Research Navigator and Learning Paths

Choose a route through the evidence—not a personalized feed.

Start with one of five fixed learning paths, open the Cross-Lab Concept Matrix, or browse the complete KillChains.com publication map. The navigator is derived from the same canonical page registry used by search, feeds, metadata, and internal navigation, so it cannot silently invent a duplicate route or a private recommendation profile.

5 fixed learning paths7 editorial groups47 clean public routesNo profile or progress tracking

Answer-first summary

Direct answers

Release 1.38.0 · reviewed 2026-08-07 · evidence states

Where should a first-time KillChains.com reader begin?

Begin with What They Are, continue through How They Work, complete the Daily Break the Chain simulation, inspect the Human Control Lab, and finish with Methodology.

Read the supporting section

Does the navigator personalize or track visitors?

No. It provides fixed editorial paths and a complete route map without an account, progress profile, behavioral analytics, inferred expertise, or persistent browser state.

Read the supporting section

How does the ecosystem split affect the learning paths?

KillChains.com remains the educational chain and evidence environment, KillWebs.com covers governed network paths, and Evulgare.com is the destination for production accountability software for real systems.

Read the supporting section

Editorial orientation

One publication. Several legitimate entry points.

The learning paths are fixed, inspectable editorial sequences. Selecting one does not identify the visitor as an educator, security practitioner, policy researcher, or source auditor.

Start with a question

Choose the path that matches the question you are trying to answer—not an inferred identity or hidden score.

Follow stable routes

Every step resolves to an existing canonical page owned by the central publication registry.

Keep claims and simulations separate

Synthetic learning values never become evidence about real systems merely because they appear in a polished path.

Know when the ecosystem changes

KillChains teaches the sequence, KillWebs teaches the option space, and Evulgare is the production accountability destination.

Five fixed paths

Move from orientation to evidence, authority, or audit.

Every path remains visible in the HTML. JavaScript only changes which released path is emphasized and announces the selection.

First-time readerFoundations in one sitting Educator or facilitatorFacilitate an evidence-led lesson Security practitionerDefend AI-enabled systems Policy researcherTrace authority through institutions Source auditor or researcherAudit the evidence chain

First-time reader

Foundations in one sitting

Build a clear model of what a kill chain is, how it works, where machine intelligence enters, and why evidence and human authority matter.

Estimated time: 35–55 minutes
Learning outcome: Explain the difference among a chain, a kill web, AI assistance, automation, and meaningful human control.

01
What They Are
Establish the vocabulary.
Understand military kill chains, the Cyber Kill Chain, AI-system attack chains, kill webs, AI-enabled functions, and the spectrum of human control.
02
How They Work
Trace the functional sequence.
Follow F2T2EA, the Cyber Kill Chain, and attacks against AI systems stage by stage, including sensing, fusion, authority, feedback, uncertainty, and controls.
03
Simulation
Experience the Daily Break the Chain simulation.
Explore a synthetic, server-authoritative simulation of military F2T2EA, cyber intrusions, AI-system attacks, human control, evidence, and counterfactual replay.
04
Human Control Lab
Test how evidence, time, and authority affect control.
Explore six synthetic labs on algorithmic filtering, machine-speed pressure, lost links, automation bias, accountability, preauthorization, and private deterministic replay.
05
Answerability Lab
See why a final click cannot explain an invisible machine decision.
Reconstruct a synthetic machine-speed failure, test whether human control was meaningful, and route production evidence requirements to Evulgare.
06
Answerability Replay
Replay the same failure as evidence completeness improves.
Replay a fictional machine-speed failure as provenance, authority, operator-view, software, and change evidence make its explanation more defensible.
07
Answerability Remediation
Test bounded prevention, containment, recovery, and answerability controls.
Apply bounded safeguards to the fixed Orison replay and compare prevention, earlier detection, containment, recovery, answerability, unknowns, and ceremonial review.
08
Answerability Assurance
See why assurance support must remain version-bound and change-sensitive.
Assemble a synthetic assurance case from a bounded claim, evidence, assumptions, defeaters, version identity, and accountable review ownership, then test material-change invalidation.
09
Assurance Review Packet
Compare immutable prior and current review packets without rewriting history.
Compare two synthetic version-bound assurance snapshots, preserve prior claim states, inspect exact evidence and version changes, and generate a bounded review packet.
10
Evidence Contract Lab
Map who must produce, challenge, suspend, correct, and retire the evidence supporting each claim.
Map who must produce, preserve, verify, challenge, accept, suspend, correct, and retire the evidence supporting a version-bound machine assurance claim.
11
Evidence-Gap Escalation
Remediate exact evidence and authority gaps without inferring a missing owner or rewriting the source packet.
Identify missing evidence and authority, apply bounded synthetic remediation, and follow a non-destructive dispute path without rewriting history or inferring missing owners.
12
Dispute Ledger
Inspect immutable dispute records, corrective actions, preserved prior states, and closure with residual unknowns.
Inspect immutable synthetic dispute records, evidence requests and production, independent review owners, corrective actions, preserved prior states, and residual unknowns.
13
Effectiveness Audit
Test whether corrective actions were implemented, independently verified, effective, durable after change, or closed with remaining exposure.
Audit whether a synthetic corrective action was merely planned, implemented, independently verified, effective, later invalidated, retired, or closed with residual exposure.
14
Monitoring & Reopening
Monitor the reviewed control, verify regression signals, preserve earlier closure, reopen the audit, and independently revalidate the changed state.
Monitor synthetic corrective-action audits, verify regression signals, preserve prior closures, reopen review, remediate, and independently revalidate changed states.
15
Coverage & Alert Integrity
Map monitoring scope, expose blind spots, and trace alert generation through delivery, review, and independent verification.
Map what a synthetic monitoring architecture can observe, expose blind spots, separate monitor health from scope, and trace alerts through delivery, review, and independent verification.
16
Validation Drill
Apply one released remediation, inject bounded failures, and test the complete alert path without treating synthetic mechanics as production safety.
Apply a released monitoring-coverage remediation, inject bounded failures, and test alert generation, delivery, review, verification, suspension, correction, and residual unknowns.
17
Exception & Retest Ledger
Preserve the immutable validation result beside a same-fixture retest, classify recurrence, and keep closure separate from durable non-recurrence.
Open a synthetic exception branch from an immutable validation result, compare original and retest stages, and preserve recurrence, evidence, ownership, escalation, and residual unknowns.
18
Recurrence Pattern Review
Compare immutable exception branches without turning counts into rates, cohorts into causes, or non-observation into disproof.
Compare immutable exception and retest branches, count recurrence observations without rates, and inspect cohort patterns without implying population, causation, risk, or legal findings.
19
Concept Matrix
Compare recurring concepts across labs, evidence records, KillWebs, and Evulgare.
Compare thirteen recurring concepts across KillChains.com labs, evidence records, KillWebs, and live Evulgare accountability areas for real systems.
20
Methodology
Understand the evidence and safety boundaries.
See how KillChains.com separates facts, claims, analysis, disputes, unknowns, and synthetic scenarios while governing sources, corrections, safety, state, and testing.

