Research / Paper Files
Paper Files
Paper Files are a personal practice of continuous study in cybersecurity that applies the scientific method as a learning tool. Each article is written not for academic publication, but as a deliberate exercise to sharpen the axe — deepening knowledge on specific topics, organizing ideas with rigor, and observing how understanding of certain subjects develops over time. It is the intellectual equivalent of a training journal: each entry records what was studied, how it was analyzed, and what conclusions emerged.
I strongly recommend that security professionals adopt this method. Choose a topic you want to master, research primary sources (RFCs, papers, official documentation), structure your text with introduction, methodology, analysis, and conclusion, and write as if you were explaining to a colleague. The act of writing forces clarity of thought and exposes gaps in understanding that passive reading cannot reveal. Use the articles on this site as examples of format and depth, and build your own collection — over time, you will have a personal repository of refined knowledge that no course or certification can replace.
DAI & ADAI · 2026
DAI: A Domain-Specific LLM with Model-Excluded Authority, Capability-Disjoint Verification, and Recomputable Receipts
DAI (Decripte Artificial Intelligence) is a proprietary domain-specific LLM within a governed autonomous defensive architecture. It is an instance of the proposed ADAI category defined in the companion framework paper. T…
Read paper →ADAI · ENAutonomous Defensive AI: An Envelope-and-Evidence Framework for Governed LLMs Acting on Production Infrastructure
ADAI (Autonomous Defensive Artificial Intelligence) is a proposed category of governed autonomous cyber defense. The framework specifies defended perimeters, bounded effects, declared rollback and capability-disjoint ver…
Read paper →25 papers
DevSecOps in 2026: Designing, Implementing, and Validating a Continuous Security Pipeline for Cloud-Native Software Supply Chains
DevSecOps has matured from a process slogan into an operational discipline for securing software delivery across cloud-native, containerized, and AI-augmented development environments. By 2026, the software supply chain has become a primary attack surface, shaped by dependency confusion, CI/CD compromise, malicious open-source updates, secrets exposure, build-system tampering, and the increasing use of generative AI in development workflows. This paper presents a technically rigorous account of DevSecOps as a cybersecurity capability, not merely a tooling stack. We formalize the problem of integrating security controls into the software lifecycle under constraints of velocity, reliability, and developer autonomy. We then propose a layered methodology spanning code, dependency, build, artifact, deployment, runtime, and governance planes. The approach combines threat modeling, policy-as-code, signed provenance, automated static and dynamic analysis, container and infrastructure scanning, SBOM generation, eBPF-assisted runtime detection, and measurable security gates tied to risk thresholds. Implementation guidance is provided for GitHub Actions, GitLab CI, and Kubernetes environments using tools such as Semgrep, Trivy, Syft, Grype, Cosign, SLSA-aligned provenance, kube-bench, Checkov, and Falco. An experimental evaluation framework is included, with quantitative metrics for false positives, mean pipeline latency, vulnerability detection coverage, and remediation lead time. A case study illustrates a realistic cloud-native service pipeline hardened against supply-chain and secret-exfiltration attacks. The paper concludes that DevSecOps is most effective when treated as a socio-technical control system with explicit attacker models, risk budgets, and feedback loops, rather than as an automated checklist. The 2026 threat landscape demands that security be continuous, attestable, and enforceable from source commit to production runtime, especially in environments where AI-assisted coding and ephemeral infrastructure accelerate both delivery and adversarial opportunity.
Read paper →DevSecOpsDevSecOps in 2026: Embedding Continuous Security Controls into Cloud-Native Delivery Pipelines Under AI-Augmented Threats
DevSecOps has evolved from a cultural slogan into a measurable engineering discipline that governs how organizations design, build, test, deploy, and operate software in environments dominated by cloud-native architectures, software supply chain dependencies, and AI-accelerated threat activity. By 2026, the operational center of gravity has shifted from perimeter defense to pipeline integrity, artifact provenance, policy-as-code, and runtime isolation across containers, Kubernetes, serverless platforms, and managed PaaS services. This paper presents a full-stack DevSecOps framework that integrates secure coding, dependency governance, infrastructure-as-code validation, software composition analysis, secret detection, container and Kubernetes policy enforcement, SBOM generation, provenance attestation, and runtime observability. We formalize the DevSecOps problem as a constrained optimization objective balancing delivery latency, defect discovery cost, and security risk reduction. The paper then proposes a reference methodology that maps controls to the software delivery lifecycle and to concrete attack paths, including CI runner compromise, dependency confusion, poisoned build caches, token theft, and artifact tampering. A practical implementation is described using GitHub Actions, GitLab CI, Trivy, Semgrep, Syft, Grype, Checkov, kube-bench, OPA Gatekeeper, Sigstore/cosign, and eBPF-based runtime detection. Experimental evaluation on representative cloud-native workloads shows that security gates can be introduced with manageable overhead when staged intelligently, while substantially improving detection of vulnerable libraries, exposed secrets, and misconfigured infrastructure. A real-world case study demonstrates how DevSecOps controls reduce blast radius during a supply-chain compromise scenario. The paper concludes that mature DevSecOps in 2026 is no longer about adding scanners to pipelines, but about engineering verifiable trust into delivery systems, aligning security evidence with compliance, and continuously validating assumptions in a threat landscape shaped by AI-assisted reconnaissance, code generation, and social engineering.
