Research / Paper Files

Paper Files

Paper Files are a personal practice of continuous study in cybersecurity that applies the scientific method as a learning tool. Each article is written not for academic publication, but as a deliberate exercise to sharpen the axe — deepening knowledge on specific topics, organizing ideas with rigor, and observing how understanding of certain subjects develops over time. It is the intellectual equivalent of a training journal: each entry records what was studied, how it was analyzed, and what conclusions emerged.

I strongly recommend that security professionals adopt this method. Choose a topic you want to master, research primary sources (RFCs, papers, official documentation), structure your text with introduction, methodology, analysis, and conclusion, and write as if you were explaining to a colleague. The act of writing forces clarity of thought and exposes gaps in understanding that passive reading cannot reveal. Use the articles on this site as examples of format and depth, and build your own collection — over time, you will have a personal repository of refined knowledge that no course or certification can replace.

DAI & ADAI · 2026

DAI · EN

DAI: A Domain-Specific LLM with Model-Excluded Authority, Capability-Disjoint Verification, and Recomputable Receipts

Read paper →ADAI · EN

Autonomous Defensive AI: An Envelope-and-Evidence Framework for Governed LLMs Acting on Production Infrastructure

Read paper →

All Detection DFIR AppSec DevSecOps AI Security IAM Cloud Containers IR Crypto Research Phishing Secrets

226 papers

Research

DAI: A Domain-Specific LLM with Model-Excluded Authority, Capability-Disjoint Verification, and Recomputable Receipts

DAI (Decripte Artificial Intelligence) is a proprietary domain-specific LLM within a governed autonomous defensive architecture. It is an instance of the proposed ADAI category defined in the companion framework paper. The paper describes incident-response sessions spanning signal curation, structured target extraction, reviewed playbook selection, declared action contracts, deterministic admissibility, bounded network-edge execution, capability-disjoint verification, hash-linked evidence sealing, scheduled review, reconciliation and undo. The learned model is trained on the system’s own outcome-verified transcripts and narrates the result; admissibility and execution authority remain structurally outside the model. The paper addresses per-principal containment within shared enforcement domains, rule-budget aggregation, element-identified reconciliation, independent receipt recomputation and exact localization of controlled tampering. Reported measurements refer to the version and period described in the manuscript and are not a claim of universal performance.

2026-10-01Read paper →Research

Autonomous Defensive AI: An Envelope-and-Evidence Framework for Governed LLMs Acting on Production Infrastructure

ADAI (Autonomous Defensive Artificial Intelligence) is a proposed category of governed autonomous cyber defense. The framework specifies defended perimeters, bounded effects, declared rollback and capability-disjoint verification for systems acting on production infrastructure. Admissibility is adjudicated outside the learned model, while hash-linked, seal-terminated receipts provide a self-describing recomputation contract. The paper develops exact tamper localization, per-principal containment at shared enforcement points, element-wise reconciliation under aggregation, atomization conditions, blinded correlation and conditions for composite reversibility. It separates policy quality, envelope integrity and evidence integrity in its evaluation methodology. Formal results depend on their stated assumptions. This preprint does not assert that every theoretical construction is implemented or independently validated.

2026-10-01Read paper →Phishing

Adaptive Phishing in the 2026 Enterprise: Threat Modeling, Multi-Layer Detection, and Operational Defenses Against Credential Theft, Business Email Compromise, and AI-Assisted Social Engineering

Phishing remains one of the most economically efficient and operationally resilient attack classes in cybersecurity because it exploits human trust, workflow dependence, and identity-centric access control. By 2026, the problem has evolved well beyond mass email lures into a multi-channel ecosystem that spans email, collaboration platforms, SMS, QR codes, OAuth consent abuse, adversary-in-the-middle (AiTM) session hijacking, callback phishing, and AI-assisted personalization at scale. This paper presents a 2026-accurate, publication-ready study of phishing as a socio-technical attack surface and proposes a defense methodology centered on identity telemetry, content and URL analysis, behavioral detection, and automated containment. We formalize phishing as a probabilistic interaction between attacker capability, user susceptibility, and control-plane exposure, and we define measurable security objectives in terms of compromise probability, detection latency, and dwell time. Building on modern enterprise controls such as zero trust, DMARC alignment, conditional access, secure email gateways, browser isolation, CNAPP, and eBPF-based telemetry, we present a layered detection architecture that integrates message analysis, identity signals, endpoint events, and cloud audit logs into a unified risk model. We also evaluate the approach using realistic phishing scenarios representative of 2024–2026 tradecraft, including QR credential theft, Microsoft 365 token replay, and invoice-themed BEC. The experimental section compares baseline filtering to a fused detection pipeline and demonstrates substantial gains in recall and mean time to containment while preserving acceptable false-positive rates. A detailed case study of an enterprise-grade AiTM phishing campaign illustrates the operational value of cross-domain telemetry and fast revocation. The paper concludes with practical guidance for defenders, highlighting why the next generation of phishing defense must be identity-aware, AI-assisted, and built for high-speed response rather than static signature matching.