Begin this path Understand the ecosystem split

Educator or facilitator

Facilitate an evidence-led lesson

Combine deterministic exercises, stable definitions, evidence classification, and citation without student accounts or persistent profiles.

Estimated time: 45–75 minutes
Learning outcome: Run a bounded lesson that rewards evidence inspection and distinguishes synthetic results from real-world claims.

01
Challenge Archive
Select a deterministic scenario.
Browse deterministic synthetic challenges for AI security, cyber defense, military governance, evidence evaluation, confidence calibration, and human control.
02
Evidence Lab
Practice source classification.
Classify official, manufacturer, independent, disputed, unknown, and synthetic evidence while preserving source lineage, uncertainty, and bounded support.
03
Human Control Lab
Discuss meaningful versus nominal control.
Explore six synthetic labs on algorithmic filtering, machine-speed pressure, lost links, automation bias, accountability, preauthorization, and private deterministic replay.
04
Answerability Lab
Route public learning, network questions, and production evidence correctly.
Reconstruct a synthetic machine-speed failure, test whether human control was meaningful, and route production evidence requirements to Evulgare.
05
Answerability Replay
Compare what can be explained from four evidence states.
Replay a fictional machine-speed failure as provenance, authority, operator-view, software, and change evidence make its explanation more defensible.
06
Answerability Remediation
Compare effective safeguards with ceremonial human review.
Apply bounded safeguards to the fixed Orison replay and compare prevention, earlier detection, containment, recovery, answerability, unknowns, and ceremonial review.
07
Answerability Assurance
Build a small assurance argument and invalidate it through material change.
Assemble a synthetic assurance case from a bounded claim, evidence, assumptions, defeaters, version identity, and accountable review ownership, then test material-change invalidation.
08
Assurance Review Packet
Compare the reviewed packet with a changed version-bound state.
Compare two synthetic version-bound assurance snapshots, preserve prior claim states, inspect exact evidence and version changes, and generate a bounded review packet.
09
Evidence Contract Lab
Compare fictional review ownership and expose missing challenge or suspension authority.
Map who must produce, preserve, verify, challenge, accept, suspend, correct, and retire the evidence supporting a version-bound machine assurance claim.
10
Evidence-Gap Escalation
Follow a non-destructive request, challenge, review, suspension, correction, and closure path.
Identify missing evidence and authority, apply bounded synthetic remediation, and follow a non-destructive dispute path without rewriting history or inferring missing owners.
11
Dispute Ledger
Compare immutable dispute histories and corrective-action ledgers without ranking or blame allocation.
Inspect immutable synthetic dispute records, evidence requests and production, independent review owners, corrective actions, preserved prior states, and residual unknowns.
12
Effectiveness Audit
Compare planned, implemented, verified, ineffective, invalidated, retired, and residual-exposure audit states.
Audit whether a synthetic corrective action was merely planned, implemented, independently verified, effective, later invalidated, retired, or closed with residual exposure.
13
Monitoring & Reopening
Compare scheduled monitoring, observed signals, verified regression, suspension, reopening, remediation, and revalidation.
Monitor synthetic corrective-action audits, verify regression signals, preserve prior closures, reopen review, remediate, and independently revalidate changed states.
14
Coverage & Alert Integrity
Compare healthy monitoring, wrong scope, blind spots, suppressed alerts, and independently tested alert paths.
Map what a synthetic monitoring architecture can observe, expose blind spots, separate monitor health from scope, and trace alerts through delivery, review, and independent verification.
15
Validation Drill
Compare end-to-end validation, blind-spot persistence, and ceremonial acknowledgement without competent review.
Apply a released monitoring-coverage remediation, inject bounded failures, and test alert generation, delivery, review, verification, suspension, correction, and residual unknowns.
16
Exception & Retest Ledger
Compare a qualified same-fixture pass, recurring transport and deduplication failure, and an ownerless escalation branch.
Open a synthetic exception branch from an immutable validation result, compare original and retest stages, and preserve recurrence, evidence, ownership, escalation, and residual unknowns.
17
Recurrence Pattern Review
Inspect repeated symptoms, branch exclusions, dependency hypotheses, and competing explanations without manufacturing a common cause.
Compare immutable exception and retest branches, count recurrence observations without rates, and inspect cohort patterns without implying population, causation, risk, or legal findings.
18
Glossary
Use stable terms.
Search plain-language definitions for F2T2EA, cyber and AI kill chains, kill webs, control modes, automation bias, provenance, confidence, preauthorization, and replay.
19
Concept Matrix
Connect each term to the labs and evidence surfaces that teach it.
Compare thirteen recurring concepts across KillChains.com labs, evidence records, KillWebs, and live Evulgare accountability areas for real systems.
20
Citation Guide
Cite the current release and evidence state.
Use stable citation templates for KillChains.com pages, the Evidence Atlas, synthetic challenges, saved views, source states, release versions, review dates, and corrections.
21
Methodology
Review safety and publication boundaries.
See how KillChains.com separates facts, claims, analysis, disputes, unknowns, and synthetic scenarios while governing sources, corrections, safety, state, and testing.