Read paper →DevSecOpsDevSecOps in 2026: A Threat-Informed, Policy-Driven, and AI-Augmented Framework for Secure Software Delivery Across Cloud-Native and Hybrid Environments
DevSecOps has evolved from a cultural slogan into an operational discipline that must withstand modern software supply-chain attacks, container and Kubernetes abuse, identity-centric compromise, and the accelerating use of generative AI in development pipelines. By 2026, the security of software delivery is no longer determined only by source-code review or perimeter controls, but by the integrity of the entire path from developer workstation to production runtime. This paper presents a threat-informed DevSecOps framework designed for cloud-native and hybrid enterprises that build and deploy software at scale. The framework integrates policy-as-code, software bill of materials governance, provenance attestation, continuous vulnerability and secret detection, eBPF-backed runtime monitoring, and AI-assisted triage under explicit human approval gates. We formalize the problem as a constrained optimization of delivery velocity, defect detection, and risk reduction, and we derive measurable security objectives using pipeline-stage risk scores and control coverage metrics. The paper also situates DevSecOps within the 2026 threat landscape, including dependency confusion, poisoned packages, compromised CI runners, token theft, Kubernetes privilege escalation, and malicious model-assisted social engineering. A reference implementation is provided using GitHub Actions, GitLab CI, Terraform, Trivy, Semgrep, OPA/Conftest, Sigstore Cosign, and in-cluster admission enforcement. We evaluate the methodology through a comparative experiment across representative pipelines and demonstrate improved detection of high-severity issues, reduced time-to-remediate, and stronger build provenance guarantees with modest overhead. Finally, a realistic case study illustrates how the framework blocks a supply-chain intrusion that would otherwise progress from a vulnerable dependency to signed artifact abuse and unauthorized deployment. The paper argues that DevSecOps in 2026 must be understood as a socio-technical control plane, not a toolchain checklist, and that effective implementation requires measurable policy enforcement, cryptographic trust, and operational feedback loops across development, security, and platform engineering.
Read paper →DevSecOpsDevSecOps in 2026: An End-to-End Secure Software Delivery Architecture for Cloud-Native, AI-Augmented, and Supply-Chain-Resilient Environments
DevSecOps matured by 2026 from a cultural slogan into a measurable engineering discipline that integrates security controls directly into software delivery, runtime governance, and incident response. This paper presents a full-stack DevSecOps methodology designed for 2026-era environments characterized by cloud-native infrastructure, software supply-chain threats, AI-assisted development, zero trust architectures, and regulated compliance demands. We formalize the problem as an optimization over deployment velocity, risk reduction, and control coverage, then propose a pipeline architecture that combines policy-as-code, SBOM generation, dependency and container image verification, secrets detection, infrastructure-as-code scanning, runtime eBPF telemetry, and continuous control validation. The methodology is built around actionable trust boundaries and feedback loops that connect development, security, operations, and governance functions. We implement the approach using widely deployed 2026 tools and standards, including GitHub Actions, GitLab CI, Snyk, Trivy, Semgrep, Checkov, Open Policy Agent, Sigstore, Syft, Grype, Falco, and Kubernetes admission controls. We evaluate the framework through quantitative analysis of detection coverage, pipeline latency, false positive rates, and remediation time, and we compare pre-merge and post-merge control placement under realistic attack scenarios such as dependency confusion, malicious OCI image insertion, misconfigured cloud permissions, secret leakage, and CI/CD runner compromise. A case study drawn from a Kubernetes-based microservices environment demonstrates that the proposed model reduces high-severity software supply-chain exposure while preserving developer throughput. The paper concludes by highlighting remaining challenges in LLM-assisted code generation, provenance enforcement at scale, policy drift, and the operationalization of post-quantum cryptography within DevSecOps pipelines.
Read paper →DevSecOpsDevSecOps as a Cybersecurity Control Plane in 2026: Operationalization, Measurement, and Resilience Across the Software Supply Chain
DevSecOps has matured from a cultural slogan into a measurable security control plane that spans source code, build systems, deployment pipelines, cloud infrastructure, and runtime telemetry. In 2026, organizations face a threat environment shaped by software supply-chain compromise, dependency confusion, CI/CD secret theft, malicious package publishing, container escape attempts, infrastructure-as-code misconfiguration, and the accelerating use of generative AI for phishing, code injection, and social engineering. This paper presents a technically grounded analysis of DevSecOps as a security architecture rather than a tooling pattern. We formalize the threat model, define security objectives across confidentiality, integrity, availability, and supply-chain provenance, and propose a layered methodology that integrates policy-as-code, software bill of materials generation, SAST, DAST, IaC scanning, container image hardening, artifact signing, secrets detection, runtime enforcement, and continuous verification. The paper contributes a practical framework for measuring DevSecOps maturity using risk-weighted metrics and a control effectiveness model. We define composite indicators that combine detection latency, false-positive burden, policy compliance, and blast-radius reduction, and we discuss how to instrument pipelines using widely adopted 2026-era tools and standards such as Sigstore, SLSA, SBOM formats, Open Policy Agent, eBPF-based runtime monitoring, and cloud-native application protection platforms. An experimental evaluation compares three pipeline profiles—baseline CI/CD, security-augmented DevSecOps, and high-assurance supply-chain-hardened DevSecOps—showing trade-offs in build latency, defect detection, release confidence, and incident containment. A case study of a containerized microservices platform demonstrates how a layered DevSecOps program prevents a high-severity credential exfiltration path and reduces the mean time to remediate misconfigurations. The discussion addresses organizational constraints, developer experience, AI-assisted development risks, governance, and the limits of automation. The paper concludes that effective DevSecOps in 2026 is not defined by tool adoption alone, but by verifiable control coverage, measurable risk reduction, and sustained operational discipline across the software delivery lifecycle.
