Threat modeling Breakwater with five proven methods

Breakwater vectors

• Forged collector identity attempts to upload a run for another site.
• Stolen MCP bearer token attempts to read another tenant's latest run.
• OAuth callback replay attempts to create a browser session without the original state cookie.

Breakwater vectors

• Collector report changes device class, owner, protocol, or confidence before upload.
• Adversarial hostnames or banners inject instructions into evidence that an AI client may later summarize.
• Policy scope is widened from a bounded CIDR to an unauthorized network.

Breakwater vectors

• Operator denies launching a collector task or reviewing an asset.
• Collector owner denies sending a malformed or replayed report.
• AI client operator denies a sensitive MCP query.

Breakwater vectors

• Tenant-scoped run data leaks through an unfiltered query or cached report.
• MCP confused-deputy behavior exposes discovery data to another connected tool.
• Authenticated user tries to convert read-only MCP into scan execution or device-write action.

Turn cloud into a scanner

Attacker asks an AI connector to scan a private or third-party network. Breakwater refuses cloud-side scanning and redirects to authorized local collector workflow.

Poison inventory

Attacker uploads fake discovery results. Required controls are signed policy, nonce, schema validation, tenant scope, checksums, and audit trail.

Prompt-inject MCP

Attacker attempts to make an AI connector reveal secrets or execute unsafe work. MCP remains read-only and returns bounded discovery summaries.

Scrape unauthenticated pages

Only login, documentation, static assets, and OAuth endpoints are public. App, telemetry, reports, and data routes require sessions or MCP auth.

Reduce joinability

• Use session IDs and actor hashes for analytics.
• Avoid raw session replay and sensitive content capture.

Minimize identity

• Display user identity only where needed.
• Store aggregate telemetry with actor hash and domain.

Limit unnecessary accountability

• Security audit logs are required, but product analytics should not create avoidable employee surveillance.
• Customer exports should distinguish audit evidence from optional usage analytics.

Prevent inference

• Avoid exposing whether a specific user, site, or asset exists through timing, error messages, or aggregate analytics.
• Require k-anonymity style thresholds before customer-visible analytics drilldowns.

Protect customer metadata

• Collector reports, MACs, hostnames, owners, locations, and evidence are customer-sensitive data.
• Docs explain that private LAN discovery requires a customer-side collector.

Make boundaries visible

• Login/docs describe collector/cloud separation.
• MCP guidance refuses unsupported cloud scanning claims.

Prepare regulated review

• Document retention, deletion, export, and backup behavior for customer evidence.
• Maintain DPIA/ROPA-ready records for telemetry, audit, and customer asset metadata.

Poison customer inventory

Goal: Poison discovery results
  OR upload without authorization [cost: medium]
    AND steal token [cost: medium, probability: medium]
    AND bypass signed policy [cost: high, probability: low]
    AND replay or forge nonce [cost: high, probability: low]
  OR tamper with collector output [cost: medium]
    AND compromise collector host [cost: medium, probability: medium]
    AND alter report file [cost: low, probability: medium]
    AND evade checksum/schema checks [cost: high, probability: low]
  OR mislead operator through MCP [cost: medium]
    AND inject hostile hostname/banner evidence [cost: low, probability: medium]
    AND trigger AI summary without evidence escaping [cost: medium, probability: medium]
    AND hide confidence caveats [cost: medium, probability: low]

Controls that break the tree

• Signed policy and policy expiration.
• Upload nonce replay tracking.
• Schema validation and report checksum.
• Tenant/site/run scoping.
• Read-only MCP responses with confidence and evidence caveats.

Methodology

Risk is scored as likelihood multiplied by impact on a 1 to 5 scale. Residual risk is accepted only when the listed validation evidence exists and no critical/high control is missing.

• 1-5: Low, monitor through normal telemetry.
• 6-12: Medium, owner and planned validation required.
• 15-25: High, release-blocking until prevention and detection pass.

Who the model considers

• Unauthenticated internet user probing public routes.
• Authenticated demo user trying to exceed discovery-only scope.
• Compromised collector host or stolen upload material.
• Prompt-injection attacker influencing MCP output.
• Insider or operator with access to customer discovery data.

Open remediation item

The Lambda handler does not currently emit a Strict-Transport-Security header. Browsers cannot preload HTTPS for subsequent requests. Fix: add strict-transport-security: max-age=63072000; includeSubDomains to the shared response headers object. Low-complexity, one-line change. Tracked in the risk register below.

Open assurance item

Automated dependency vulnerability scanning for the Lambda handler, React frontend, and Rust collector binary is not confirmed in CI. Add Dependabot, Snyk, or equivalent with a policy to remediate critical/high CVEs within a defined SLA. Required before enterprise security review.