Shining a Light on the
Mainframe Security Blackhole
Mainframes process 70% of the world's production IT workloads — yet they remain a blind spot for most security teams. We're changing that.
The Threat to Financial Stability
When you use a card, withdraw from an ATM, or transfer funds, a mainframe is usually authorizing, settling, and recording that transaction. Despite their importance, a critical gap exists in how we defend these systems today.
Because mainframes are the central nervous system of global payments and clearing houses, they are highly attractive targets. The primary threats come not from amateur hackers, but from sophisticated, state-sponsored actors and experienced ransomware gangs.
Intelligence shows that nation-state groups from Russia, China, North Korea, and Iran have both the intent and the capability to cause severe disruption to Western financial infrastructure. If the mainframe layer is compromised, cashflow, reconciliation, fraud controls, and everyday customer trust all fail alongside it.
What is MITRE ATT&CK?
Modern Security Operations Centers (SOCs) use MITRE ATT&CK as a shared language to track how hackers operate. It categorizes attacks into TTPs:
⚠️ The Problem
While ATT&CK covers Windows, macOS, cloud, and ICS, there is no native coverage for mainframes.
Mainframe TTP Navigator
121 mainframe-specific TTPs mapped across 12 MITRE ATT&CK tactics. Data sourced from Jonathan Prince's Mainframe MITRE project.
Closing the Gap: Our Initiative
The solution is not just buying more software — it requires translating mainframe activity into a language that standard security teams can understand, hunt for, and alert on. We are gathering a dedicated team of experts to map out attacker behaviours natively for the mainframe environment, bridging the knowledge gap between standard network security and the mainframe ecosystem.