Read paper →DevSecOpsOperationalizing DevSecOps in Cloud-Native Pipelines: Threat Modeling, Automated Enforcement, and Empirical Security Outcomes in the 2026 Software Supply Chain
The acceleration of cloud-native software delivery has fundamentally transformed the attack surface of modern organizations. Continuous Integration and Continuous Deployment (CI/CD) pipelines, containerized workloads, and large-scale dependency ecosystems have introduced new classes of vulnerabilities across the software supply chain. High-impact incidents such as the SolarWinds supply-chain compromise, the Log4Shell vulnerability (CVE-2021-44228), and the XZ Utils backdoor (CVE-2024-3094) demonstrated that adversaries increasingly target build pipelines, dependency resolution mechanisms, and artifact distribution systems rather than traditional runtime vulnerabilities. DevSecOps emerged as a response to this threat landscape, embedding security controls directly into development pipelines while preserving deployment velocity. By 2026, mature implementations incorporate automated static and dynamic analysis, Software Bill of Materials (SBOM) generation, cryptographic artifact signing, runtime anomaly detection using eBPF telemetry, and policy enforcement using infrastructure-as-code governance engines. This paper presents an operational framework for DevSecOps in cloud-native environments, focusing on measurable risk reduction across the software lifecycle. We formalize the threat model of CI/CD ecosystems, identify adversarial entry points across developer workstations, dependency repositories, pipeline orchestration systems, and container registries, and introduce a methodology integrating automated scanning, policy enforcement, and runtime detection. The framework combines static analysis tools (Semgrep, CodeQL), container security scanners (Trivy, Grype), artifact signing via Sigstore Cosign, and runtime monitoring with Falco and eBPF-based telemetry. An experimental evaluation was conducted across a simulated enterprise pipeline comprising 120 microservices deployed on Kubernetes. The proposed DevSecOps pipeline reduced exploitable vulnerabilities by 63.4%, decreased mean-time-to-remediation (MTTR) by 47%, and detected simulated supply-chain attacks with 92% accuracy. We also present a detailed case study demonstrating how automated SBOM generation and dependency policy enforcement prevented a dependency-confusion attack in a CI pipeline. The results show that DevSecOps is most effective when security controls are integrated as deterministic, policy-driven pipeline gates rather than advisory scanning steps. Our findings emphasize the necessity of cryptographic provenance, reproducible builds, and runtime behavioral monitoring to defend against modern supply-chain attacks. Finally, we discuss emerging challenges in AI-assisted development, LLM-generated code vulnerabilities, and the need for secure pipeline governance in increasingly autonomous software development environments.
Read paper →DevSecOpsRisk-Driven DevSecOps Architecture with Multi-Stage, MITRE ATT&CK-Based Correlation and Empirical Evidence in Cloud-Native CI/CD Pipelines
TITLE: Risk-Driven DevSecOps Architecture with Multi-Stage, MITRE ATT&CK-Based Correlation and Empirical Evidence in Cloud-Native CI/CD Pipelines ABSTRACT: The increasing adoption of cloud-native architectures and highly automated CI/CD pipelines has significantly expanded the attack surface associated with the software development lifecycle. Well-documented incidents, including supply chain compromises and the exploitation of widely deployed vulnerabilities, show that isolated security controls are insufficient when they are not integrated into mechanisms for context-aware prioritization and behavior-based correlation. In this work, we present a risk-driven DevSecOps architecture that integrates static code analysis, dependency analysis, SBOM generation and verification, infrastructure as code validation, runtime behavioral detection, and a formal engine for computing contextual risk. The architecture uses the MITRE ATT&CK framework as an ontology for multi-stage correlation of events across the entire development and execution pipeline. We provide a critical analysis of the limitations of approaches based solely on CVSS and show that the lack of operational contextualization often leads to inappropriate prioritization of vulnerabilities and to alert fatigue. We propose a mathematical formulation of risk as a composite function of exploitability probability estimated by EPSS, normalized technical impact, and dynamic factors of operational exposure. We introduce formal definitions of the attacker, correctness properties of the build-blocking mechanism, and a probabilistic correlation model between adversarial techniques. The architecture was implemented in a Kubernetes environment using GitLab CI, SonarQube, Semgrep, Trivy, Syft, Grype, OWASP ZAP, Falco, Suricata, and Open Policy Agent. We evaluated the system empirically over a period of six months on a set of distributed enterprise microservices in two distinct organizational domains. The results show a consistent reduction in mean time to remediation, a relative decrease in false positives, and a limited operational impact on overall build time. The empirical findings suggest that the integration of formal risk modeling, threat intelligence, and policy automation can significantly improve the operational effectiveness of DevSecOps programs in cloud-native environments.
Read paper →DevSecOpsRisk-Driven DevSecOps Architecture with Multi-Stage Correlation Based on MITRE ATT&CK and Empirical Evidence in Cloud-Native CI/CD Pipelines
TITLE: Risk-Driven DevSecOps Architecture with Multi-Stage Correlation Based on MITRE ATT&CK and Empirical Evidence in Cloud-Native CI/CD Pipelines ABSTRACT: The growing adoption of cloud-native architectures and highly automated CI/CD pipelines has significantly expanded the attack surface associated with the software development lifecycle. Widely documented incidents, including supply chain compromises and the exploitation of widely distributed vulnerabilities, demonstrate that isolated security controls are insufficient when they are not integrated with contextual prioritization and behavioral correlation mechanisms. In this work, we present a risk-driven DevSecOps architecture that integrates static code analysis, dependency analysis, SBOM generation and verification, infrastructure-as-code validation, runtime behavioral detection, and a formal contextual risk calculation engine. The architecture uses the MITRE ATT&CK framework as an ontology for multi-stage correlation of events across the entire development and execution pipeline. We conducted a critical analysis of the limitations of approaches based exclusively on CVSS, showing that the absence of operational context often leads to inappropriate prioritization of vulnerabilities and alert fatigue. We propose a mathematical formulation of risk as a composite function of the exploitation probability estimated by EPSS, normalized technical impact, and dynamic operational exposure factors. We introduce formal definitions of the adversary, correctness properties of the build-blocking mechanism, and a probabilistic model for correlation between adversary techniques. The architecture was implemented in a Kubernetes environment using GitLab CI, SonarQube, Semgrep, Trivy, Syft, Grype, OWASP ZAP, Falco, Suricata, and Open Policy Agent. We empirically evaluated the system over six months in a set of enterprise microservices distributed across two distinct organizational domains. The results indicate a consistent reduction in mean time to remediation, a relative decrease in false positives, and limited operational impact on total build time. The empirical results suggest that the integration of formal risk modeling, threat intelligence, and policy automation can significantly improve the operational effectiveness of DevSecOps programs in cloud-native environments.
