Method, apparatus, and system to map network reachability

An apparatus, comprising:

• a network reachability module configured to map and dynamically track network reachability of a cyber-security response-orchestrator engine, where the cyber-security response-orchestrator engine is configured to take autonomous actions, without a human to initiate the actions, to mitigate a detected cyber threat,
• where the network reachability module has a tracking module to 1) monitor network traffic and 2) keep a list of known devices and/or known subnets on the network, which is dynamically tracked and updated as previously unknown devices and subnets on the network are detected, and
• where the network reachability module has a trigger module configured to cooperate with the tracking module, where the trigger module is configured to generate a spoofed transmission and/or response communication, supported by a network protocol used by the network, that is used to map network reachability of i) network devices, ii) network addresses, and iii) any combination of both, which either 1) can receive or 2) cannot receive protocol communications from a location of a host for the cyber-security response-orchestrator engine.