TITAN PHOENIX

PHASE 1

BLAST RADIUS

Builds dependency graph via Azure Resource Graph / AWS Resource Explorer / GCP Cloud Asset Inventory + grep of pipeline YAMLs. If impact > 25 resources, hard-blocks the fix.

PHASE 2

BASELINE TESTS

Runs synthetic probes against every dependent (HTTP 200 check, SQL SELECT, pipeline dry-run). Captures "green" state.

PHASE 3

EXECUTE FIX

Applies the approved remediation. Only after human approval (trial always blocks writes).

PHASE 4

POST VERIFY

Re-runs same synthetic tests. Diffs against baseline. Any green→red = cascade break flagged.

PHASE 5

CASCADE REPAIR

LLM generates a fix for each broken dependent using resource-type playbooks. If cascade cost > 10 ops, rolls back the original fix.

SCENARIO 1

GATEKEEPER disables 2 public blobs → CI/CD pipelines break

⚠ BREAK

Pipelines pulling artifacts from blob.core.windows.net/public-artifacts/* start 403-ing
Cloud Build / Azure DevOps / GitHub Actions workflows fail at artifact-download step
Deployments stop. Eng team paralyzed.

✓ PHOENIX AUTO-REPAIR

Blast radius: identifies 3 pipelines referencing that blob (via pipeline-YAML grep)
Pre-fix: post bot comment on each pipeline PR repo warning the fix is coming
Fix: disables public access (GATEKEEPER's original action)
Post-fix: synthetic pipeline run fails → cascade break detected
Auto-repair: LLM generates SAS-token URL + updates pipeline variable groups via Azure DevOps / GitHub API
Result: pipelines re-run and succeed. Public access stays disabled. Evidence logged.

SCENARIO 2

AKS backend → on-prem DB direct (no firewall) → non-compliant. Routing through firewall breaks the app.

⚠ THE CLASSIC HYBRID-CLOUD COMPLIANCE TRAP

App pods in AKS directly reaching on-prem SQL via public IP + NAT
Compliance scan flags it (HIPAA 164.312(e)(1), PCI 1.3 — traffic not inspected / encrypted properly)
If you force traffic through corporate firewall, typical breaks:
- TLS chain breaks (firewall SSL inspection; pod doesn't trust corp CA)
- Connection pool exhaustion (firewall adds latency, pods hold connections longer)
- 60s idle timeout kills long-running transactions
- NAT port exhaustion on firewall with thousands of pods
- Kerberos auth fails (firewall rewrites source IPs)

✓ PHOENIX STAGED MIGRATION (10 STEPS, 4-6 HOURS)

1. DISCOVER current direct path: source pod IPs, dest DB IP/port, transaction TPS
2. BASELINE p50/p95/p99 latency + conn count + error rate over 24hr
3. PREPARE deploy corp CA cert to pod image; pre-create firewall rule scoped to app VNet
4. CANARY deploy 1 replica with DB_URL via firewall; route 10% traffic
5. OBSERVE 1hr. p99 latency within 2x baseline AND error rate < 0.1%? proceed
6. PROGRESSIVE 10% → 25% → 50% → 100% with 30-min soak each
7. CUT-OVER remove direct-path security group rule (firewall path now mandatory)
8. VERIFY 24hr soak; any SEV-2+ incident => auto-rollback to direct path
9. DECOMMISSION remove temporary direct-path fallback rule
10. EVIDENCE auto-generate HIPAA 164.312(e)(1) + PCI 1.3 evidence showing firewalled flow

AUTO-ROLLBACK TRIGGERS

p99 latency > 2x baseline for 15 min · error rate > 1% for 5 min · firewall conntrack > 80% · NAT port exhaustion · any SEV-2+ incident

SCENARIO 3

FORGE rotates SQL admin password → 5 Functions + 2 Logic Apps hardcode that password

⚠ BREAK

FORGE rotates the SQL admin password per PCI 8.2.4 (quarterly rotation)
Legacy Azure Functions with connection strings in App Settings still reference old password
Functions throw 500s. Business workflows halt.

✓ PHOENIX AUTO-REPAIR

Blast radius scan finds 5 Functions + 2 Logic Apps referencing the old SQL server
Pre-rotate: PHOENIX injects Key Vault reference into each Function's App Settings
Rotate: FORGE performs the password rotation
Auto-repair: PHOENIX updates Key Vault secret to new password (Function auto-picks up via KV reference)
Result: zero downtime. New password active. Key Vault reference replaces hardcoded string.

SCENARIO 4

GATEKEEPER tightens NSG → monitoring agents lose inbound, alerts go dark

⚠ BREAK

GATEKEEPER narrows over-permissive NSG rule (remove 0.0.0.0/0)
Datadog / New Relic / Prometheus agents probe VMs from public IPs
Alerts go silent. You're flying blind.

✓ PHOENIX AUTO-REPAIR

Blast radius detects known monitoring service-tag ranges in deny rules
Auto-adds monitoring-service-tag allow rule BEFORE the GATEKEEPER tighten takes effect
Result: monitoring never drops, NSG is tightened, compliance evidence generated

SCENARIO 5

PROMPTGUARD blocks ChatGPT → legit eng team uses it for non-PHI coding help

⚠ BREAK

PROMPTGUARD's DLP policy blocks all ChatGPT traffic
Engineering team loses productivity (using it for code review, boilerplate, docs)
Friction complaints.

✓ PHOENIX AUTO-REPAIR

Blast radius identifies "engineering department" as heavily impacted (via AAD group membership)
Auto-refines PROMPTGUARD policy: allow ChatGPT from eng@ group when NO PHI/PII/source-secrets detected in payload
Logs every allowed conversation for audit (keeps data, doesn't leak it)
Result: compliance preserved, productivity restored, policy now context-aware

Storage · Azure Blob / S3 / GCS

NSG / Security Groups · Azure NSG / AWS SG / GCP Firewall

SQL / RDS · password rotations, private endpoints

Key Vault / Secrets Mgr · access policies, RBAC

CI/CD Pipelines · Azure DevOps / GitHub / GitLab

Hybrid: AKS → on-prem DB · 10-step staged migration

Hybrid: on-prem AD auth · Kerberos, GMSA, AD App Proxy

Any other resource · LLM-generated on the fly

5 PHASES PER FIX — AUTOMATIC

BLAST RADIUS

BASELINE TESTS

EXECUTE FIX

POST VERIFY

CASCADE REPAIR

REAL SCENARIOS PHOENIX HANDLES

GATEKEEPER disables 2 public blobs → CI/CD pipelines break

AKS backend → on-prem DB direct (no firewall) → non-compliant. Routing through firewall breaks the app.

FORGE rotates SQL admin password → 5 Functions + 2 Logic Apps hardcode that password

GATEKEEPER tightens NSG → monitoring agents lose inbound, alerts go dark

PROMPTGUARD blocks ChatGPT → legit eng team uses it for non-PHI coding help

PHOENIX REPAIR PLAYBOOKS BUILT-IN

PRICING