2026-05-11Read paper →DevSecOps

DevSecOps in 2026: Designing, Implementing, and Validating a Continuous Security Pipeline for Cloud-Native Software Supply Chains

DevSecOps has matured from a process slogan into an operational discipline for securing software delivery across cloud-native, containerized, and AI-augmented development environments. By 2026, the software supply chain has become a primary attack surface, shaped by dependency confusion, CI/CD compromise, malicious open-source updates, secrets exposure, build-system tampering, and the increasing use of generative AI in development workflows. This paper presents a technically rigorous account of DevSecOps as a cybersecurity capability, not merely a tooling stack. We formalize the problem of integrating security controls into the software lifecycle under constraints of velocity, reliability, and developer autonomy. We then propose a layered methodology spanning code, dependency, build, artifact, deployment, runtime, and governance planes. The approach combines threat modeling, policy-as-code, signed provenance, automated static and dynamic analysis, container and infrastructure scanning, SBOM generation, eBPF-assisted runtime detection, and measurable security gates tied to risk thresholds. Implementation guidance is provided for GitHub Actions, GitLab CI, and Kubernetes environments using tools such as Semgrep, Trivy, Syft, Grype, Cosign, SLSA-aligned provenance, kube-bench, Checkov, and Falco. An experimental evaluation framework is included, with quantitative metrics for false positives, mean pipeline latency, vulnerability detection coverage, and remediation lead time. A case study illustrates a realistic cloud-native service pipeline hardened against supply-chain and secret-exfiltration attacks. The paper concludes that DevSecOps is most effective when treated as a socio-technical control system with explicit attacker models, risk budgets, and feedback loops, rather than as an automated checklist. The 2026 threat landscape demands that security be continuous, attestable, and enforceable from source commit to production runtime, especially in environments where AI-assisted coding and ephemeral infrastructure accelerate both delivery and adversarial opportunity.

2026-05-11Read paper →DevSecOps

DevSecOps in 2026: Embedding Continuous Security Controls into Cloud-Native Delivery Pipelines Under AI-Augmented Threats

DevSecOps has evolved from a cultural slogan into a measurable engineering discipline that governs how organizations design, build, test, deploy, and operate software in environments dominated by cloud-native architectures, software supply chain dependencies, and AI-accelerated threat activity. By 2026, the operational center of gravity has shifted from perimeter defense to pipeline integrity, artifact provenance, policy-as-code, and runtime isolation across containers, Kubernetes, serverless platforms, and managed PaaS services. This paper presents a full-stack DevSecOps framework that integrates secure coding, dependency governance, infrastructure-as-code validation, software composition analysis, secret detection, container and Kubernetes policy enforcement, SBOM generation, provenance attestation, and runtime observability. We formalize the DevSecOps problem as a constrained optimization objective balancing delivery latency, defect discovery cost, and security risk reduction. The paper then proposes a reference methodology that maps controls to the software delivery lifecycle and to concrete attack paths, including CI runner compromise, dependency confusion, poisoned build caches, token theft, and artifact tampering. A practical implementation is described using GitHub Actions, GitLab CI, Trivy, Semgrep, Syft, Grype, Checkov, kube-bench, OPA Gatekeeper, Sigstore/cosign, and eBPF-based runtime detection. Experimental evaluation on representative cloud-native workloads shows that security gates can be introduced with manageable overhead when staged intelligently, while substantially improving detection of vulnerable libraries, exposed secrets, and misconfigured infrastructure. A real-world case study demonstrates how DevSecOps controls reduce blast radius during a supply-chain compromise scenario. The paper concludes that mature DevSecOps in 2026 is no longer about adding scanners to pipelines, but about engineering verifiable trust into delivery systems, aligning security evidence with compliance, and continuously validating assumptions in a threat landscape shaped by AI-assisted reconnaissance, code generation, and social engineering.

2026-05-10Read paper →IR

Incident Response in 2026: AI-Augmented, Cloud-Native, and Identity-Centric Operations for Detecting, Containing, and Eradicating Modern Cyber Intrusions

Incident response (IR) in 2026 is no longer a post-compromise, host-centric discipline focused primarily on malware triage and disk imaging. It has matured into a multi-domain operational function that must unify identity telemetry, cloud control-plane visibility, endpoint detection and response (EDR), security information and event management (SIEM), extended detection and response (XDR), eBPF-driven runtime data, and governance for AI-enabled workflows. This paper presents a practical, publication-ready framework for modern IR that reflects the realities of 2026: adversaries increasingly abuse valid accounts, cloud APIs, OAuth consent, remote management tooling, SaaS collaboration features, and AI-assisted social engineering, while defenders must compress dwell time under constrained analyst capacity. We formalize the IR problem as an optimization over time-to-detect, time-to-contain, and probability of successful eradication, subject to evidence preservation and business continuity constraints. Building on NIST guidance, MITRE ATT&CK, and contemporary cloud and identity defense practices, we propose an operational methodology centered on identity-first scoping, graph-based entity correlation, tiered containment playbooks, and post-incident hardening loops. The methodology is implemented using widely deployed 2026-era tools such as Velociraptor, Sigma, YARA, osquery, Wazuh, Zeek, Suricata, Splunk, Microsoft Sentinel, Elastic Security, CrowdStrike Falcon, and eBPF-based sensors. We evaluate the approach through comparative experiments and a realistic intrusion case study involving stolen credentials, OAuth abuse, cloud persistence, and cross-environment lateral movement. Results show that identity-centric scoping reduces mean time to scope by 41%, while automated containment workflows reduce median dwell time by 57% without materially increasing false-positive business interruptions. The paper concludes that effective IR in 2026 requires treating identity, cloud, endpoint, and AI governance as a single operational surface rather than separate domains.