Read paper →DevSecOpsRisk-Oriented DevSecOps Architecture with Multi-Stage Correlation Based on MITRE ATT&CK and Empirical Evidence in Cloud-Native CI/CD Pipelines
TITLE: Risk-Oriented DevSecOps Architecture with Multi-Stage Correlation Based on MITRE ATT&CK and Empirical Evidence in Cloud-Native CI/CD Pipelines ABSTRACT: The growing adoption of cloud-native architectures and highly automated CI/CD pipelines has significantly expanded the attack surface associated with the software development lifecycle. Widely documented incidents, including supply chain compromises and exploitation of broadly distributed vulnerabilities, demonstrate that isolated security controls are insufficient when not integrated with contextual prioritization and behavioral correlation mechanisms. In this work, we present a risk-oriented DevSecOps architecture that integrates static code analysis, dependency analysis, SBOM generation and verification, infrastructure as code validation, runtime behavioral detection, and a formal contextual risk computation engine. The architecture uses the MITRE ATT&CK framework as an ontology for multi-stage correlation of events throughout the development and execution pipeline. We conduct a critical analysis of the limitations of approaches based exclusively on CVSS, showing that the absence of operational contextualization often leads to inadequate vulnerability prioritization and alert fatigue. We propose a mathematical formulation of risk as a composite function of the exploitation probability estimated by EPSS, normalized technical impact, and dynamic operational exposure factors. We introduce formal definitions of the adversary, correctness properties of the build-blocking mechanism, and a probabilistic model of correlation between adversarial techniques. The architecture was implemented in a Kubernetes environment using GitLab CI, SonarQube, Semgrep, Trivy, Syft, Grype, OWASP ZAP, Falco, Suricata, and Open Policy Agent. We empirically evaluated the system over six months in a set of corporate microservices distributed across two distinct organizational domains. The results indicate a consistent reduction in mean time to remediation, a relative decrease in false positives, and limited operational impact on total build time. The empirical findings suggest that integrating formal risk modeling, threat intelligence, and policy automation can significantly improve the operational effectiveness of DevSecOps programs in cloud-native environments.
Read paper →DevSecOpsThreat-Oriented DevSecOps: A Formal Architecture for Integrating MITRE ATT&CK–Based SAST, DAST, SCA, and Behavioral Telemetry in CI/CD Pipelines
TITLE: Threat-Oriented DevSecOps: A Formal Architecture for Integrating MITRE ATT&CK–Based SAST, DAST, SCA, and Behavioral Telemetry in CI/CD Pipelines ABSTRACT: Threat-Oriented DevSecOps: A Formal Architecture for Integrating MITRE ATT&CK–Based SAST, DAST, SCA, and Behavioral Telemetry in CI/CD Pipelines Abstract: The large-scale adoption of cloud-native architectures and continuous integration/continuous delivery (CI/CD) pipelines has fundamentally transformed software development processes. However, when security mechanisms are not systematically incorporated into the development lifecycle, this automation can significantly expand the attack surface. Widely documented incidents such as the compromise of the SolarWinds supply chain and the exploitation of CVE-2021-44228 (Log4Shell) demonstrate that a lack of integration among code security, dependency security, and runtime monitoring can lead to large-scale intrusions. Although static analysis (SAST), dynamic analysis (DAST), and software composition analysis (SCA) tools are widely deployed in DevSecOps pipelines, their isolated operation often generates large numbers of alerts and makes risk-based prioritization difficult. This paper proposes a threat-oriented DevSecOps architecture that combines security scan results with behavioral telemetry and systematic mapping to the MITRE ATT&CK framework. We mathematically formalize residual risk computation in CI/CD pipelines by combining severity metrics (CVSS), runtime evidence of exploitation, and the contextual criticality of the application. We introduce an adaptive prioritization algorithm that correlates vulnerabilities detected in static stages with behavioral indicators from detection and observability systems such as Falco and Suricata. We implement the proposed architecture in an enterprise environment based on GitLab CI/CD, Kubernetes, and widely used application security tools, including Semgrep, SonarQube, Trivy, Checkov, and OWASP ZAP. We empirically evaluate the approach across 120 pipelines, 48 microservices, and approximately 3.2 million lines of code over six months. The results show significant reductions in mean time to detect (MTTD), mean time to remediate (MTTR), and the incidence of critical vulnerabilities in production. We also observe a substantial decrease in false positive rates when prioritization is driven by behavioral telemetry and threat intelligence. These results indicate that systematically correlating code analysis, supply chain security, and MITRE ATT&CK–based behavioral detection can measurably reduce operational risk in modern CI/CD pipelines.
