Skip to content
FALKENS MAZE

Cyber-threat pathway intelligence

In development

Every attack follows a path.Find where it can be stopped.

Falkens Maze is a method in development for tracing how a harmful or unauthorised action could happen — through which channels, on whose apparent authority — and identifying the checkpoints where it can be interrupted.

Explore the Maze Lab Explore the Method

Interactive fictional scenarios only. No live detection, uploads, or security decisions.

Falkens Maze: metallic falcon and interlocking maze with an illuminated blue pathway. Find the pathway. Break the attack.

I — Why it matters

The message can be genuine. The action can still be wrong.

A supplier's real mailbox asks for new bank details. An AI assistant receives an instruction that looks routine. The communication may be authentic, while the resulting action — a payment, a disclosure, an automated step — is not authorised. Inspecting the message alone cannot settle that.

Common focus

Detect the message

Is this email, file or prompt suspicious? Valuable, but it fails quietly when the source itself is real or compromised.

Falkens Maze focus

Control the action

What would this request cause, and which independent check must hold before it can happen?

II — The Method

Three disciplined steps.

  1. 01

    Trace

    Map the conditions, dependencies and trust relationships an action relies on.

    Follow the route from first contact to consequence.

  2. 02

    Interrupt

    Locate the human and system gates where the route can be stopped.

    Prefer checks that are independent of the requesting channel.

  3. 03

    Verify

    Assess the evidence that each check was actually completed.

    Record who confirmed what, through which channel, and when.

A signed-off checkpoint is evidence that a process was followed — not a guarantee of safety.

III — Worked example

Walk one pathway.

A payment-detail change, traced from first contact to consequence, with an independent verification gate at the point of action.

Illustrative model — not a live scan

Supplier payment-detail change

Stage 04 · checkpoint

The path is interrupted

Pathway interrupted here

Before the change is applied, it must be confirmed through a channel the requester does not control: a known phone number, a second approver, or a system-held reference. The pathway stops here until the check is complete.

Reviewer's question

Is the verification independent of the channel that made the request?

The interactive laboratory

See how the evidence changes the assessment.

Explore fictional payment, information-release, and AI-agent scenarios. Examine verification checkpoints and synthetic source attestations. This is an educational demonstration, not a live cybersecurity check.

Open the Maze Lab

IV — Applications

Where the method is aimed first.

Planned application areas

  • AREA APlanned

    Payment diversion

    Changes to supplier or payee details that redirect legitimate funds.

  • AREA BPlanned

    Sensitive information release

    Requests that lead to disclosure of personal, commercial or official records.

  • AREA CPlanned

    AI agent actions

    Instructions that cause an automated agent to act beyond its intended authority.

V — Development status

Building the foundation.

Falkens Maze is in development. The interactive Maze Lab now demonstrates fictional threat pathways and signed test attestations in your browser. It cannot authenticate real-world evidence, authorise actions or block attacks. There is no login, file upload or live threat scanning.

Methodology
Defined
Synthetic Maze Lab
Available to explore
Signed test evidence
Synthetic only
Live security enforcement
Not implemented

Security and privacy by design: any future architecture will define its data boundaries before it handles sensitive material.