Begin this path Understand the ecosystem split

Security practitioner

Defend AI-enabled systems

Connect the AI kill chain to provenance, confidence calibration, bounded interruption, and downstream tool or authority risk.

Estimated time: 45–70 minutes
Learning outcome: Map Recon, Poison, Hijack, Persist, and Impact to defensive controls and evidence-quality questions.

01
AI Security
Learn the AI-system attack chain.
Learn how attackers reconnoiter, poison, hijack, persist in, and impact AI-enabled systems—and how provenance, least privilege, approval, monitoring, and rollback interrupt them.
02
Simulation
Apply a bounded control in the simulation.
Explore a synthetic, server-authoritative simulation of military F2T2EA, cyber intrusions, AI-system attacks, human control, evidence, and counterfactual replay.
03
Challenge Archive
Compare additional scenarios.
Browse deterministic synthetic challenges for AI security, cyber defense, military governance, evidence evaluation, confidence calibration, and human control.
04
Evidence Lab
Audit source and evidence class.
Classify official, manufacturer, independent, disputed, unknown, and synthetic evidence while preserving source lineage, uncertainty, and bounded support.
05
Human Control Lab
Inspect approval and authority failures.
Explore six synthetic labs on algorithmic filtering, machine-speed pressure, lost links, automation bias, accountability, preauthorization, and private deterministic replay.
06
Answerability Lab
Identify the evidence a real agentic system must preserve.
Reconstruct a synthetic machine-speed failure, test whether human control was meaningful, and route production evidence requirements to Evulgare.
07
Answerability Replay
Trace causal contribution without turning evidence into a blame score.
Replay a fictional machine-speed failure as provenance, authority, operator-view, software, and change evidence make its explanation more defensible.
08
Answerability Remediation
Test provenance, authority, safe-state, rollback, and assurance controls.
Apply bounded safeguards to the fixed Orison replay and compare prevention, earlier detection, containment, recovery, answerability, unknowns, and ceremonial review.
09
Answerability Assurance
Bind security claims to evidence, assumptions, versions, and review ownership.
Assemble a synthetic assurance case from a bounded claim, evidence, assumptions, defeaters, version identity, and accountable review ownership, then test material-change invalidation.
10
Assurance Review Packet
Inspect exact model, software, configuration, interface, and policy diffs.
Compare two synthetic version-bound assurance snapshots, preserve prior claim states, inspect exact evidence and version changes, and generate a bounded review packet.
11
Evidence Contract Lab
Assign evidence production, preservation, verification, challenge, suspension, correction, and retirement duties.
Map who must produce, preserve, verify, challenge, accept, suspend, correct, and retire the evidence supporting a version-bound machine assurance claim.
12
Evidence-Gap Escalation
Distinguish missing evidence, open requests, produced records, and blocked corrective authority.
Identify missing evidence and authority, apply bounded synthetic remediation, and follow a non-destructive dispute path without rewriting history or inferring missing owners.
13
Dispute Ledger
Audit requested, produced, unavailable, challenged, corrected, retired, and closed states.
Inspect immutable synthetic dispute records, evidence requests and production, independent review owners, corrective actions, preserved prior states, and residual unknowns.
14
Effectiveness Audit
Verify that ticket closure and human sign-off are not substituted for implementation or effectiveness evidence.
Audit whether a synthetic corrective action was merely planned, implemented, independently verified, effective, later invalidated, retired, or closed with residual exposure.
15
Monitoring & Reopening
Verify that a monitoring dashboard or human reapproval is not substituted for performed monitoring and independent regression verification.
Monitor synthetic corrective-action audits, verify regression signals, preserve prior closures, reopen review, remediate, and independently revalidate changed states.
16
Coverage & Alert Integrity
Verify that silence, monitor health, alert delivery, review, and independent verification remain distinct evidence states.
Map what a synthetic monitoring architecture can observe, expose blind spots, separate monitor health from scope, and trace alerts through delivery, review, and independent verification.
17
Validation Drill
Stress-test observation, transport, receipt, review, verification, reliance, and correction while preserving unsupported conclusions.
Apply a released monitoring-coverage remediation, inject bounded failures, and test alert generation, delivery, review, verification, suspension, correction, and residual unknowns.
18
Exception & Retest Ledger
Retest the frozen path, preserve the original stage state, and distinguish transient recurrence from a systemic blind spot.
Open a synthetic exception branch from an immutable validation result, compare original and retest stages, and preserve recurrence, evidence, ownership, escalation, and residual unknowns.
19
Recurrence Pattern Review
Count typed observations, inspect cohorts and dependency hypotheses, and keep correlation separate from common cause.
Compare immutable exception and retest branches, count recurrence observations without rates, and inspect cohort patterns without implying population, causation, risk, or legal findings.
20
Source Review
Check source freshness and reuse.
Inspect review dates, source classes, dependencies, supersession, link-check boundaries, and correction pathways for every public KillChains.com source record.

