Method, apparatus, and system to map network reachability

A non-transitory computer readable medium comprising computer readable code operable, when executed by one or more processing apparatuses in the computer system is configured to instruct a computing device to perform steps as follows, comprising:

• communicating between a network reachability module and a cyber-security response-orchestrator engine that is configured to mitigate a detected cyber threat,
• mapping and dynamically tracking network reachability of a cyber-security response-orchestrator engine, where the network reachability module has a tracking module to 1) monitor network traffic and 2) keep track of known devices and/or known subnets on a network, which is updated as previously unknown devices and subnets on the network are detected, and
• communicating between a trigger module and the tracking module to repeatedly, on their own initiative, go through and check network addresses to see when at least one network device in each known subnet can be reached, via at least one of a generated spoofed transmission and response communication, and then periodically recheck the network addresses with network devices in each known subnet over time in order to determine whether the known devices and/or known subnets on the network currently either 1) can receive or 2) cannot receive protocol communications from a location of a host device for the cyber-security response-orchestrator engine.