2026-05-09Read paper →Detection

Detection Engineering for Modern Cybersecurity in 2026: A Multi-Layer, Behavior-Centric Framework for High-Fidelity Threat Detection Across Endpoint, Identity, Cloud, and AI Workloads

Detection remains the decisive control plane in modern cybersecurity because prevention is no longer sufficient against adaptive adversaries, living-off-the-land intrusion chains, identity abuse, supply-chain compromise, and prompt-injection-enabled abuse of generative AI systems. In 2026, effective detection must operate across heterogeneous telemetry domains: endpoint process and kernel events, identity provider logs, cloud control-plane activity, container and Kubernetes signals, network flow and packet metadata, and emergent AI application traces. This paper presents a behavior-centric detection framework designed to reduce false positives while improving coverage against post-compromise activity. The framework unifies rules, statistical baselines, graph correlation, and detection-as-code practices into a single operational pipeline. It formalizes the detection problem as an optimization over expected utility, balancing detection probability, alert cost, and analyst workload under constrained telemetry fidelity. The paper also provides an implementation blueprint using widely deployed 2026-era tools and standards, including Sigma, YARA, Zeek, Suricata, Sysmon, eBPF telemetry, OpenTelemetry, and cloud-native audit sources. Experimental evaluation is conducted through representative adversary behaviors mapped to ATT&CK, demonstrating measurable gains in precision and triage efficiency when detections are layered and context-enriched rather than deployed as isolated signatures. A case study on identity-driven cloud intrusion illustrates how token abuse, OAuth consent manipulation, and abnormal control-plane sequencing can be detected before lateral expansion. The discussion addresses operational pitfalls such as alert fatigue, sensor blind spots, encrypted traffic, and the special challenges of detecting misuse in AI-assisted workflows. The paper concludes that detection in 2026 must be engineered as a continuously tested socio-technical system, not as a static collection of rules, and argues for standardized validation, adversary emulation, and detection quality metrics as foundational security practices.

2026-05-08Read paper →IAM

Identity and Access Management as a Cybersecurity Control Plane in 2026: Threat-Driven Design, Zero-Trust Integration, and Operational Hardening

Identity and Access Management (IAM) has evolved from a directory-centric administrative function into the primary control plane for enterprise cybersecurity. By 2026, the convergence of cloud-native architectures, SaaS sprawl, remote work, machine identities, and AI-assisted attack tradecraft has made identity the most contested layer in the enterprise stack. This paper presents a technical, threat-driven analysis of IAM as a security system, rather than merely an access administration service. We formalize IAM as a set of policy, authentication, authorization, provisioning, and telemetry primitives whose security objective is to minimize unauthorized privilege while preserving operational continuity. We examine contemporary attack paths including credential phishing, adversary-in-the-middle session hijacking, token theft, consent abuse, OAuth application abuse, SCIM and federation misconfiguration, dormant privilege exploitation, and identity-provider compromise. We then propose a hardened IAM methodology that combines phishing-resistant authentication, least-privilege privilege orchestration, just-in-time access, continuous conditional evaluation, device and workload attestation, and graph-based anomaly detection over identity relationships. The paper maps these controls into practical deployment patterns for modern environments spanning Microsoft Entra ID, Okta, Google Cloud Identity, AWS IAM/Identity Center, and hybrid LDAP/Active Directory estates. We further present an implementation blueprint, evaluation framework, and a detailed case study of a SaaS-centric enterprise migration from password-based access to a zero-trust IAM architecture. The findings show that the dominant failure modes in 2026 are not cryptographic weakness but lifecycle, federation, and operational design flaws, especially around stale entitlements, over-broad OAuth grants, and token persistence. The paper concludes that IAM security in 2026 must be treated as a continuously measured, automated, and adversary-aware control plane integrated with security telemetry, governance, and incident response.

2026-05-07Read paper →Phishing

Phishing in 2026: Adversary Tradecraft, Detection Engineering, and a Risk-Adaptive Defense Framework for Modern Identity-Centric Enterprises

Phishing remains the dominant initial access vector in enterprise compromise because it exploits the most scalable weakness in modern environments: human decision-making under time pressure, ambiguity, and trust. By 2026, phishing has evolved well beyond mass email lures into a multi-channel ecosystem spanning email, SMS, collaboration suites, QR codes, OAuth consent abuse, adversary-in-the-middle (AiTM) credential interception, browser-in-the-browser deception, and AI-assisted social engineering. This paper presents a technical, publication-ready analysis of phishing as an operational cyber threat and a defense problem. We formalize phishing as an identity-centric attack pipeline in which an adversary optimizes the probability of a victim completing a harmful action while minimizing pre-delivery and post-delivery detection. We then propose a risk-adaptive defense methodology that combines authentication hardening, provenance enforcement, content and URL analysis, user interaction telemetry, detection engineering, and response automation. The methodology is designed for 2026-era environments characterized by widespread MFA adoption, conditional access, cloud collaboration, mature zero trust architectures, and the integration of eBPF, CNAPP, and SIEM/SOAR pipelines. The paper includes an implementation blueprint, a reproducible evaluation design, and a case study illustrating how AiTM phishing bypasses legacy MFA assumptions. Our evaluation framework models the expected loss reduction from layered controls, using both static controls such as DMARC enforcement and FIDO2-resistant authentication, and dynamic controls such as time-of-click URL analysis and session risk scoring. We show that no single control is sufficient: robust phishing defense requires coupling preventative controls with rapidly-instrumented detection and response. The paper concludes with practical recommendations for enterprises, security vendors, and incident responders, emphasizing identity governance, phishing-resistant MFA, continuous control validation, and the operational limits of user awareness training in isolation.

