Adding controls & attacks

Extend the catalog without touching code: your own compliance controls and attack scenarios are added as importable packs.

Extending the catalog

• Custom controls — give it an ID, a level, its framework references and the check that evaluates it; it runs, scores and exports like the 318 shipped in the box.
• Declarative checks, no code, over Microsoft Graph or REST connectors.
• Attack scenarios — the simulation catalog extends by importing JSON attack packs, alongside the built-in (non-removable) scenarios.
• An internal requirement or a client-specific framework becomes a first-class control.

Going further in the guide: how controls are structured.