Research / Paper Files

Paper Files

Paper Files are a personal practice of continuous study in cybersecurity that applies the scientific method as a learning tool. Each article is written not for academic publication, but as a deliberate exercise to sharpen the axe — deepening knowledge on specific topics, organizing ideas with rigor, and observing how understanding of certain subjects develops over time. It is the intellectual equivalent of a training journal: each entry records what was studied, how it was analyzed, and what conclusions emerged.

I strongly recommend that security professionals adopt this method. Choose a topic you want to master, research primary sources (RFCs, papers, official documentation), structure your text with introduction, methodology, analysis, and conclusion, and write as if you were explaining to a colleague. The act of writing forces clarity of thought and exposes gaps in understanding that passive reading cannot reveal. Use the articles on this site as examples of format and depth, and build your own collection — over time, you will have a personal repository of refined knowledge that no course or certification can replace.

DAI & ADAI · 2026

DAI · EN

DAI: A Domain-Specific LLM with Model-Excluded Authority, Capability-Disjoint Verification, and Recomputable Receipts

DAI (Decripte Artificial Intelligence) is a proprietary domain-specific LLM within a governed autonomous defensive architecture. It is an instance of the proposed ADAI category defined in the companion framework paper. T…

Read paper →ADAI · EN

Autonomous Defensive AI: An Envelope-and-Evidence Framework for Governed LLMs Acting on Production Infrastructure

ADAI (Autonomous Defensive Artificial Intelligence) is a proposed category of governed autonomous cyber defense. The framework specifies defended perimeters, bounded effects, declared rollback and capability-disjoint ver…

Read paper →

All Detection DFIR AppSec DevSecOps AI Security IAM Cloud Containers IR Crypto Research Phishing Secrets

226 papers

IAM

Identity and Access Management as a Cybersecurity Control Plane: Threats, Formal Models, and Defensive Engineering in the 2026 Era

Identity and Access Management (IAM) has become the primary control plane of modern cybersecurity, replacing perimeter-centric assumptions with identity-centric authorization decisions across cloud, SaaS, hybrid enterprise, and machine-to-machine environments. By 2026, the operational attack surface of IAM extends far beyond human logins: adversaries exploit phishing-resistant authentication gaps, token theft, consent abuse, OAuth misconfiguration, federation trust weaknesses, privilege escalation paths, and machine identity sprawl. This paper examines IAM as both a defensive architecture and a persistent target for offensive operations. We formalize IAM risk as a composition of authentication assurance, authorization correctness, federation trust, lifecycle hygiene, and monitoring visibility, and we analyze how these properties interact under real-world constraints such as zero trust deployment, cloud-native workloads, and AI-accelerated social engineering. Building on established standards and industry practice, we propose a defense-oriented methodology that unifies identity inventory, privilege graph analysis, continuous verification, policy-as-code, just-in-time access, phishing-resistant MFA, workload identity governance, and anomaly detection over sign-in and token telemetry. We also present an implementation blueprint spanning Microsoft Entra ID, Okta, AWS IAM, Google Cloud IAM, and Kubernetes service account patterns, with concrete automation and detection examples. An experimental evaluation framework is provided to measure reduction in standing privilege, mean time to revoke access, unauthorized consent exposure, and detection latency under simulated adversarial conditions. A case study of an OAuth consent-phishing incident demonstrates how identity telemetry, conditional access, and token revocation can compress attacker dwell time and limit blast radius. The paper concludes that IAM in 2026 must be treated as a dynamic cyber-defense system rather than a static directory service, requiring continuous governance, graph-based risk analysis, and operational integration with detection and response workflows.

2026-04-22Read paper →IR

Incident Response in 2026: A Risk-Based, Telemetry-Driven Framework for Cloud, Identity, Endpoint, and AI-Enabled Environments