2026-05-06Read paper →DevSecOps

DevSecOps in 2026: A Threat-Informed, Policy-Driven, and AI-Augmented Framework for Secure Software Delivery Across Cloud-Native and Hybrid Environments

DevSecOps has evolved from a cultural slogan into an operational discipline that must withstand modern software supply-chain attacks, container and Kubernetes abuse, identity-centric compromise, and the accelerating use of generative AI in development pipelines. By 2026, the security of software delivery is no longer determined only by source-code review or perimeter controls, but by the integrity of the entire path from developer workstation to production runtime. This paper presents a threat-informed DevSecOps framework designed for cloud-native and hybrid enterprises that build and deploy software at scale. The framework integrates policy-as-code, software bill of materials governance, provenance attestation, continuous vulnerability and secret detection, eBPF-backed runtime monitoring, and AI-assisted triage under explicit human approval gates. We formalize the problem as a constrained optimization of delivery velocity, defect detection, and risk reduction, and we derive measurable security objectives using pipeline-stage risk scores and control coverage metrics. The paper also situates DevSecOps within the 2026 threat landscape, including dependency confusion, poisoned packages, compromised CI runners, token theft, Kubernetes privilege escalation, and malicious model-assisted social engineering. A reference implementation is provided using GitHub Actions, GitLab CI, Terraform, Trivy, Semgrep, OPA/Conftest, Sigstore Cosign, and in-cluster admission enforcement. We evaluate the methodology through a comparative experiment across representative pipelines and demonstrate improved detection of high-severity issues, reduced time-to-remediate, and stronger build provenance guarantees with modest overhead. Finally, a realistic case study illustrates how the framework blocks a supply-chain intrusion that would otherwise progress from a vulnerable dependency to signed artifact abuse and unauthorized deployment. The paper argues that DevSecOps in 2026 must be understood as a socio-technical control plane, not a toolchain checklist, and that effective implementation requires measurable policy enforcement, cryptographic trust, and operational feedback loops across development, security, and platform engineering.

2026-05-05Read paper →Detection

Detection in Cybersecurity at Scale in 2026: A Risk-Calibrated, Multi-Layer Methodology for Telemetry Fusion, Adversary Behavior Modeling, and Operational Response

Detection remains the decisive control plane of modern cybersecurity because prevention is incomplete, identity has become the new perimeter, and adversaries now routinely combine living-off-the-land tradecraft, cloud control-plane abuse, supply-chain compromise, and AI-assisted social engineering. This paper presents a 2026-oriented, publication-ready treatment of detection as an operational discipline rather than a narrow alerting function. We formalize detection as a probabilistic inference problem over heterogeneous telemetry streams, including endpoint, network, identity, cloud, SaaS, application, and model-usage signals. Building on established frameworks such as MITRE ATT&CK, D3FEND, NIST CSF 2.0, and Elastic’s detection engineering practices, we propose a risk-calibrated methodology that fuses signatures, behavioral analytics, anomaly detection, and graph-based correlation into a layered detection pipeline. The paper introduces a threat-model-driven design that explicitly accounts for false-positive economics, adversary dwell-time reduction, telemetry loss, and analytic drift. We describe an implementation pattern using eBPF-based host telemetry, OpenTelemetry for application observability, Sigma-to-backend rule translation, and SOAR-enforced response gating. An experimental evaluation is presented using representative attack scenarios spanning credential theft, token abuse, lateral movement, exfiltration, and AI-assisted phishing, with comparative tables for precision, recall, and time-to-detect. A case study demonstrates how a cloud-tenant compromise can be detected through weak signals that individually appear benign but become highly actionable when correlated across identity, endpoint, and control-plane events. We argue that high-fidelity detection in 2026 requires continuous validation, adversary emulation, and governance around AI-generated content and model endpoints. The paper concludes with a practical roadmap for organizations seeking measurable detection maturity without overfitting to any single platform, vendor, or data source.

2026-05-04Read paper →Crypto

Crypto in Cybersecurity in 2026: Offensive Abuse, Defensive Engineering, and a Unified Risk Framework for Cryptographic Systems

Cryptography remains one of the most misunderstood and over-trusted layers in modern cybersecurity. By 2026, it is no longer sufficient to ask whether an algorithm is mathematically sound; practitioners must evaluate how cryptography is deployed, how keys are generated and protected, how trust anchors are provisioned, how protocols fail under real operational pressure, and how adversaries weaponize implementation mistakes, supply-chain compromise, side channels, and social engineering. This paper examines “crypto” as a full-stack cybersecurity problem spanning confidential messaging, TLS ecosystems, software signing, cloud key management, hardware roots of trust, password storage, post-quantum migration, and criminal abuse of encrypted channels. We propose a unified methodology that models cryptographic risk across four layers: primitive security, protocol composition, implementation integrity, and operational governance. The paper synthesizes offensive tradecraft and defensive engineering drawn from real-world vulnerabilities, including weak randomness, nonce reuse, padding-oracle exposure, misconfigured certificate validation, signature-substitution attacks, and key theft from CI/CD, endpoint, and cloud control planes. We also analyze the 2026 threat landscape, where AI-assisted phishing, malicious package ecosystems, and encrypted command-and-control reduce attacker cost while increasing the burden on defenders. Our contribution is a practical framework for evaluating cryptographic control planes in enterprises, with concrete validation steps using open-source tools, measurable security criteria, and deployment guidance for hybrid classical/post-quantum transitions. Experimental evaluation uses a representative test environment to compare crypto hygiene profiles across common service classes and to quantify the reduction in exposure achieved by hardening measures such as strict certificate pinning policy, HSM-backed key storage, ephemeral key rotation, and centralized secret scanning. The paper concludes that cryptography is not merely a collection of algorithms but an operational security system whose resilience depends on the weakest trust boundary in the stack.

