// Method — dark again. Three columns. Diagrammatic SVGs. function StepGlyph({ kind }) { if (kind === 'plant') return ( {[[40,50],[100,48],[160,52],[35,90],[110,90],[170,92]].map(([x,y],i)=>( ))} prd-eu · 6 tokens armed ); if (kind === 'provoke') return ( {[0,72,144,216,288].map((a,i)=>{ const rad = a*Math.PI/180; return ; })} {['VT','SHO','GEO','IP','MIT'].map((l,i)=>{ const a = i*72*Math.PI/180; const x = 110+Math.cos(a)*52, y = 75+Math.sin(a)*52; return {l}; })} parallel enrichment · < 4s ); return ( iam.revoke cf.block siem.ingest nis2.dossier slack.page deterministic · audited · < 60s ); } function MethodSection() { const steps = [ { n:'01', title:'Plant', sub:'Nine primitives', body:'AWS IAM keys, URL hooks, DNS subdomains, PDF beacons, JDBC credentials, LLM API tokens, RAG canaries, CI/CD pipeline canaries, npm package canaries. Indistinguishable from the real thing. Five-minute setup, no agent on your network.', kind:'plant' }, { n:'02', title:'Provoke', sub:'AI investigation', body:'A LangGraph pipeline fires the moment a token is touched. Parallel enrichment via VirusTotal, AbuseIPDB, Shodan, GeoIP. MITRE-mapped. Classifies the actor as human-novice, human-expert, script, or autonomous agent.', kind:'provoke' }, { n:'03', title:'Prevail', sub:'Deterministic response', body:'Above your risk threshold, Vantuz revokes the IAM key, blocks the IP at Cloudflare, ingests to your SIEM, and writes the NIS2 Article 23 incident dossier. All before your phone has finished ringing.', kind:'contain' }, ]; return (
FILE № 02 · METHOD

Three moves. Sixty seconds.

Every Vantuz response is deterministic — no LLM in the critical path. Claude only narrates after containment is done.

{steps.map(s => (
{s.n} · {s.sub.toUpperCase()}
{s.title}.

{s.body}

))}
); } window.MethodSection = MethodSection;