Begin this path Understand the ecosystem split

Policy researcher

Trace authority through institutions

Follow how objectives, data, thresholds, recommendations, authorization, execution, correction, retirement, and liability move through an institution.

Estimated time: 70–110 minutes
Learning outcome: Distinguish machine function from legal authority and identify where accountability or contestability can fail.

01
Machine Leadership Lab
Unbundle institutional leadership.
Explore how AI moves from tool to analyst, orchestrator, operational delegate, and proxy leader while humans retain formal office, override duties, and liability.
02
Answerability Lab
Separate technical answerability from legal authority and blame.
Reconstruct a synthetic machine-speed failure, test whether human control was meaningful, and route production evidence requirements to Evulgare.
03
Answerability Replay
See how authority and operator-view evidence change the explanation.
Replay a fictional machine-speed failure as provenance, authority, operator-view, software, and change evidence make its explanation more defensible.
04
Answerability Remediation
Compare where prevention, recovery, and correction authority must reside.
Apply bounded safeguards to the fixed Orison replay and compare prevention, earlier detection, containment, recovery, answerability, unknowns, and ceremonial review.
05
Answerability Assurance
Trace who owns assurance support, suspension, and withdrawal after change.
Assemble a synthetic assurance case from a bounded claim, evidence, assumptions, defeaters, version identity, and accountable review ownership, then test material-change invalidation.
06
Assurance Review Packet
Separate packet completion from operational release authority.
Compare two synthetic version-bound assurance snapshots, preserve prior claim states, inspect exact evidence and version changes, and generate a bounded review packet.
07
Evidence Contract Lab
Inspect which institutions own the evidence contract and which authority gaps block review.
Map who must produce, preserve, verify, challenge, accept, suspend, correct, and retire the evidence supporting a version-bound machine assurance claim.
08
Evidence-Gap Escalation
Trace dispute escalation without collapsing technical remediation into legal responsibility.
Identify missing evidence and authority, apply bounded synthetic remediation, and follow a non-destructive dispute path without rewriting history or inferring missing owners.
09
Dispute Ledger
Compare how institutions preserve dispute history and corrective action without inferring missing authority.
Inspect immutable synthetic dispute records, evidence requests and production, independent review owners, corrective actions, preserved prior states, and residual unknowns.
10
Effectiveness Audit
Trace action ownership, verification, invalidation, retirement, and residual exposure without converting the audit into legal responsibility.
Audit whether a synthetic corrective action was merely planned, implemented, independently verified, effective, later invalidated, retired, or closed with residual exposure.
11
Monitoring & Reopening
Trace monitoring ownership, suspension, reopening, revalidation, and reclosure without assigning missing duties to the operator.
Monitor synthetic corrective-action audits, verify regression signals, preserve prior closures, reopen review, remediate, and independently revalidate changed states.
12
Coverage & Alert Integrity
Trace who owns monitoring coverage, alert delivery, independent review, suspension, correction, and retirement.
Map what a synthetic monitoring architecture can observe, expose blind spots, separate monitor health from scope, and trace alerts through delivery, review, and independent verification.
13
Validation Drill
Show why absent review, suspension, correction, or retirement authority cannot be assigned to the nearest operator.
Apply a released monitoring-coverage remediation, inject bounded failures, and test alert generation, delivery, review, verification, suspension, correction, and residual unknowns.
14
Exception & Retest Ledger
Show why acknowledgement, exception ownership, verification, suspension authority, escalation, and closure remain separate institutional duties.
Open a synthetic exception branch from an immutable validation result, compare original and retest stages, and preserve recurrence, evidence, ownership, escalation, and residual unknowns.
15
Recurrence Pattern Review
Show why selected samples, recurrence counts, causal support, systemic support, and production authority remain separate institutional questions.
Compare immutable exception and retest branches, count recurrence observations without rates, and inspect cohort patterns without implying population, causation, risk, or legal findings.
16
Anticipatory Intelligence Lab
Separate observation, inference, and recommendation.
Compare observation, forecasting, person-risk inference, provenance, machine explanations, and human control in six synthetic anticipatory-intelligence labs.
17
Predictive Enforcement
Inspect preemptive government decision chains.
Compare eight source-bounded predictive-policing, watchlisting, traveler-screening, and behavioral-threat-assessment programs, then test a synthetic feedback loop.
18
Risk, Law & Control
Review legal and human-control questions.
Examine international humanitarian law, weapons review, responsible-AI principles, meaningful human control, testing, accountability, escalation, and governance.
19
Authority Casebook
Compare real institutional authority owners.
Compare six source-reconciled cases showing which machine functions are documented, what authority migrated into software, and what legal or institutional authority remained human.
20
Concept Matrix
Compare authority, preauthorization, confidence, provenance, and correction across the publication.
Compare thirteen recurring concepts across KillChains.com labs, evidence records, KillWebs, and live Evulgare accountability areas for real systems.
21
Claim Lineage
Trace sources, transformations, and reuse.
Trace public claims backward to source records and transformations, then forward to authority owners, machine and human roles, public reuse, review status, unknowns, and correction paths.
22
Change Ledger
Inspect accepted corrections and supersessions.
Review accepted KillChains.com corrections, withdrawals, supersessions, and evidence reclassifications with prior states, release proof, public impacts, and preserved history.