Read paper →DevSecOpsThreat-Oriented DevSecOps: Formal Architecture for Integrating SAST, DAST, SCA, and MITRE ATT&CK-Based Behavioral Telemetry in CI/CD Pipelines
TITLE: Threat-Oriented DevSecOps: Formal Architecture for Integrating SAST, DAST, SCA, and MITRE ATT&CK-Based Behavioral Telemetry in CI/CD Pipelines ABSTRACT: The massive adoption of cloud-native architectures and continuous integration and continuous delivery (CI/CD) pipelines has profoundly transformed software development processes. However, this automation significantly expands the attack surface when security mechanisms are not systematically incorporated into the development lifecycle. Widely documented incidents, such as the SolarWinds supply chain compromise and the exploitation of vulnerability CVE-2021-44228 (Log4Shell), demonstrate that failures in the integration of code security, dependencies, and runtime monitoring can enable large-scale compromises. Although static analysis (SAST), dynamic analysis (DAST), and software composition analysis (SCA) tools are widely used in DevSecOps pipelines, their isolated operation often generates high volumes of alerts and makes prioritization based on real risk difficult. In this work, we propose a threat-oriented DevSecOps architecture that integrates security scanner results with behavioral telemetry and systematic mapping to the MITRE ATT&CK framework. We mathematically formalize the calculation of residual risk in CI/CD pipelines by combining severity metrics (CVSS), observed runtime exploitation evidence, and contextual application criticality. We introduce an adaptive prioritization algorithm that correlates vulnerabilities detected in static stages with behavioral indicators from detection and observability systems, such as Falco and Suricata. We implemented the proposed architecture in an enterprise environment based on GitLab CI/CD, Kubernetes, and widely used application security tools, including Semgrep, SonarQube, Trivy, Checkov, and OWASP ZAP. We empirically evaluated the approach in 120 pipelines involving 48 microservices and approximately 3.2 million lines of code over six months. The results indicate a significant reduction in mean time to detect (MTTD), mean time to remediate (MTTR), and the incidence of critical vulnerabilities in production. We also observed a substantial decrease in the false positive rate when prioritization is driven by behavioral telemetry and threat intelligence. These results demonstrate that systematic correlation between code analysis, supply chain security, and MITRE ATT&CK-based behavioral detection can measurably reduce operational risk in modern CI/CD pipelines.
Read paper →DevSecOpsThreat-Oriented DevSecOps: A Formal Architecture for Integrating MITRE ATT&CK-Based SAST, DAST, SCA, and Behavioral Telemetry in CI/CD Pipelines
Threat-Oriented DevSecOps: A Formal Architecture for Integrating MITRE ATT&CK-Based SAST, DAST, SCA, and Behavioral Telemetry in CI/CD Pipelines Abstract: The large-scale adoption of cloud-native architectures and continuous integration/continuous delivery (CI/CD) pipelines has profoundly transformed software development processes. However, when security mechanisms are not systematically incorporated into the development lifecycle, such automation can significantly expand the attack surface. Widely documented incidents such as the SolarWinds supply chain compromise and the exploitation of CVE‑2021‑44228 (Log4Shell) demonstrate that a lack of integration among code security, dependency security, and runtime monitoring can lead to large-scale intrusions. Although static analysis (SAST), dynamic analysis (DAST), and software composition analysis (SCA) tools have been widely adopted in DevSecOps pipelines, their isolated operation often generates large volumes of alerts and makes prioritization based on actual risk difficult. This paper proposes a threat-oriented DevSecOps architecture that combines security scanning results with behavioral telemetry and systematic mapping to the MITRE ATT&CK framework. We mathematically formalize residual risk computation in CI/CD pipelines by combining severity metrics (CVSS), runtime evidence of observed exploitation, and the contextual criticality of the application. We introduce an adaptive prioritization algorithm that correlates vulnerabilities detected in the static phase with behavioral indicators from detection and observability systems such as Falco and Suricata. We implemented the proposed architecture in an enterprise environment based on GitLab CI/CD, Kubernetes, and widely used application security tools including Semgrep, SonarQube, Trivy, Checkov, and OWASP ZAP. We empirically evaluated the approach across 120 pipelines, 48 microservices, and approximately 3.2 million lines of code over a six-month period. The results show significant reductions in mean time to detect (MTTD), mean time to remediate (MTTR), and the incidence of critical vulnerabilities in production environments. We also observed a substantial decrease in false positive rates when prioritization was driven by behavioral telemetry and threat intelligence. These results indicate that systematically correlating code analysis, supply chain security, and MITRE ATT&CK-based behavioral detection can measurably reduce operational risk in modern CI/CD pipelines.
Read paper →DevSecOpsCryptographically Verifiable Orchestration of DevSecOps Pipelines: Formal Model, Automated Architecture, and Experimental Evaluation in Cloud-Native Kubernetes Environments
TITLE: Cryptographically Verifiable Orchestration of DevSecOps Pipelines: Formal Model, Automated Architecture, and Experimental Evaluation in Cloud-Native Kubernetes Environments ABSTRACT: The growing adoption of microservices-based architectures and Kubernetes orchestration has established CI/CD pipelines as a central component of modern software engineering. However, this automation has significantly expanded the attack surface of software supply chains. Widely documented incidents have shown that tampering with dependencies, build artifacts, or pipeline infrastructure can compromise thousands of systems simultaneously. This work proposes a formal model for cryptographically verifiable orchestration of DevSecOps pipelines in cloud-native environments. The model represents pipelines as directed acyclic graphs in which each artifact transformation is accompanied by verifiable properties of integrity, authenticity, and traceability. We formalize quantitative metrics of operational risk based on cryptographic hash functions, digital signatures, and scoring derived from CVSS vulnerabilities. Building on this theoretical foundation, we developed an automated architecture called OCV-DevSecOps, which integrates artifact verification with Sigstore/Cosign, declarative policies with Open Policy Agent, runtime behavioral detection with Falco, and vulnerability analysis with SAST, SCA, and DAST tools. The architecture also incorporates a Software Bill of Materials (SBOM) in CycloneDX format for dependency traceability and supply chain governance support. We experimentally evaluated the proposal in a Kubernetes cluster with 42 microservices and 180 pipeline executions. The results indicate a significant reduction in the mean time to detect critical vulnerabilities, substantial improvement in artifact traceability, and a reduction in the number of deployments containing critical failures. We also observed a moderate impact on total pipeline execution time, while maintaining operational viability. The results suggest that the combination of mandatory cryptographic verification, automated policies, and continuous behavioral monitoring provides an effective mechanism to strengthen the security of modern DevSecOps pipelines. This work contributes by providing a mathematical formalization of the problem, a reproducible architecture, and an empirical evaluation based on real cloud-native infrastructure.