Incident response in 2026 operates under a materially different threat landscape than the one that shaped classical playbooks a decade earlier. Cloud control planes, identity providers, SaaS collaboration layers, endpoint telemetry pipelines, and AI-assisted attack workflows now define the practical scope of compromise. This paper presents a publication-ready research treatment of incident response (IR) as a socio-technical cyber defense function that must integrate detection engineering, adversary emulation, containment automation, evidence preservation, and governance across hybrid estates. We formalize IR as an optimization problem under uncertainty, where time-to-contain, evidentiary integrity, business criticality, and operational safety are jointly minimized subject to legal, technical, and organizational constraints. Building on mature frameworks such as NIST SP 800-61r2, the Lockheed Martin kill chain, MITRE ATT&CK, cloud-native detection methods, and modern zero trust architectures, we propose a risk-based methodology designed for 2026 conditions: identity-first compromise, living-off-the-land tradecraft, cloud abuse, token theft, ransomware extortion, and AI-enabled social engineering. The paper details an implementation architecture that fuses SIEM, SOAR, EDR, CSPM, CNAPP, eBPF telemetry, and secure case management into a closed-loop response system with measurable service-level objectives. We then evaluate the methodology using realistic scenarios drawn from public incident patterns, including identity compromise, email-borne initial access, cloud persistence, and ransomware staging. Results show that telemetry fusion and preapproved containment actions reduce mean time to contain while preserving forensic quality, provided that governance thresholds and evidence-handling controls are rigorously enforced. Finally, we analyze a real-world-style case study involving a hybrid Microsoft 365 and AWS environment and derive lessons for 2026-era IR programs facing AI-mediated attacker adaptation, regulatory pressure, and operational complexity.

2026-04-20Read paper →Detection

Detection at Scale in Cybersecurity: A Multi-Layer, Behavior-Centric Architecture for Adversary Detection Across Endpoint, Identity, Cloud, and Network Telemetry

Detection is the decisive control-plane problem in modern cybersecurity: if malicious activity cannot be observed, normalized, correlated, and prioritized quickly enough, prevention becomes a probabilistic aspiration rather than an operational guarantee. By 2026, the detection problem has been reshaped by cloud-native infrastructure, SaaS sprawl, encrypted traffic, identity-centric attacks, living-off-the-land tradecraft, and the operationalization of generative AI for both defenders and adversaries. This paper presents a full-length research treatment of detection as a cyber-defense discipline, formalizing the problem across endpoint, identity, network, application, and cloud telemetry, and proposing a multi-layer, behavior-centric detection architecture designed for high-volume enterprise environments. The methodology combines deterministic rules, statistical baselines, graph correlation, ATT&CK-aligned behavior modeling, and supervised anomaly triage to reduce false positives while preserving sensitivity to low-and-slow intrusions. We define detection quality in terms of precision, recall, time-to-detect, analyst workload, and cost-adjusted utility, and we evaluate the architecture under realistic adversary emulation scenarios including credential theft, lateral movement, cloud token abuse, and data staging. The paper also examines implementation trade-offs in SIEM, SOAR, EDR, NDR, XDR, CNAPP, and eBPF-based monitoring stacks, with practical deployment guidance for log normalization, rule lifecycle management, and detection engineering workflows. A case study demonstrates how a mature organization can detect a hybrid intrusion chain spanning phishing, identity compromise, cloud persistence, and exfiltration by fusing multiple weak signals into a high-confidence incident. The central argument is that detection in 2026 must be treated as an adaptive distributed inference problem, not a static ruleset: resilient detection systems require telemetry breadth, semantic normalization, adversary-centric design, and continuous validation against evolving tradecraft.

2026-04-19Read paper →IAM

Identity and Access Management in Cybersecurity at 2026: A Risk-Adaptive, Zero-Trust, and AI-Resilient Framework for Enterprise Identity Defense

Identity and Access Management (IAM) has become the primary control plane of modern cybersecurity. By 2026, enterprise compromise increasingly begins not with perimeter intrusion but with credential theft, session hijacking, consent abuse, OAuth token abuse, SIM-swap-enabled MFA bypass, and privileged identity misuse across SaaS, cloud, and hybrid environments. This paper presents a technically grounded, publication-ready analysis of IAM as a security discipline, with emphasis on contemporary attack surfaces, control gaps, and defensive engineering patterns that reflect the 2026 threat landscape. We formalize IAM as a stateful authorization system spanning identities, authenticators, sessions, entitlements, device posture, and contextual risk, and we derive a risk-adaptive model that integrates phishing-resistant authentication, continuous authorization, privileged access governance, identity threat detection and response, and zero-trust enforcement. The proposed methodology is designed for heterogeneous enterprise environments that include Entra ID, Okta, Google Workspace, Active Directory, AWS IAM, and Kubernetes-native identity flows. We further discuss implementation patterns using SCIM, SAML, OIDC, FIDO2/WebAuthn, passkeys, conditional access, PAM, and CNAPP-integrated detection pipelines. The paper evaluates this framework through a realistic enterprise deployment scenario and a case study centered on modern identity-based intrusion tradecraft, including AiTM phishing, device-code abuse, OAuth consent attacks, and stale privilege accumulation. Experimental analysis shows that adaptive identity controls reduce blast radius, shorten mean time to detect anomalous sign-ins, and improve containment of token replay and lateral movement. The results support the conclusion that IAM in 2026 must be treated not as an administrative utility, but as a core security architecture requiring continuous telemetry, graph-based risk reasoning, and governance aligned with emerging AI-driven attack and defense capabilities.