2026-05-04Read paper →DFIR

DFIR in 2026: A Unified, Evidence-Centric Methodology for Cloud-Native, Endpoint, Identity, and AI-Assisted Incident Response

Digital Forensics and Incident Response (DFIR) has evolved from a predominantly endpoint-centered discipline into a multi-domain operational capability spanning cloud control planes, identity providers, SaaS platforms, containerized workloads, mobile devices, and AI-assisted collaboration environments. By 2026, defenders face adversaries who routinely exploit signed malware, identity abuse, living-off-the-land binaries, cloud API token theft, and generative AI-enabled social engineering. This paper presents an evidence-centric DFIR methodology designed for contemporary enterprise environments in which telemetry is distributed, ephemeral, partially encrypted, and often retained under policy constraints rather than technical limitations. The proposed approach unifies triage, acquisition, normalization, correlation, reconstruction, and reporting into a single chain-of-custody-aware workflow that preserves evidentiary integrity while supporting rapid operational decision-making. We formalize the DFIR problem as a constrained inference task over heterogeneous event streams and define measurable objectives for latency, completeness, fidelity, and attribution confidence. The paper also introduces an implementation blueprint that combines modern forensic tooling, eBPF-based runtime visibility, cloud audit-log ingestion, Sigma/YARA analytics, and graph-based correlation. An experimental evaluation using representative enterprise datasets demonstrates improved time-to-scoping, higher artifact recovery rates, and stronger timeline reconstruction than traditional siloed workflows. A detailed case study on a hybrid intrusion involving OAuth token theft, endpoint persistence, and cloud data staging illustrates how the methodology performs in practice. Finally, we discuss emerging challenges including AI-generated phishing, post-quantum transition evidence, and legal/ethical constraints around privacy-preserving collection. The result is a practical, publication-ready DFIR framework for 2026 and beyond.

2026-05-03Read paper →Cloud

Cloud Security in 2026: A Formalized Detection and Hardening Framework for Identity-Centric Multi-Cloud and Kubernetes Environments

Cloud security in 2026 is dominated by identity abuse, control-plane compromise, misconfiguration at scale, supply-chain insertion, and the operational complexity introduced by multi-cloud, Kubernetes, managed identity systems, and AI-assisted administration. This paper presents a publication-ready research study on cloud security that combines a formal threat model with a deployable detection and hardening methodology centered on identity, telemetry fusion, and continuous verification. The work is grounded in 2026-era realities: widespread use of AWS, Microsoft Azure, and Google Cloud Platform; Kubernetes and service mesh adoption; cloud-native application protection platforms (CNAPP); eBPF-based runtime visibility; and security governance pressures from post-quantum planning and AI-enabled operations. We propose a hybrid control framework that correlates cloud control-plane events, workload telemetry, and identity graph changes to detect high-risk sequences such as privilege escalation, token theft, suspicious federation, metadata service abuse, and lateral movement across tenants and clusters. The methodology integrates event normalization, risk scoring, and rule-based plus graph-based detection logic. We also describe an implementation using Sigma-like detection logic, cloud-native logs, Kubernetes audit telemetry, and runtime signals from eBPF sensors. Experimental evaluation on representative cloud attack paths shows that combining identity-aware correlation with workload-level telemetry materially improves detection fidelity over single-source alerting, especially for stealthy compromise chains. A detailed case study illustrates an attack progression from exposed access keys to privileged control-plane actions and container breakout attempts, showing how the proposed framework detects and constrains each stage. The paper concludes with operational recommendations for cloud defenders, including zero-trust enforcement, least-privilege design, short-lived credentials, guardrails for AI-powered administration, and evidence-driven incident response in multi-cloud environments.

2026-05-02Read paper →Phishing

Phishing in 2026: A Cyber Operational Framework for Detection, Resistance, and Large-Scale Measurement Across Email, Identity, and AI-Mediated Attack Surfaces

Phishing remains the most persistent and adaptable initial-access vector in modern cybersecurity, but its 2026 form is materially different from the message-spam archetype of the 2010s. Contemporary phishing operations are multi-stage identity attacks that blend credential theft, session hijacking, adversary-in-the-middle (AiTM) reverse-proxy infrastructure, OAuth consent abuse, business email compromise (BEC), QR-based lures, domain impersonation, and increasingly AI-assisted social engineering. This paper presents a publication-ready, operationally grounded framework for understanding, measuring, and defending against phishing as an end-to-end kill chain spanning delivery, deception, authentication bypass, and post-compromise monetization. We formalize phishing risk as a function of exposure, user susceptibility, control-plane weaknesses, and attacker infrastructure resilience, and we map this model to concrete controls spanning DMARC/DKIM/SPF, conditional access, phishing-resistant MFA, browser and DNS protections, egress telemetry, identity threat detection, and user-facing reporting loops. The paper synthesizes 2026-era threat intelligence and defensive practice, including trends in AiTM kits, token theft, QR phishing, cloud identity abuse, and generative-AI-enabled lure optimization. We propose a methodology for high-fidelity phishing defense that combines graph-based sender reputation, URL and page feature extraction, identity-context scoring, and response orchestration, then describe an implementation architecture using mail gateway telemetry, cloud identity logs, browser isolation signals, and SOAR playbooks. Experimental evaluation is presented as a realistic comparative analysis of layered controls across simulated enterprise traffic, showing that no single control is sufficient; rather, robust reduction in compromise rates emerges only when content filtering, authentication hardening, and identity telemetry are fused. A case study of a Microsoft 365 tenant demonstrates how an AiTM campaign can be detected after token replay, and how rapid containment reduces blast radius. The paper closes with operational lessons for 2026: phishing should be treated as an identity-security and fraud problem, not merely a spam-filter problem, and defensive maturity now depends on integration across email, endpoint, browser, cloud identity, and governance layers.

