Case study · Cybersecurity · Aether for cybersecurity

Meridian Financial

Cut a critical-CVE triage from a two-day fire drill to an afternoon.

Headline

2 days → hours

critical-CVE triage to confirmed fix

Digital twin

exploit confirmed off a sandboxed copy

0

actions taken against production to prove it

9 → 1

point tools in the triage path

Background

Meridian is a mid-market bank with a 20-person SOC and a hard regulatory clock on remediation. Their critical-CVE drill was a two-day relay across nine tools — a SIEM, two scanners, a SOAR, a threat-intel portal, a ticketing system and three spreadsheets — and it still came down to an analyst arguing about whether a flagged CVE was actually reachable in their estate.

The challenge

CVSS told them a vulnerability was critical; it never told them whether it was exploitable on their network. Confirming reachability meant either a careful, risky test against production or a guess. Most of the queue was triaged on guesswork, and the genuinely exploitable paths competed for attention with theoretical ones.

What we did

Stood up a digital twin of the relevant network segment, identities and services from existing inventory and telemetry — a sandboxed copy, never the live estate.
Ran CVE-aware review against their actual code and dependencies, then emulated the adversary against the twin to confirm which flagged paths were reachable and exploitable.
Capability gating kept the agent to defensive actions — it could isolate, drain and rotate in the twin, but weaponisation and exfiltration were outside its envelope by construction.
Confirmed findings shipped to the SOC as ranked fixes with blast radius and an audit-grade evidence trail, not as raw alerts.

In their words

“It proved the path was exploitable against a copy of our network — then handed us the fix, not an exploit.”

— SOC Lead, Meridian Financial

The outcome

Critical-CVE triage dropped from a two-day, nine-tool relay to an afternoon, ranked by demonstrated exploitability rather than raw CVSS.
The exploitable paths were proven against a copy of the network — the SOC took zero actions against production to establish reachability.
Each confirmed finding arrived as a fix with a closed-blast-radius estimate, so remediation went straight to engineering with the evidence attached.
The same model now runs continuous detection-as-code validation against the twin between drills.

One detail worth calling out

The cultural shift was trusting a confirmation that came from simulation rather than from a production test. Once the team saw the twin reproduce a known prior incident exactly — same path, same blast radius — they were willing to let it certify reachability without touching the live estate. The refusal layer mattered to the CISO: the same analysis that proved the path could not be asked to walk it.