Begin this path Understand the ecosystem split

Source auditor or researcher

Audit the evidence chain

Move from methodology to source identity, freshness, claim transformation, hypothetical review impact, accepted history, and citation.

Estimated time: 75–120 minutes
Learning outcome: Reconstruct how a public statement is supported, qualified, reused, corrected, or superseded.

01
Methodology
Read the evidence rules.
See how KillChains.com separates facts, claims, analysis, disputes, unknowns, and synthetic scenarios while governing sources, corrections, safety, state, and testing.
02
Evidence Lab
Practice evidence-state classification.
Classify official, manufacturer, independent, disputed, unknown, and synthetic evidence while preserving source lineage, uncertainty, and bounded support.
03
Source Library
Inspect source identity and bounded support.
Search the curated official policies, program records, standards, frameworks, manufacturer statements, legal positions, and independent research used by KillChains.com.
04
Source Review
Inspect freshness and dependencies.
Inspect review dates, source classes, dependencies, supersession, link-check boundaries, and correction pathways for every public KillChains.com source record.
05
Answerability Lab
Test whether the incident record can reconstruct the machine and human decision environment.
Reconstruct a synthetic machine-speed failure, test whether human control was meaningful, and route production evidence requirements to Evulgare.
06
Answerability Replay
Compare chronology, provenance, authority, software, and change evidence.
Replay a fictional machine-speed failure as provenance, authority, operator-view, software, and change evidence make its explanation more defensible.
07
Answerability Remediation
Inspect safeguard assumptions and unresolved evidence before claiming prevention.
Apply bounded safeguards to the fixed Orison replay and compare prevention, earlier detection, containment, recovery, answerability, unknowns, and ceremonial review.
08
Answerability Assurance
Audit a version-bound assurance claim and its explicit defeaters.
Assemble a synthetic assurance case from a bounded claim, evidence, assumptions, defeaters, version identity, and accountable review ownership, then test material-change invalidation.
09
Assurance Review Packet
Diff immutable packets and preserve stale, suspended, withdrawn, and revalidated history.
Compare two synthetic version-bound assurance snapshots, preserve prior claim states, inspect exact evidence and version changes, and generate a bounded review packet.
10
Evidence Contract Lab
Audit ownership, independent challenge, suspension, correction, and retirement obligations.
Map who must produce, preserve, verify, challenge, accept, suspend, correct, and retire the evidence supporting a version-bound machine assurance claim.
11
Evidence-Gap Escalation
Verify requests, production, custody, support, challenge resolution, correction, and historical preservation separately.
Identify missing evidence and authority, apply bounded synthetic remediation, and follow a non-destructive dispute path without rewriting history or inferring missing owners.
12
Dispute Ledger
Inspect immutable dispute records, prior-state hashes, corrective actions, and residual unknowns.
Inspect immutable synthetic dispute records, evidence requests and production, independent review owners, corrective actions, preserved prior states, and residual unknowns.
13
Effectiveness Audit
Audit version-bound implementation evidence, independent verification, later invalidation, and closure with remaining exposure.
Audit whether a synthetic corrective action was merely planned, implemented, independently verified, effective, later invalidated, retired, or closed with residual exposure.
14
Monitoring & Reopening
Audit continuing-monitoring evidence, regression verification, immutable reopening, remediation, and revalidation.
Monitor synthetic corrective-action audits, verify regression signals, preserve prior closures, reopen review, remediate, and independently revalidate changed states.
15
Coverage & Alert Integrity
Audit component and dependency coverage, monitor health, blind spots, alert integrity, and residual unknowns.
Map what a synthetic monitoring architecture can observe, expose blind spots, separate monitor health from scope, and trace alerts through delivery, review, and independent verification.
16
Validation Drill
Audit deterministic validation results, exact predecessor hashes, failure propagation, evidence records, owner gaps, and persistent unknowns.
Apply a released monitoring-coverage remediation, inject bounded failures, and test alert generation, delivery, review, verification, suspension, correction, and residual unknowns.
17
Exception & Retest Ledger
Audit immutable source-result hashes, same-versus-changed fixture status, original-versus-retest diffs, recurrence classification, and ownerless closure gates.
Open a synthetic exception branch from an immutable validation result, compare original and retest stages, and preserve recurrence, evidence, ownership, escalation, and residual unknowns.
18
Recurrence Pattern Review
Audit branch admission, missing observations, typed event counts, cohort boundaries, competing explanations, and causal and systemic support limits.
Compare immutable exception and retest branches, count recurrence observations without rates, and inspect cohort patterns without implying population, causation, risk, or legal findings.
19
Concept Matrix
See where each governance concept is taught and where production evidence routes to Evulgare.
Compare thirteen recurring concepts across KillChains.com labs, evidence records, KillWebs, and live Evulgare accountability areas for real systems.
20
Claim Lineage
Trace transformations and authority.
Trace public claims backward to source records and transformations, then forward to authority owners, machine and human roles, public reuse, review status, unknowns, and correction paths.
21
Change Impact
Preview review obligations without changing truth.
Preview which claims, authority cases, pages, simulations, answers, discovery files, and durable owners require review when a source or claim changes.
22
Change Ledger
Review accepted history.
Review accepted KillChains.com corrections, withdrawals, supersessions, and evidence reclassifications with prior states, release proof, public impacts, and preserved history.
23
Citation Guide
Cite the current state precisely.
Use stable citation templates for KillChains.com pages, the Evidence Atlas, synthetic challenges, saved views, source states, release versions, review dates, and corrections.