2026-05-01Read paper →DevSecOps

DevSecOps in 2026: An End-to-End Secure Software Delivery Architecture for Cloud-Native, AI-Augmented, and Supply-Chain-Resilient Environments

DevSecOps matured by 2026 from a cultural slogan into a measurable engineering discipline that integrates security controls directly into software delivery, runtime governance, and incident response. This paper presents a full-stack DevSecOps methodology designed for 2026-era environments characterized by cloud-native infrastructure, software supply-chain threats, AI-assisted development, zero trust architectures, and regulated compliance demands. We formalize the problem as an optimization over deployment velocity, risk reduction, and control coverage, then propose a pipeline architecture that combines policy-as-code, SBOM generation, dependency and container image verification, secrets detection, infrastructure-as-code scanning, runtime eBPF telemetry, and continuous control validation. The methodology is built around actionable trust boundaries and feedback loops that connect development, security, operations, and governance functions. We implement the approach using widely deployed 2026 tools and standards, including GitHub Actions, GitLab CI, Snyk, Trivy, Semgrep, Checkov, Open Policy Agent, Sigstore, Syft, Grype, Falco, and Kubernetes admission controls. We evaluate the framework through quantitative analysis of detection coverage, pipeline latency, false positive rates, and remediation time, and we compare pre-merge and post-merge control placement under realistic attack scenarios such as dependency confusion, malicious OCI image insertion, misconfigured cloud permissions, secret leakage, and CI/CD runner compromise. A case study drawn from a Kubernetes-based microservices environment demonstrates that the proposed model reduces high-severity software supply-chain exposure while preserving developer throughput. The paper concludes by highlighting remaining challenges in LLM-assisted code generation, provenance enforcement at scale, policy drift, and the operationalization of post-quantum cryptography within DevSecOps pipelines.

2026-04-30Read paper →IR

Incident Response in Cybersecurity in 2026: A Zero-Trust, Telemetry-Driven, and AI-Assisted Methodology for High-Fidelity Detection, Containment, and Recovery

Incident response (IR) has evolved from a largely forensic, ticket-driven discipline into a continuous, telemetry-rich, decision-intensive security function that must operate across cloud, endpoint, identity, software supply chain, and AI-enabled environments. By 2026, defenders face adversaries that routinely combine credential theft, valid account abuse, living-off-the-land execution, rapid cloud persistence, and automated social engineering. In parallel, organizations have adopted zero trust architectures, CNAPP platforms, eBPF-based runtime visibility, and AI-assisted security operations, yet operational gaps remain in detection fidelity, containment speed, evidence preservation, and cross-domain coordination. This paper presents a full-length research study on IR as a formal cybersecurity capability in 2026, focusing on how modern enterprises can reduce mean time to contain while preserving forensic integrity and business continuity. We propose a methodology that integrates threat-informed triage, graph-based incident scoping, evidence-grade telemetry collection, containment playbooks, and recovery validation with explicit utility constraints. The methodology is grounded in a formal problem model that balances detection latency, false-positive cost, and operational disruption. We further present an implementation blueprint using contemporary tools such as Velociraptor, Sigma, YARA, Sysmon, Zeek, Wazuh, eBPF sensors, and cloud-native event pipelines. An experimental evaluation framework compares telemetry sources and response strategies across endpoint, identity, and cloud incidents, illustrating measurable trade-offs in precision, containment time, and investigative workload. A detailed case study of a hybrid ransomware intrusion demonstrates how identity telemetry, endpoint event correlation, and cloud control-plane logs can reconstruct attacker behavior and support safe recovery. The paper concludes by discussing AI governance, post-quantum readiness, and the operationalization of IR in environments where adversaries and defenders increasingly co-evolve through automation.

2026-04-29Read paper →Detection

Detection-Centric Cybersecurity in 2026: A Multi-Layer, Telemetry-Fused Framework for High-Fidelity Intrusion Detection, Threat Hunting, and Adversarially Robust Response

Detection remains the decisive control plane of cybersecurity in 2026 because perimeter defenses have become porous, identity is the new boundary, and adversaries increasingly blend commodity exploitation with AI-assisted social engineering, living-off-the-land tradecraft, and cloud-native abuse. This paper examines detection as an end-to-end cyber capability rather than a single alerting technology, and proposes a telemetry-fused methodology that unifies endpoint, network, identity, cloud, and application signals into a probabilistic detection pipeline. The framework is designed for contemporary environments characterized by hybrid work, SaaS dependency, containerized workloads, ephemeral infrastructure, and automated attacker adaptation. We formalize detection as a sequential inference problem under partial observability, adversarial manipulation, and severe class imbalance, and we derive operational metrics that extend beyond precision and recall to cost-weighted expected loss, time-to-detect, and adversarial robustness. The paper synthesizes mature 2026-era practices including Sigma normalization, MITRE ATT&CK mapping, eBPF-driven telemetry, cloud posture and workload visibility, behavioral baselining, and security orchestration with analyst-in-the-loop feedback. We further provide an implementation blueprint using open-source tools and widely deployed commercial paradigms, then evaluate the approach through realistic attack scenarios including credential theft, cloud token abuse, lateral movement, and defense evasion. Results show that high-fidelity detection in 2026 depends less on any single sensor and more on correlation quality, identity context, and disciplined rule lifecycle management. A case study based on a hybrid enterprise compromise illustrates how multi-layer detection compresses attacker dwell time, exposes cross-domain pivots, and reduces false positives compared with siloed alerting. The paper concludes that future progress lies in robust analytics, privacy-preserving sharing, model governance, and adversarially aware detection engineering that can withstand AI-enabled attackers and rapidly evolving operational environments.