2026-04-18Read paper →Phishing

Operational Phishing in the AI Era: Offensive Tradecraft, Detection Engineering, and Resilient Defense Architectures (2006–2026)

Phishing remains the most operationally successful initial access vector in contemporary cyber operations, responsible for a significant proportion of enterprise breaches and credential compromise incidents. Despite two decades of defensive improvements—including email authentication standards (SPF, DKIM, DMARC), secure email gateways, and user awareness training—phishing campaigns continue to evolve in sophistication and scale. By 2026, the threat landscape has been further transformed by the integration of generative artificial intelligence, large language models (LLMs), and automated reconnaissance pipelines that enable adversaries to produce highly targeted spear‑phishing campaigns at industrial scale. Simultaneously, phishing frameworks such as Evilginx2, Modlishka, and advanced adversary‑in‑the‑middle (AiTM) kits have enabled attackers to bypass multi‑factor authentication (MFA) protections by intercepting authentication tokens in real time. This paper presents a comprehensive operational analysis of phishing within the modern cybersecurity ecosystem as of 2026. We examine historical evolution, threat models, attacker tooling, infrastructure tradecraft, and defensive detection engineering. Particular attention is given to the operational pipeline used by real adversaries: reconnaissance, infrastructure preparation, lure generation, credential harvesting, session hijacking, and post‑compromise exploitation. We formalize phishing risk as a probabilistic model incorporating user susceptibility, technical bypass probability, and detection latency. We then propose a defensive methodology integrating behavioral email analysis, identity telemetry correlation, and zero‑trust authentication signals. The architecture leverages modern detection capabilities including identity provider logs, eBPF‑based endpoint telemetry, and machine‑learning classifiers trained on phishing campaign artifacts. An implementation using open‑source security tooling is presented along with a controlled experimental evaluation simulating phishing campaigns against enterprise‑style infrastructure. Results demonstrate that identity‑centric telemetry correlation significantly improves detection of adversary‑in‑the‑middle phishing campaigns that bypass traditional email filtering controls. A detailed case study based on documented real‑world AiTM phishing operations illustrates attacker tradecraft and defender response workflows. The paper concludes with a discussion of the impact of generative AI on phishing scalability, the limitations of awareness‑based defenses, and future directions for identity‑centric security architectures designed to mitigate phishing‑driven compromise in the coming decade.

2026-03-06Read paper →DevSecOps

Operationalizing DevSecOps in Cloud-Native Pipelines: Threat Modeling, Automated Enforcement, and Empirical Security Outcomes in the 2026 Software Supply Chain

The acceleration of cloud-native software delivery has fundamentally transformed the attack surface of modern organizations. Continuous Integration and Continuous Deployment (CI/CD) pipelines, containerized workloads, and large-scale dependency ecosystems have introduced new classes of vulnerabilities across the software supply chain. High-impact incidents such as the SolarWinds supply-chain compromise, the Log4Shell vulnerability (CVE-2021-44228), and the XZ Utils backdoor (CVE-2024-3094) demonstrated that adversaries increasingly target build pipelines, dependency resolution mechanisms, and artifact distribution systems rather than traditional runtime vulnerabilities. DevSecOps emerged as a response to this threat landscape, embedding security controls directly into development pipelines while preserving deployment velocity. By 2026, mature implementations incorporate automated static and dynamic analysis, Software Bill of Materials (SBOM) generation, cryptographic artifact signing, runtime anomaly detection using eBPF telemetry, and policy enforcement using infrastructure-as-code governance engines. This paper presents an operational framework for DevSecOps in cloud-native environments, focusing on measurable risk reduction across the software lifecycle. We formalize the threat model of CI/CD ecosystems, identify adversarial entry points across developer workstations, dependency repositories, pipeline orchestration systems, and container registries, and introduce a methodology integrating automated scanning, policy enforcement, and runtime detection. The framework combines static analysis tools (Semgrep, CodeQL), container security scanners (Trivy, Grype), artifact signing via Sigstore Cosign, and runtime monitoring with Falco and eBPF-based telemetry. An experimental evaluation was conducted across a simulated enterprise pipeline comprising 120 microservices deployed on Kubernetes. The proposed DevSecOps pipeline reduced exploitable vulnerabilities by 63.4%, decreased mean-time-to-remediation (MTTR) by 47%, and detected simulated supply-chain attacks with 92% accuracy. We also present a detailed case study demonstrating how automated SBOM generation and dependency policy enforcement prevented a dependency-confusion attack in a CI pipeline. The results show that DevSecOps is most effective when security controls are integrated as deterministic, policy-driven pipeline gates rather than advisory scanning steps. Our findings emphasize the necessity of cryptographic provenance, reproducible builds, and runtime behavioral monitoring to defend against modern supply-chain attacks. Finally, we discuss emerging challenges in AI-assisted development, LLM-generated code vulnerabilities, and the need for secure pipeline governance in increasingly autonomous software development environments.