Begin this path Understand the ecosystem split

Complete publication map

Browse every clean canonical route.

Search and filters operate over existing page titles, descriptions, topics, and editorial groups. Query-state views remain nonindexable and canonicalize to this clean route.

Start and simulate

Begin with the primary synthetic experience or select a deterministic challenge.

Simulation

Explore a synthetic, server-authoritative simulation of military F2T2EA, cyber intrusions, AI-system attacks, human control, evidence, and counterfactual replay.

Kill chainF2T2EACyber Kill ChainAI security

/challenges.php

Challenge Archive

Browse deterministic synthetic challenges for AI security, cyber defense, military governance, evidence evaluation, confidence calibration, and human control.

Daily challengeCyber defenseAI securityMilitary governance

/research-navigator.php

Research Navigator

Choose a fixed learning path or browse the complete KillChains.com publication map across simulations, concepts, labs, evidence, governance, sources, and history.

Research navigationLearning pathsKill chain educationEvidence literacy

Core concepts

Learn the difference among military, cyber, AI-system, chain, web, and ecosystem models.

/what-they-are.php

What They Are

Understand military kill chains, the Cyber Kill Chain, AI-system attack chains, kill webs, AI-enabled functions, and the spectrum of human control.

Kill chain definitionF2T2EACyber Kill ChainAI Kill Chain

/how-they-work.php

How They Work

Follow F2T2EA, the Cyber Kill Chain, and attacks against AI systems stage by stage, including sensing, fusion, authority, feedback, uncertainty, and controls.

F2T2EA stagesCyber Kill Chain stagesAI attack chainSensor fusion

/kill-webs/

KillWebs.com

See how KillChains.com and KillWebs.com fit together, compare an ordered mission chain with a governed option space, and open the official KillWebs explorer and labs.

Kill webKill chain versus kill webMission networksResilience

/ecosystem.php

Ecosystem

Understand the split among KillChains.com education, KillWebs.com network and resilience research, and Evulgare.com production accountability software for real systems.

KillChains.comKillWebs.comEvulgareMachine accountability

/ai-security.php

AI Security

Learn how attackers reconnoiter, poison, hijack, persist in, and impact AI-enabled systems—and how provenance, least privilege, approval, monitoring, and rollback interrupt them.

AI Kill ChainPrompt injectionData poisoningExcessive agency

Interactive labs

Test evidence, human control, anticipation, predictive enforcement, and machine leadership in bounded synthetic environments.

/evidence-lab.php

Evidence Lab

Classify official, manufacturer, independent, disputed, unknown, and synthetic evidence while preserving source lineage, uncertainty, and bounded support.

Source classificationEvidence qualitySource lineageOSINT

/human-control.php

Human Control Lab

Explore six synthetic labs on algorithmic filtering, machine-speed pressure, lost links, automation bias, accountability, preauthorization, and private deterministic replay.

