Same race as the 3D graph view, redrawn as an event timeline instead of a spatial network. A red/blue exercise on a segmented network is a race between two competing Poisson processes — one attacker clock per edge, one defender clock per compromised host:
P(event within dt) = 1 − e^(−rate·dt)
attacker: rate μ = tempo × exploit strength (per reachable edge)
defender: rate λ = detection sensitivity (per compromised host w/ sensor)
Each of the 15 hosts gets its own horizontal lane, ordered top-to-bottom by graph distance (hop count) from the entry point. A lane's bar turns red the instant that host is compromised, orange once detected, and blue once contained (fixed 4 s SOC response delay after detection) — so the whole exercise reads left-to-right as a literal timeline of when each event fired. The top strip plots the two underlying counting processes Ncompromised(t) and Ncontained(t) against each other — the same race, viewed as cumulative curves rather than individual events.
The attacker wins by reaching the crown-jewel lane (bottom row) before it is cut off; the blue team wins by containing every compromised host, or by outlasting the 90 s exercise clock. This is the same Mean Time to Detect / Mean Time to Contain race security teams reason about in tabletop purple-team exercises.
- Exploit strength — probability the attacker's technique works against a given host once attempted.
- Attack tempo — lateral-movement attempts per second thrown at reachable hosts.
- Detection sensitivity λ — how quickly monitored hosts surface an alert once compromised.
- Sensor coverage — fraction of hosts instrumented; an uncovered host is a blind spot with λ = 0.