2026-04-28Read paper →Detection

Detection at Scale in 2026: A Unified Multi-Layer Framework for Cloud, Endpoint, Identity, and AI-Driven Cyber Threat Detection

Detection remains the decisive control in modern cybersecurity because prevention fails under adversarial adaptation, software complexity, and identity-centric attack paths. By 2026, defenders operate across hybrid cloud estates, containerized workloads, SaaS identities, endpoint fleets, and AI-assisted user and machine interactions, while attackers increasingly combine living-off-the-land tradecraft, credential theft, supply-chain intrusion, and automation-enhanced social engineering. This paper presents a full-stack detection framework for 2026 that unifies telemetry normalization, behavior-centric analytics, attack-graph correlation, and risk-adaptive scoring across endpoint, network, identity, cloud control plane, and AI interaction layers. The core contribution is a practical methodology that treats detection as an evidence fusion problem under uncertainty rather than as isolated alert rules. We formalize detection quality using precision, recall, timeliness, and expected cost, and we map those metrics to operational playbooks and response thresholds. The proposed architecture combines high-fidelity data sources such as endpoint security telemetry, DNS and proxy logs, cloud audit events, Kubernetes control-plane signals, eBPF-derived process visibility, identity risk events, and LLM safety and abuse telemetry. We evaluate the framework against representative intrusion sequences including phishing-led account takeover, cloud API abuse, lateral movement, and low-and-slow exfiltration patterns. Results show that correlation across layers materially improves true-positive rate while reducing alert volume compared with siloed detection. The paper also examines practical deployment constraints: schema drift, telemetry gaps, adversarial evasion, privacy, and analyst workload. A 2026 case study demonstrates how the framework would have shortened dwell time in a hybrid identity-cloud intrusion by combining impossible travel, token abuse, anomalous OAuth consent, and container execution analytics. The contribution is not a new detector in isolation, but a defensible operational model for modern detection engineering that remains robust under the threat landscape of 2026.

2026-04-27Read paper →Cloud

Cloud Security in 2026: A Unified Detection and Resilience Framework for Identity-Centric Attacks, Misconfiguration, and AI-Enabled Abuse Across Multi-Cloud Environments

Cloud computing has become the default operating model for enterprise IT, but by 2026 it has also become the primary battleground for identity compromise, control-plane abuse, workload hijacking, and data exfiltration. The cloud security problem is no longer reducible to perimeter hardening or basic configuration hygiene. It is a systems problem spanning identity, API authorization, ephemeral compute, software supply chains, observability, governance, and the operational realities of multi-cloud and hybrid deployments. This paper presents a 2026-grounded research treatment of cloud cybersecurity, focusing on a unified detection and resilience framework designed to address attack paths that dominate modern incidents: token theft, IAM privilege escalation, exposed secrets, container escape precursors, Kubernetes control-plane abuse, serverless abuse, storage exposure, and AI-assisted social engineering against cloud operators. We formalize the cloud threat model around adversary objectives, cloud provider trust boundaries, and measurement uncertainty introduced by elastic infrastructure. We then propose a practical methodology that fuses CSPM, CWPP, CIEM, eBPF telemetry, control-plane audit analysis, and graph-based attack-path reasoning into a single analytic workflow. The paper includes implementation guidance using open standards and tools available by 2026, such as OpenTelemetry, Falco, kube-bench, Trivy, Cloud Custodian, and cloud-native audit streams. We evaluate the approach using representative scenarios and compare detection coverage, time-to-detection, and operational burden across alternative control stacks. A detailed case study on a Kubernetes-backed SaaS deployment demonstrates how a low-severity misconfiguration can chain into identity abuse and data access at scale. The paper concludes with a discussion of limitations, governance constraints, post-quantum preparation, and the implications of AI-augmented attackers and defenders in the 2026 cloud security landscape. The central claim is that effective cloud defense now requires continuous identity-aware reasoning, workload-level telemetry, and policy-as-code enforcement rather than isolated point controls.

2026-04-27Read paper →Phishing

Phishing in 2026: A Socio-Technical, Identity-Centric, and AI-Aware Defense Framework for Detection, Disruption, and Resilience

Phishing remains the dominant initial access vector in cyber intrusion campaigns because it exploits the most difficult boundary in security: human trust operating inside identity systems that are increasingly federated, cloud-native, and machine-augmented. In 2026, the phishing landscape is characterized by highly personalized lures, adversary-in-the-middle credential interception, OAuth consent abuse, QR-based delivery, business email compromise, deepfake-enabled social engineering, and large-scale infrastructure rotation that defeats simplistic URL-blocking approaches. This paper presents a full-stack research treatment of phishing as a socio-technical attack class and proposes an identity-centric defense methodology designed for the 2026 threat environment. The methodology integrates mail authentication, browser and endpoint telemetry, identity-provider signals, user-risk modeling, content and network analysis, and incident response automation. We formalize phishing as a probabilistic attacker-success optimization problem under constraints on time, cost, and detection risk, and we derive defense objectives that minimize both compromise probability and dwell time. The paper further presents an implementation blueprint using widely deployed controls and open tooling, including DMARC, SPF, DKIM, MTA-STS, TLS-RPT, Microsoft Defender for Office 365, Google Workspace protections, YARA, Zeek, Sigma, and SOAR workflows. Experimental evaluation is reported through a realistic lab design that compares attachment, URL, credential-harvest, QR, and consent-phishing variants, showing that no single control is sufficient but layered identity-aware defenses can materially reduce success rates and shorten containment time. A detailed case study illustrates a modern adversary-in-the-middle campaign and the practical value of token revocation, conditional access, and tenant-wide hunt logic. The paper concludes with an operational discussion of limitations, user training, organizational governance, and future work in passkey adoption, browser isolation, post-quantum readiness, and AI-assisted defense.

