Reconnaissance Detection & Attack-Surface Minimisation

Control objective

Reconnaissance detection and attack-surface minimisation watches for the early-stage probing that precedes an attack and removes unnecessary ways for an agent or adversary to map the system. Before exploiting an environment, attackers typically enumerate available agents, tools, APIs and capabilities ('introspection' or reconnaissance); spotting that pattern early gives defenders time to respond, and denying undocumented introspection shrinks what an attacker can even discover. To implement, instrument agent and tool interfaces to detect enumeration patterns - bursts of capability-listing or introspection calls - raise alerts for rapid triage, deny any introspection call that is not part of a documented, sanctioned interface, and log enumeration attempts and denials as evidence. No statistical formula is specified; detection is pattern- and policy-based. The threshold is that enumeration-pattern alerts are triaged in under 1 hour and that 100% of undocumented introspection calls are denied. A breach - an enumeration alert left untriaged beyond an hour, or any undocumented introspection call allowed through - signals weakened defences and must trigger immediate review and tightening, since unanswered reconnaissance is often the prelude to a real intrusion.