Human controlAutomation biasPreauthorizationLost link

/accountability-handoff.php

Answerability Lab

Reconstruct a synthetic machine-speed failure, test whether human control was meaningful, and route production evidence requirements to Evulgare.

Machine answerabilityHuman scapegoatingMeaningful human judgmentDecision provenance

/answerability-replay.php

Answerability Replay

Replay a fictional machine-speed failure as provenance, authority, operator-view, software, and change evidence make its explanation more defensible.

Machine answerabilityCausal contributionDecision provenanceOperator-view reconstruction

/answerability-remediation.php

Answerability Remediation

Apply bounded safeguards to the fixed Orison replay and compare prevention, earlier detection, containment, recovery, answerability, unknowns, and ceremonial review.

Machine answerabilityRemediationPreventionContinuous assurance

/answerability-assurance.php

Answerability Assurance

Assemble a synthetic assurance case from a bounded claim, evidence, assumptions, defeaters, version identity, and accountable review ownership, then test material-change invalidation.

Machine answerabilityAssurance caseContinuous assuranceEvidence integrity

/answerability-review.php

Assurance Review Packet

Compare two synthetic version-bound assurance snapshots, preserve prior claim states, inspect exact evidence and version changes, and generate a bounded review packet.

Machine answerabilityAssurance review packetVersion diffEvidence lineage

/answerability-contract.php

Evidence Contract Lab

Map who must produce, preserve, verify, challenge, accept, suspend, correct, and retire the evidence supporting a version-bound machine assurance claim.

Machine answerabilityEvidence contractReview ownershipMany hands

/answerability-escalation.php

Evidence-Gap Escalation

Identify missing evidence and authority, apply bounded synthetic remediation, and follow a non-destructive dispute path without rewriting history or inferring missing owners.

Machine answerabilityEvidence gapsDispute escalationIndependent review

/answerability-disputes.php

Dispute Ledger

Inspect immutable synthetic dispute records, evidence requests and production, independent review owners, corrective actions, preserved prior states, and residual unknowns.

Machine answerabilityDispute recordCorrective action ledgerEvidence production

/answerability-effectiveness.php

Effectiveness Audit

Audit whether a synthetic corrective action was merely planned, implemented, independently verified, effective, later invalidated, retired, or closed with residual exposure.

Machine answerabilityCorrective action effectivenessImplementation evidenceIndependent verification

/answerability-monitoring.php

Monitoring & Reopening

Monitor synthetic corrective-action audits, verify regression signals, preserve prior closures, reopen review, remediate, and independently revalidate changed states.

Machine answerabilityCorrective action monitoringRegression detectionAudit reopening

/answerability-coverage.php

Coverage & Alert Integrity

Map what a synthetic monitoring architecture can observe, expose blind spots, separate monitor health from scope, and trace alerts through delivery, review, and independent verification.

Machine answerabilityMonitoring coverageBlind spotsAlert integrity

/answerability-validation.php

Validation Drill

Apply a released monitoring-coverage remediation, inject bounded failures, and test alert generation, delivery, review, verification, suspension, correction, and residual unknowns.

Machine answerabilityCoverage remediationAlert path validationFailure injection

/answerability-retest.php

Exception & Retest Ledger

Open a synthetic exception branch from an immutable validation result, compare original and retest stages, and preserve recurrence, evidence, ownership, escalation, and residual unknowns.

Machine answerabilityValidation exceptionSame-fixture retestRecurrence classification

/answerability-patterns.php

Recurrence Pattern Review

Compare immutable exception and retest branches, count recurrence observations without rates, and inspect cohort patterns without implying population, causation, risk, or legal findings.

Machine answerabilityRecurrence reviewCohort comparisonShared dependency hypothesis

/anticipatory-intelligence.php

Anticipatory Intelligence Lab

Compare observation, forecasting, person-risk inference, provenance, machine explanations, and human control in six synthetic anticipatory-intelligence labs.

Anticipatory intelligencePredictive policingPre-crimeAutomation bias

/machine-leadership.php

Machine Leadership Lab

Explore how AI moves from tool to analyst, orchestrator, operational delegate, and proxy leader while humans retain formal office, override duties, and liability.

Machine leadershipProxy governanceAlgorithmic executiveAgentic AI

/predictive-enforcement.php

Predictive Enforcement

Compare eight source-bounded predictive-policing, watchlisting, traveler-screening, and behavioral-threat-assessment programs, then test a synthetic feedback loop.

Predictive policingPredictive enforcementWatchlistingTraveler screening

Evidence and comparison explorers

Compare systems, institutions, claims, authority owners, and hypothetical or accepted changes.

/atlas.php

Evidence Atlas

Explore evidence-labeled public records about countries, doctrine, systems, kill-chain functions, human-control arrangements, timelines, unknowns, and sources.

Evidence AtlasMilitary AIHuman controlAutonomous weapons

/concept-matrix.php

Concept Matrix

Compare thirteen recurring concepts across KillChains.com labs, evidence records, KillWebs, and live Evulgare accountability areas for real systems.

Concept matrixEvidence provenanceAutomation biasHuman authorization

/claim-lineage.php

Claim Lineage

Trace public claims backward to source records and transformations, then forward to authority owners, machine and human roles, public reuse, review status, unknowns, and correction paths.

