Skip to content

Cyber digital twin

Intelligence · seven layers
RESTRICTED // INTERNAL--:--:-- PKT
13proposals awaiting decision
Live
financial fraud report — 2026-10-30Karachi · openSIM-swap wave reported across three operatorsGujranwala · openRansomware detonation on logistics sector hostMardan · openNCCIA-C-2026-100680 financial fraudKarachiNCCIA-C-2026-100512 financial fraudKarachiPhishing kit hosted on domestic VPSPeshawar · openCredential-stuffing burst against e-commerceIslamabad · open
illustrative data
Intelligence · seven layers

The national model, and where it is blind

A digital twin is only useful if it tells you which layer is missing. Five of seven layers are populated; the one that would let us see a SIM swap in flight is not.

6 of 7 layers1 critical gap

Layer stack

what is populated
illustrative
L1
Physical & telecom topology
Not populated — gap G08. Wave detection lags 4–6h as a result.
blind
L2
Network & infrastructure
PKCERT and CERT feeds, ASN and hosting map
4 feeds
L3
Identity & identifier
Hashed identifiers only; raw identity stays in NADRA
3 feeds
L4
Financial & value rails
Bank, wallet and 1LINK linkage at institution level
5 feeds
L5
Platform & content
Referral volumes and takedown state per platform
4 feeds
L6
Actor & behaviour
Cluster behaviour, not persons — attribution is human-only
3 feeds
L7
Case & response
Live from the case and mission ledger
2 feeds

Entity graph

cluster-level, never person-level
static model view
L1L2L3L4L5L6L7PK national modelASN clusterdomestic VPShashed identifiersdevice familybank railwallet railexchange off-rampplatform referraltakedownsmule cluster C-221behavioural driftcase 3112mission M-014A6 financial traceA11 predictive
entity live cluster agent governance
A fixed representation of the model, not a live feed. Hashed identifiers only — no person is named here by design.

Scenario simulator

trade-offs, made discussable
IL
The golden hour is decided here, not at the bank.
SMS / URL suppression applied inside the golden hour.
Today 4 of 26 partner rails are at stage 2 or above.
6 of 14 venues are currently reachable (gap G03).
Projected loss avoidedRs 5.0 cr
Holds confirmed49
Residual lossRs 26.8 cr
Reports arriving4,384
Projected capture of value in motion15.8%

Feed health

model inputs
App stores1
Banks, wallets, 1LINK2
Bureau of Emigration / BISP1
Courts (e-filing)1
Embassies / Overseas Pakistanis Foundation0
FIA2

The right-hand column is integration maturity, 0–4. Nothing here is a live connection: each rail is an intended integration waiting on its own approval and interface documentation.

District load

top eight
Lahore74
Karachi70
Islamabad43
Rawalpindi28
Faisalabad28
Multan28
Peshawar25
Hyderabad18

Safeguards

what the twin will not do
  • No facial recognition and no cross-camera person tracking.
  • No matching of social accounts to CCTV or to a physical identity.
  • No DPI or TLS interception. Network evidence arrives by warrant only.
  • Routing is by reviewer-confirmed district name, never by a drawn boundary.
  • Simulation output is a scenario, and is labelled as one everywhere it appears.