Read paper →DevSecOpsCryptographically Verifiable Orchestration of DevSecOps Pipelines: Formal Models, Automation Architecture, and Experimental Evaluation in a Cloud-Native Kubernetes Environment
TITLE: Cryptographically Verifiable Orchestration of DevSecOps Pipelines: Formal Models, Automation Architecture, and Experimental Evaluation in a Cloud-Native Kubernetes Environment ABSTRACT: TITLE: Cryptographically Verifiable Orchestration of DevSecOps Pipelines: Formal Models, Automation Architecture, and Experimental Evaluation in a Cloud-Native Kubernetes Environment ABSTRACT: The growing adoption of microservice-based architectures and Kubernetes orchestration has established CI/CD pipelines as a core element of modern software engineering. However, this automation has significantly expanded the attack surface of the software supply chain. Well-documented incidents have shown that tampering with dependencies, build artifacts, or pipeline infrastructure can simultaneously compromise thousands of systems. This study proposes a formal model for cryptographically verifiable orchestration of DevSecOps pipelines in cloud-native environments. The model represents a pipeline as a directed acyclic graph in which each artifact transformation is accompanied by verifiable properties regarding integrity, authenticity, and traceability. In addition, it formalizes quantitative operational risk indicators derived from cryptographic hash functions, digital signatures, and scoring based on CVSS vulnerabilities. Building on this theoretical foundation, we developed an automation architecture called OCV-DevSecOps that integrates artifact verification with Sigstore/Cosign, declarative policy enforcement with Open Policy Agent, runtime behavior detection with Falco, and vulnerability analysis with SAST, SCA, and DAST tools. The architecture also incorporates a Software Bill of Materials (SBOM) in CycloneDX format to support dependency traceability and supply chain governance. We experimentally evaluated the proposed approach on a Kubernetes cluster consisting of 42 microservices and 180 pipeline executions. The results demonstrated a significant reduction in the average detection time for critical vulnerabilities, a substantial improvement in artifact traceability, and a decrease in the number of deployments containing critical defects. Furthermore, the impact on total pipeline execution time was moderate, preserving operational feasibility. These results suggest that the combination of enforced cryptographic verification, policy automation, and continuous behavioral monitoring provides an effective mechanism for strengthening the security of modern DevSecOps pipelines. This study contributes by providing a mathematical formalization of the problem, a reproducible architecture, and an empirical evaluation based on real cloud-native infrastructure.
Read paper →DevSecOpsFormal Security Orchestration in CI/CD Pipelines: A Quantitative Risk Model for DevSecOps with MITRE ATT&CK Correlation and Operational Metrics
TITLE: Formal Security Orchestration in CI/CD Pipelines: A Quantitative Risk Model for DevSecOps with MITRE ATT&CK Correlation and Operational Metrics ABSTRACT: The adoption of DevOps practices has profoundly transformed the software development lifecycle by prioritizing automation, continuous integration, and continuous delivery. However, the acceleration of CI/CD pipelines has significantly expanded organizations’ attack surface, especially in the context of software supply chain attacks and exploitation of vulnerable dependencies. Widely documented incidents, such as the compromise of the SolarWinds Orion distribution chain (SUNBURST) and the large-scale exploitation of the Log4Shell vulnerability (CVE-2021-44228), demonstrate that flaws introduced during the build process or through external dependencies can propagate impact on a global scale. Although the DevSecOps paradigm proposes integrating security controls into the development pipeline, operational practice is still characterized by superficial tool integration, the absence of quantitative risk metrics, and a lack of alignment between automated scanner outputs and formal threat models. In this work, we propose a quantitative model for security orchestration in CI/CD pipelines based on incremental risk analysis. The model formalizes the pipeline as a directed acyclic graph and defines an accumulated risk function that combines CVSS scoring, exploitation probability estimated via EPSS, asset criticality, and a temporal factor associated with vulnerability age. Based on this formulation, we introduce an adaptive blocking mechanism that uses dynamic thresholds to automatically decide the promotion or rejection of artifacts during the build process. We implemented the model in a Kubernetes environment using widely adopted tools in the DevSecOps ecosystem, including Semgrep, SonarQube, Trivy, Syft/Grype, OWASP ZAP, and Checkov, as well as runtime monitoring with Falco and event correlation with the MITRE ATT&CK matrix. The experimental evaluation was conducted over 1,200 pipeline executions involving 37 microservices. The results indicate a significant reduction in exposure to critical vulnerabilities in production and a decrease in mean time to remediation without a substantial impact on pipeline execution time. The study demonstrates that the mathematical formalization of risk in CI/CD pipelines enables more consistent automated decisions and provides an operational basis for metrics-driven security governance in DevSecOps environments.
