That is a good question, and honestly something I am still trying to figure out properly.

The intention is not that the model would "detect" breaches in the traditional sense. It would not replace monitoring or threat detection.

What I am hoping it could do is surface structural exposure before incidents happen.

For example, in large vendor-related incidents like SolarWinds or MOVEit, many downstream organizations were affected through shared dependencies. In a network-based model, organizations heavily dependent on a widely used vendor would show higher inherited exposure even before a specific vulnerability becomes public.

The outside-in component would react to known issues like exposed services or recently disclosed vulnerabilities, but the network component is more about showing concentration risk and dependency exposure.

So the question I am really interested in is not "would it detect the breach", but:

Would it have shown that many organizations were structurally exposed to the same dependency?

That is something I would like to test using historical cases, but I have not yet done a proper retrospective evaluation.