUS threat model  |  Ottawa, ON

Tripwires

18.2%

Baseline Escape

~0%

w/Tripwires

$39.5K

Total Cost

Max Deploy

96/100

Best Leverage

0.001%

Min False Pos.

210,000x

ROI

Key Findings

TW-12: Simultaneous Multi-Institution Login Alert (96/100)

Phase 5 — Arch-A Bridge. 95% detection, 0.1% FP, $2,500, 1.5h deploy. Alert when same credential authenticates to >3 institutions in 60 seconds. 5-minute intervention window before JAR injection.

TW-01: Canary SWIFT Admin Account (95/100)

Phase 0 — Reconnaissance. 72% detection, 0.1% FP, $500, 0.5h deploy. Fires during reconnaissance before any damage. 30-minute window to extend hardening to Arch-E.

TW-10: Out-of-Schedule Credential Sync Alert (94/100)

Phase 4 — Mass Credential Compromise. 92% detection, 0.2% FP, $400, 0.5h deploy. 2-minute window before all 10 Arch-E institutions are compromised.

Wave 1 Alone ($1,900, 30 min) Reduces Escape to 0.3%

5 tripwires deployable in 30 minutes reduce attacker escape from 18.2% to 0.3%. ROI of Wave 1 alone: 3,884,210×. The single highest-ROI defensive action in the entire analysis.

Data Table

Scenario	Entry	Delay	Comp.	Loss	vs Hard.	Effective?
TW-01	Canary SWIFT Admin Account	Honeytoken	0.5h	$500	72%	95
TW-10	Out-of-Schedule Credential Sync	Behavioral	0.5h	$400	92%	94
TW-07	Canary Database Credential	Honeytoken	1.0h	$800	88%	93
TW-03	Cross-Institution Login Velocity	Behavioral	1.0h	$2,000	85%	92
TW-12	Simultaneous Multi-Inst Login	Behavioral	1.5h	$2,500	95%	96
TW-05	New Source IP for SWIFT Admin	Behavioral	2.0h	$1,500	90%	89
TW-15	New Beneficiary Account Alert	Behavioral	2.0h	$3,000	88%	78