2026-01-10Read paper →IR

Formal and Operational Architecture for Evidence-Driven Incident Response with Multilayer Correlation and Automated Orchestration

TITLE: Formal and Operational Architecture for Evidence-Driven Incident Response with Multilayer Correlation and Automated Orchestration ABSTRACT: The growing complexity of digital infrastructures and the increasing volume of security telemetry have made incident response a significant operational challenge for modern organizations. Contemporary enterprise environments generate millions of security events daily, originating from multiple monitoring layers, including network, endpoints, applications, and cloud infrastructure. Although tools such as intrusion detection systems, SIEM platforms, and EDR solutions increase operational visibility, the fragmentation of evidence and the absence of formal correlation models often result in high false-positive rates and delays in incident containment. This work presents a formal and operational architecture for evidence-driven incident response, based on probabilistic temporal correlation of events and automated response orchestration. We model security events as vertices in a weighted temporal graph, in which causal relationships are estimated by a likelihood function conditioned on the temporal and semantic proximity between observable events. The proposed architecture integrates telemetry from network sensors (Suricata), host monitoring (Sysmon and Wazuh), log ingestion pipelines (Elastic Stack and Kafka), and a SOAR-based orchestration layer using TheHive and Cortex. Automatic correlation generates incident hypotheses that trigger response playbooks, including volatile memory collection, execution of YARA rules, and automated isolation of compromised hosts via endpoint security APIs. To empirically evaluate the model, we conducted controlled experiments in a simulated enterprise environment with 200 endpoints and 12 servers, using attack scenarios reproduced through Atomic Red Team aligned with the MITRE ATT&CK framework. The results indicate measurable reductions in critical operational metrics: mean time to detect (MTTD) was reduced from 18.4 to 11.5 minutes, while mean time to respond (MTTR) decreased from 42.7 to 24.7 minutes. In addition, we observed a significant improvement in incident classification performance, with the F1-score increasing from 0.71 to 0.91. The analysis demonstrates that the mathematical formalization of event correlation, combined with evidence-based response automation, contributes to greater analytical accuracy, lower cognitive load for analysts, and faster containment of complex threats.

2008-10-05Read paper →Containers

Container Security in Cloud-Native Environments: Threat Modeling, Exploitation Techniques, and Defense Strategies in Docker and Kubernetes Ecosystems (2023)

TITLE: Container Security in Cloud-Native Environments: Threat Modeling, Exploitation Techniques, and Defense Strategies in Docker and Kubernetes Ecosystems (2023) ABSTRACT: The adoption of containers has profoundly transformed software engineering and operational security in cloud-native environments. Technologies such as Docker and Kubernetes have become the foundation of modern infrastructure, enabling portability, scalability, and large-scale automation. However, this new architecture also introduces a distinct attack surface, characterized by shared-kernel-based isolation, complex image dependencies, and potentially vulnerable software supply chains. This work presents an in-depth analysis of container security from both offensive and defensive perspectives, considering the state of the art up to 2023. Initially, we examine the technical foundations of the Linux container model, including namespaces, cgroups, and the OCI runtime. Next, we analyze recurrent attack vectors observed in real incidents, such as container escape, runtime exploitation, build chain compromise, and attacks against Kubernetes clusters. We propose a formal threat model that captures relationships among workload, runtime, host, and control plane, enabling risk quantification based on exploitation probability and operational impact. The methodology presented combines static image analysis, behavioral monitoring based on eBPF, and isolation policies reinforced by seccomp, AppArmor, and Pod Security Standards. The experimental implementation was carried out in a Kubernetes cluster instrumented with widely used tools in 2023, including Falco, Trivy, and kube-bench. The results demonstrate a significant reduction in exposure to known vulnerabilities and improved detection of anomalous behavior in near real time. We also present a case study based on cryptomining campaigns observed in compromised Kubernetes clusters. The discussion explores practical limitations, governance challenges, and implications of container supply chain security. We conclude by highlighting future directions, including integration with Zero Trust models, eBPF-based observability, and automated incident response in cloud-native environments. This study provides an operational and technical perspective for security professionals, infrastructure architects, and researchers interested in defending container ecosystems.