Read paper →DevSecOpsA Formal and Quantitatively Evaluated Framework for Adaptive Orchestration of Security Controls in DevSecOps Pipelines Based on Threat Modeling and Continuous Risk Analysis
TITLE: A Formal and Quantitatively Evaluated Framework for Adaptive Orchestration of Security Controls in DevSecOps Pipelines Based on Threat Modeling and Continuous Risk Analysis ABSTRACT: The growing adoption of DevOps practices has radically transformed the software development lifecycle, but has introduced new attack vectors arising from extensive automation, infrastructure as code, and complex supply chains. Although DevSecOps proposes the continuous integration of security into the development pipeline, most implementations remain ad hoc, lacking mathematical formalization, rigorous threat modeling, and adaptive control prioritization mechanisms. In this work, we propose a formal framework for adaptive orchestration of security controls in DevSecOps pipelines, grounded in probabilistic risk modeling and integration with the MITRE ATT&CK matrix. We formally define the problem of minimizing residual risk under latency and computational cost constraints, modeling the pipeline as a directed acyclic graph with risk functions associated with each stage. We developed two main algorithms: (i) a dynamic prioritization mechanism for security checks based on expected marginal risk and (ii) an adaptive orchestrator that reconfigures the pipeline in real time based on execution telemetry. We implemented the framework on GitLab CI/CD, Kubernetes, and tools such as SAST, DAST, SCA, and IaC scanners, evaluating it across 312 enterprise repositories with 4.8 million lines of code. The results demonstrate an average reduction of 37.4% in total pipeline time, a 52.1% decrease in estimated residual risk, and a 41.3% reduction in false positives compared to traditional static pipelines. In addition, we observed a 29.6% improvement in mean time to repair (MTTR). The results indicate that the mathematical formalization of DevSecOps orchestration enables simultaneous gains in security and operational efficiency, contributing to the scientific consolidation of the field.
Read paper →DevSecOpsA Formal and Quantitatively Evaluated Architecture for Adaptive Orchestration of Security Controls in Cloud-Native DevSecOps Pipelines
TITLE: A Formal and Quantitatively Evaluated Architecture for Adaptive Orchestration of Security Controls in Cloud-Native DevSecOps Pipelines ABSTRACT: The acceleration of software delivery cycles driven by DevOps practices has introduced a structural paradox: the reduction in development time has expanded the attack surface and the frequency of vulnerability introduction. DevSecOps emerges as a response, integrating security controls throughout the continuous integration and continuous delivery (CI/CD) pipeline. However, existing approaches remain predominantly heuristic, lacking rigorous formalization, systematic threat modeling, and comprehensive quantitative evaluation. In this work, we propose a formal architecture for adaptive orchestration of security controls in cloud-native DevSecOps pipelines, grounded in mathematical risk modeling and multi-objective optimization. Our methodology combines static analysis (SAST), dynamic analysis (DAST), dependency scanning (SCA), infrastructure as code (IaC) analysis, and MITRE ATT&CK-oriented behavioral detection, integrated by a prioritization mechanism based on the risk function R = P · I · E, where P represents exploitable probability, I impact, and E temporal exposure. We implemented a prototype in Kubernetes with GitLab CI, SonarQube, OWASP ZAP, Trivy, and Open Policy Agent, evaluating it on 42 real microservices (≈1.8 million lines of code). The results indicate an average reduction of 37.4% in remediation time (MTTR), a decrease of 29.1% in critical vulnerabilities in production (CVSS ≥ 9.0), and an average pipeline overhead below 11.6%. Compared with conventional DevSecOps pipelines, we observed a 22.8% gain in prioritization accuracy and a 31.5% reduction in actionable false positives. We demonstrate that the mathematical formalization of security orchestration enables a balance between rigor and agility, providing measurable guarantees of risk reduction without compromising delivery throughput. This work contributes (i) a formal continuous risk model for DevSecOps, (ii) adaptive orchestration algorithms with complexity analysis, and (iii) a large-scale empirical evaluation with reproducible quantitative data.
Read paper →DevSecOpsFormal Orchestration and Quantitative Evaluation of Policy-as-Code-Based DevSecOps Pipelines with Measurable Security Guarantees
TITLE: Formal Orchestration and Quantitative Evaluation of Policy-as-Code-Based DevSecOps Pipelines with Measurable Security Guarantees ABSTRACT: The growing adoption of DevOps practices has transformed the software development lifecycle, but has significantly expanded the attack surface by introducing highly automated pipelines, ephemeral infrastructure, and continuous integration of third-party dependencies. Recent incidents involving supply chain compromise — such as SolarWinds and Log4Shell (CVE-2021-44228) — demonstrate that the absence of security controls integrated into the development workflow results in large-scale systemic impacts. In this work, we propose a formal framework for DevSecOps based on Policy-as-Code with measurable guarantees of compliance and risk reduction. Our approach combines formal modeling of the pipeline as a directed acyclic graph, verification of security properties through declarative constraints, and an adaptive vulnerability prioritization mechanism grounded in CVSS metrics and MITRE ATT&CK threat intelligence. We implemented a prototype integrated with Kubernetes environments, GitLab CI/CD, and tools such as Open Policy Agent (OPA), Trivy, and SonarQube. We evaluated the system in 42 real-world open-source projects, totaling 3.8 million lines of code and 12,614 container images. The results indicate an average reduction of 47.3% in mean time to remediation (MTTR), a 62.8% decrease in the introduction of critical vulnerabilities into production, and execution overhead below 8.4% in total pipeline time. We further demonstrate that formalization of security properties enables the detection of 91.6% of policy violations before the deployment phase. We conclude that the systematic integration of lightweight formal verification and adaptive prioritization in DevSecOps pipelines provides substantial quantitative security gains without compromising operational agility, establishing a measurable and reproducible paradigm for secure software engineering in high-velocity environments.
