Evidence
Technology proposes a different starting point for security: establish identity before resolving the protected connection. The next question is simple. Does that architectural change produce a measurable result?
Test design
A current frontier AI model driving standard attacker tools was pointed at the same server twice, once with SIF off and once with SIF on, under an authorized assessment plan following NIST SP 800-115. Tested 23 July 2026.
Both conditions ran against the same host under the same assessment approach. The only variable changed was SIF.
Interactive demonstration
Move the switch to see the two conditions beside each other. This is an illustrative demonstration driven by representative figures from the recorded test. It is not a live feed from a production system.
The recorder
| external probe → :22 | no reply |
| external probe → :443 | no reply |
| census scanner → :53 | no reply |
| untrusted range → :4444 | no reply |
| bot × N → :9443 :2404 :2087 | no reply |
| TCP sweep 1–65535 | no reply |
| ICMP echo | no reply |
| identity verified → authorized client | 200 OK |
Source addresses redacted. Measured on an Owl One asset.
The result
This real-world penetration test demonstrated that the Identity First, Connection Second architecture can protect conventional enterprise systems from being compromised.
Same server, same assessment approach. With SIF off, it was taken over. With SIF on, 281 probes drew no reply, no port was found open, and an authorized client kept working.
One test, one layer, one recorded window. It is the result we invite qualified evaluators to reproduce in their own environment, with their own scope and tooling.