Claim lineageInstitutional authorityEvidence provenanceHuman control

/authority-casebook.php

Authority Casebook

Compare six source-reconciled cases showing which machine functions are documented, what authority migrated into software, and what legal or institutional authority remained human.

Institutional authorityOperational delegationMachine leadershipHuman control

/change-impact.php

Change Impact

Preview which claims, authority cases, pages, simulations, answers, discovery files, and durable owners require review when a source or claim changes.

Change impactSource supersessionCorrectionsClaim lineage

/historical-changes.php

Change Ledger

Review accepted KillChains.com corrections, withdrawals, supersessions, and evidence reclassifications with prior states, release proof, public impacts, and preserved history.

Historical change ledgerRelease diffAccepted correctionsSource supersession

Systems, countries, and providers

Browse public records about systems, countries, organizations, and evidence-bounded technology relationships.

/countries.php

Countries & Use

Review evidence-labeled country and alliance summaries of public military-AI programs, doctrine, systems, human-control arrangements, and unresolved unknowns.

CountriesMilitary AI policyAutonomous weapons policyPublic doctrine

/systems.php

Systems

Compare ISR, command networks, terminal recognition, loitering munitions, local defense, autonomous mobility, swarms, and AI-security system categories.

Military systemsISRAir defenseLoitering munitions

/kill-chain-technology-providers/

Technology Providers

Browse source-labeled kill-chain technology companies and trace reviewed relationships to sensing, command, autonomy, defense, communications, space, and cyber systems.

Technology providersCompany-to-system relationshipsDefense technologyCommand and control

Governance, sources, and history

Inspect risk, methodology, source identity, source freshness, correction, citation, and editorial responsibility.

/risks-law.php

Risk, Law & Control

Examine international humanitarian law, weapons review, responsible-AI principles, meaningful human control, testing, accountability, escalation, and governance.

International humanitarian lawWeapons reviewMeaningful human controlAI governance

/methodology.php

Methodology

See how KillChains.com separates facts, claims, analysis, disputes, unknowns, and synthetic scenarios while governing sources, corrections, safety, state, and testing.

Research methodologyEvidence statesSource hierarchySimulation method

/sources.php

Source Library

Search the curated official policies, program records, standards, frameworks, manufacturer statements, legal positions, and independent research used by KillChains.com.

SourcesPrimary evidenceManufacturer claimsStandards

/source-review.php

Source Review

Inspect review dates, source classes, dependencies, supersession, link-check boundaries, and correction pathways for every public KillChains.com source record.

Source freshnessCorrectionsEvidence dependenciesSupersession

/citation.php

Citation Guide

Use stable citation templates for KillChains.com pages, the Evidence Atlas, synthetic challenges, saved views, source states, release versions, review dates, and corrections.

Citation guideResearch citationDataset citationSimulation citation

/editorial-policy.php

Editorial Policy

Learn about Michael Kappel, the named creator of KillChains.com, and how the site handles evidence review, AI assistance, source labels, commercial independence, and corrections.

Editorial policyAuthorshipAI-assisted draftingCorrections

Answers and publication information

Find concise answers, stable terms, author identity, privacy boundaries, and terms of use.

/faq.php

FAQ

Get concise, evidence-linked answers about kill chains, F2T2EA, cyber and AI attack chains, autonomous weapons, human control, Iron Dome, privacy, and WebXR.

Kill chain FAQF2T2EAAutonomous weaponsHuman control

/glossary.php

Glossary

Search plain-language definitions for F2T2EA, cyber and AI kill chains, kill webs, control modes, automation bias, provenance, confidence, preauthorization, and replay.

GlossaryDefined termsF2T2EAHuman control

/about-author.php

About the Author

Meet Michael Kappel, creator of KillChains.com: a senior software engineer and architect focused on .NET, SQL Server, TypeScript, Angular, validation, and human-reviewed AI workflows.

Michael KappelSoftware architectureEnterprise modernizationHuman-reviewed AI engineering

/privacy.php

Privacy

Read how KillChains.com minimizes data: no accounts, advertising, analytics, raw XR telemetry, server-side learning profiles, uploads, or hidden sharing of local interactions.

PrivacyData minimizationWebXR telemetryLocal storage

/terms.php

Terms

Review the educational-use, lawful-use, non-reliance, intellectual-property, external-link, and prohibited-operational-use terms for KillChains.com.

Terms of useAcceptable useEducational simulationNon-operational boundary

Three connected responsibilities

Know when to stay here—and when to continue elsewhere.

The public learning environment and the production accountability product are deliberately separated so educational simulations cannot be mistaken for operational software.

KillChains.com

Understand one consequential sequence.

Use this site for synthetic simulation, evidence literacy, human control, institutional authority, and public research.

See the KillChains boundary

KillWebs.com

Understand the governed option space.

Use the sister learning site for path diversity, compatibility, trust, common dependencies, graceful degradation, and recomposition.

Open KillWebs.com

Evulgare

MAKE THE MACHINE ANSWERABLE.

Use Evulgare for real software that reconstructs what deployed systems knew, did, showed, and were authorized to do.

Open Evulgare.com