Read paper →DevSecOpsFormal Orchestration and Quantitative Evaluation of DevSecOps Pipelines Based on Policy-as-Code with Measurable Security Guarantees
TITLE: Formal Orchestration and Quantitative Evaluation of DevSecOps Pipelines Based on Policy-as-Code with Measurable Security Guarantees ABSTRACT: The growing adoption of DevOps practices has transformed the software development lifecycle; however, it has significantly expanded the attack surface by introducing highly automated pipelines, ephemeral infrastructure, and continuous integration of third‑party dependencies. Recent incidents involving supply chain compromise — such as SolarWinds and Log4Shell (CVE-2021-44228) — demonstrate that the absence of security controls integrated into the development workflow results in large-scale systemic impacts. In this work, we propose a formal DevSecOps framework based on Policy-as-Code with measurable guarantees of compliance and risk reduction. Our approach combines formal modeling of the pipeline as a directed acyclic graph, verification of security properties through declarative constraints, and an adaptive vulnerability prioritization mechanism grounded in CVSS metrics and MITRE ATT&CK threat intelligence. We implemented a prototype integrated with Kubernetes environments, GitLab CI/CD, and tools such as Open Policy Agent (OPA), Trivy, and SonarQube. We evaluated the system across 42 real-world open-source projects, totaling 3.8 million lines of code and 12,614 container images. The results indicate an average reduction of 47.3% in mean time to remediation (MTTR), a 62.8% decrease in the introduction of critical vulnerabilities into production, and execution overhead below 8.4% of total pipeline time. We further demonstrate that the formalization of security properties enables detection of 91.6% of policy violations before the deployment phase. We conclude that the systematic integration of lightweight formal verification and adaptive prioritization into DevSecOps pipelines provides substantial quantitative security gains without compromising operational agility, establishing a measurable and reproducible paradigm for secure software engineering in high-velocity environments.
Read paper →DevSecOpsA Formally Grounded Architecture for Adaptive Orchestration of DevSecOps Controls with Quantitative Guarantees of Attack Surface Reduction
TITLE: A Formally Grounded Architecture for Adaptive Orchestration of DevSecOps Controls with Quantitative Guarantees of Attack Surface Reduction ABSTRACT: The accelerated adoption of DevOps pipelines has significantly expanded the attack surface of corporate systems, introducing vectors associated with software supply chains, ephemeral configurations, and poorly instrumented continuous integrations. Although the DevSecOps paradigm proposes the continuous integration of security mechanisms into the development lifecycle, the literature lacks formal models that quantify its effectiveness under realistic adversaries and reproducible metrics. In this work, we propose an adaptive DevSecOps architecture with explicit mathematical foundations for measurable risk reduction, modeled as an optimization problem under operational constraints. We formalize the pipeline as a directed acyclic graph $G = (V,E)$ with risk functions associated with each stage, and define a composite attack surface metric $A(G)$ based on exploitable vulnerabilities weighted by CVSS criticality and exploitation probability estimated via MITRE ATT&CK data. We implemented the architecture in a Kubernetes environment with integration to tools such as GitLab CI, SonarQube, OWASP ZAP, Trivy, and HashiCorp Vault. We evaluated the system on 120 open-source projects and 18 enterprise applications, totaling 3.2 million lines of code. The results demonstrate an average reduction of 47.3% in exposure to critical vulnerabilities (CVSS ≥ 9.0), a 38.6% decrease in mean time to remediation (MTTR), and operational overhead below 8.4% in total build time. Compared to static DevSecOps pipelines, our adaptive mechanism showed a statistically significant gain (p < 0.01) in the rate of preventive blocking of exploitable misconfiguration failures. We conclude that quantitative formalization makes it possible not only to economically justify the adoption of DevSecOps, but also to dynamically optimize security controls in high-deployment-cadence environments.
Read paper →DevSecOpsA Formally Verifiable Architecture for DevSecOps Orchestration with Quantitative Risk Prioritization and Threat-Oriented Continuous Integration
1. Introduction Digital transformation has accelerated the adoption of distributed architectures, microservices, containerization, and infrastructure as code (IaC), resulting in increasingly shorter and highly automated development cycles. The DevOps paradigm has consolidated itself as a response to the need to reduce time-to-market, promoting continuous integration (CI) and continuous delivery (CD) (GITLAB, 2024). However, the late insertion of security controls into these pipelines has substantially expanded the attack surface, especially in cloud-native and API-oriented environments. Wi
Read paper →DevSecOpsFormal Orchestration of Security Controls in DevSecOps Pipelines: A Framework Based on Threat Modeling, Multi-Objective Optimization, and Continuous Verification
maximize_detection_probability: true ``` This abstraction enables the orchestration engine to map policies onto platform-specific controls. For example: • artifact signing may use Sigstore in Kubernetes clusters • binary authorization in Google Cloud • custom signing services in on-premise environments The mapping function can be represented as $$ f : P \rightarrow C_{platform} $$ where $P$ represents abstract policy requirements and $C_{platform}$ represents concrete security control implementations supported by a given environment. Finally, cross-platform orchestration becomes part
Read paper →DevSecOpsRisk-Oriented DevSecOps with Continuous Formal Verification: A Quantitative Model for Adaptive Security Orchestration in CI/CD Pipelines
1. Introduction The consolidation of DevOps practices, combined with the widespread adoption of architectures based on microservices, containers, and infrastructure as code (IaC), has structurally transformed the software development lifecycle. By 2026, organizations operate highly automated CI/CD pipelines, frequently integrated with CNAPP (Cloud-Native Application Protection Platforms) and observability mechanisms based on eBPF. However, the compression of time between commit and deploy amplifies the attack surface and increases the probability of exposure to known and misconfiguration vuln
Read paper →DevSecOpsEvidence-Oriented DevSecOps: A Formal Architecture with Contextual Risk-Based Prioritization and Continuous Verification for Large-Scale Software Delivery Pipelines (2026)
DeploymentVerification DeploymentVerification --> RuntimeMonitoring RuntimeMonitoring --> IncidentResponse RuntimeMonitoring --> ContinuousVerification ContinuousVerification --> StaticAnalysis IncidentResponse --> [] ``` Within this model, the ContinuousVerification state performs consistency checks on previously generated evidence artifacts. If verification fails, the system transitions to IncidentResponse. We define the pipeline correctness invariant as follows: $$ \forall s_i \in S,\ Integrity(E_i) \land PolicyCompliance(E_i) $$ Where: - $Integrity(E_i)$ verifie
Read paper →