2026-04-26Read paper →DevSecOps

DevSecOps as a Cybersecurity Control Plane in 2026: Operationalization, Measurement, and Resilience Across the Software Supply Chain

DevSecOps has matured from a cultural slogan into a measurable security control plane that spans source code, build systems, deployment pipelines, cloud infrastructure, and runtime telemetry. In 2026, organizations face a threat environment shaped by software supply-chain compromise, dependency confusion, CI/CD secret theft, malicious package publishing, container escape attempts, infrastructure-as-code misconfiguration, and the accelerating use of generative AI for phishing, code injection, and social engineering. This paper presents a technically grounded analysis of DevSecOps as a security architecture rather than a tooling pattern. We formalize the threat model, define security objectives across confidentiality, integrity, availability, and supply-chain provenance, and propose a layered methodology that integrates policy-as-code, software bill of materials generation, SAST, DAST, IaC scanning, container image hardening, artifact signing, secrets detection, runtime enforcement, and continuous verification. The paper contributes a practical framework for measuring DevSecOps maturity using risk-weighted metrics and a control effectiveness model. We define composite indicators that combine detection latency, false-positive burden, policy compliance, and blast-radius reduction, and we discuss how to instrument pipelines using widely adopted 2026-era tools and standards such as Sigstore, SLSA, SBOM formats, Open Policy Agent, eBPF-based runtime monitoring, and cloud-native application protection platforms. An experimental evaluation compares three pipeline profiles—baseline CI/CD, security-augmented DevSecOps, and high-assurance supply-chain-hardened DevSecOps—showing trade-offs in build latency, defect detection, release confidence, and incident containment. A case study of a containerized microservices platform demonstrates how a layered DevSecOps program prevents a high-severity credential exfiltration path and reduces the mean time to remediate misconfigurations. The discussion addresses organizational constraints, developer experience, AI-assisted development risks, governance, and the limits of automation. The paper concludes that effective DevSecOps in 2026 is not defined by tool adoption alone, but by verifiable control coverage, measurable risk reduction, and sustained operational discipline across the software delivery lifecycle.

2026-04-25Read paper →IR

Incident Response in 2026: AI-Assisted Detection, Containment, and Recovery for Cloud-Native, Identity-Centric, and Ransomware-Driven Cyber Incidents

Incident response (IR) in 2026 operates in a materially different threat and technology environment than the one that shaped classical playbooks. Modern incidents increasingly traverse hybrid identity fabrics, SaaS control planes, cloud workloads, endpoint fleets, and data pipelines, while adversaries exploit stolen credentials, living-off-the-land tooling, software supply chains, and AI-enabled social engineering. At the same time, defenders can leverage mature zero trust architectures, eBPF-based telemetry, cloud-native application protection platforms, security information and event management systems with scalable analytics, and large-language-model-assisted triage under strict governance. This paper proposes a publication-ready IR methodology for 2026 that is optimized for identity-first intrusions, ransomware, cloud control-plane abuse, and high-volume alert conditions. The method formalizes incident response as a constrained optimization problem over detection latency, containment blast radius, evidence integrity, and business availability, and then maps those objectives to a practical operational workflow spanning preparation, detection, analysis, containment, eradication, recovery, and post-incident improvement. We present an implementation architecture integrating endpoint, identity, cloud, and network signals; a decision matrix for containment sequencing; and a tiered workflow for analyst augmentation using AI systems without delegating authoritative judgments. Experimental evaluation is provided through realistic scenarios derived from contemporary enterprise and public-sector incidents, including credential theft, privileged access abuse, and ransomware. The results show that identity-aware containment and cloud-side revocation reduce mean time to contain more effectively than host-only actions in multi-tenant environments, while evidentiary rigor and rollback planning reduce recovery risk. A detailed case study illustrates how the approach addresses a modern hybrid intrusion. The paper concludes with practical guidance for 2026-ready IR programs, emphasizing measurable service objectives, immutable logging, tabletop exercises, and governance for AI-assisted operations.

2026-04-24Read paper →Detection

Detection in Cybersecurity at Scale in 2026: A Hybrid Telemetry, eBPF, and ML-Driven Framework for High-Fidelity Intrusion Detection

Detection remains the decisive control plane in modern cybersecurity because prevention is no longer sufficient against supply-chain compromise, cloud-native abuse, identity theft, living-off-the-land tradecraft, and rapidly adapting adversaries. By 2026, defensive programs must operate across endpoints, identities, containers, cloud control planes, SaaS platforms, and AI-enabled workflows while preserving low latency, low false-positive rates, and operational explainability. This paper presents a technically grounded framework for detection that combines deterministic analytics, behavioral correlation, graph-based investigation, and supervised and unsupervised machine learning over heterogeneous telemetry. The proposed architecture integrates endpoint visibility through eBPF and ETW, cloud audit streams, IAM signals, DNS and proxy telemetry, and security orchestration outputs into a unified detection pipeline. We formalize detection as an optimization problem that balances detection probability, expected analyst cost, and adversary adaptation risk under constrained latency and observability. We further describe a production-oriented implementation pattern using Sigma-to-backend translation, rule versioning, feature extraction, entity-centric correlation, and model governance. To ground the design, we evaluate representative detection scenarios including credential theft, PowerShell abuse, container escape precursors, suspicious OAuth consent, and beaconing behavior. The evaluation uses realistic metrics such as precision, recall, mean time to detect, and alert volume per day, showing that hybrid detection consistently outperforms single-source signature or ML-only approaches. A detailed case study on a cloud identity compromise demonstrates how multi-layer telemetry can reveal attacker progression before lateral movement and exfiltration. The paper concludes that the future of detection lies in composable analytics, cryptographically trustworthy telemetry, and human-centered triage pipelines that retain rigor under AI-accelerated adversarial pressure.

2026-04-23Read paper →