2008-09-28Read paper →Containers

Formal and Operational Architecture for Threat Detection and Containment in Kubernetes-Based Containerized Environments

TITLE: Formal and Operational Architecture for Threat Detection and Containment in Kubernetes-Based Containerized Environments ABSTRACT: The adoption of container-based cloud-native architectures has profoundly transformed the way distributed applications are designed, deployed, and scaled. Kubernetes has established itself as the leading orchestration system for managing containerized workloads, offering declarative abstractions for scaling, fault tolerance, and operational automation. However, this additional abstraction layer introduces new attack vectors and broadens the exposure surface, particularly in environments with high densities of ephemeral containers and complex image supply chains. Exploitation of vulnerabilities in container runtimes, insecure orchestration API configurations, and automated cryptomining campaigns in misconfigured clusters demonstrate that traditional security mechanisms are insufficient to handle the dynamic nature of these environments. In this work, we propose a formal and operational architecture for threat detection and containment in Kubernetes clusters, combining mathematical modeling of system states with practical observability mechanisms and automated response. We formalize the containerized environment as a labeled transition system LTS = (S, A, →), enabling the expression of integrity and non-interference properties related to the interaction among containers, cluster nodes, and the control plane. On this theoretical basis, we implement a multi-layer security pipeline composed of static image analysis (Trivy and YARA), declarative admission policies using Open Policy Agent/Gatekeeper, kernel-level behavioral monitoring with eBPF via Falco, and automated isolation mechanisms using NetworkPolicies and Kubernetes administrative controls. The architecture was experimentally evaluated in a cluster with 120 nodes and 2,400 active pods, where different attack scenarios were simulated, including container escape attempts, execution of cryptocurrency miners, and lateral movement via compromised credentials. The results indicate an average detection rate of 96.3% with a false positive rate of 3.8%, in addition to significant reductions in the operational indicators MTTD and MTTR. These results demonstrate that the integration of theoretical formalization and low-level eBPF-based telemetry constitutes an effective approach to strengthening the operational security of cloud-native platforms at scale.

2008-09-21Read paper →Containers

Formal Architecture and Empirical Evaluation of a Defense-in-Depth Model for Kubernetes-Based Container Environments under Advanced Persistent Threats

TITLE: Formal Architecture and Empirical Evaluation of a Defense-in-Depth Model for Kubernetes-Based Container Environments under Advanced Persistent Threats ABSTRACT: The adoption of architectures based on containers orchestrated by Kubernetes has become predominant in cloud-native infrastructures due to their elasticity, portability, and operational automation capabilities. However, the increasing complexity of these environments introduces an expanded attack surface that can be exploited by sophisticated adversaries, including campaigns of Advanced Persistent Threats (APTs). In particular, vectors such as image supply chain compromise, exploitation of shared kernel vulnerabilities, abuse of control plane permissions, and lateral movement between pods represent critical challenges for security teams. In this work, we present a formal defense-in-depth architecture for Kubernetes clusters, integrating preventive control mechanisms, behavioral detection, and automated response. We model the defense system as a security state graph G=(V,E), in which vertices represent cluster security configurations and edges represent transitions induced by adversarial actions or mitigation mechanisms. The proposed architecture combines declarative security policies (Open Policy Agent/Gatekeeper and Kyverno), eBPF-based system call inspection (Falco), network segmentation with layer 7 policies (Cilium), image vulnerability analysis (Trivy), and observable telemetry integrated into the cloud-native security ecosystem. We conducted an empirical evaluation in an experimental environment containing multiple Kubernetes nodes and representative workloads of distributed applications. The experimental scenario reproduced techniques documented in the MITRE ATT&CK framework for containers, including privilege escalation, container escape, and data exfiltration. The results indicate that the defense-in-depth approach significantly reduces the observable attack surface and improves the Mean Time To Detect (MTTD). We observed that the integration of admission policies, static image analysis, and real-time eBPF-based monitoring enables the detection of malicious behavioral patterns with greater precision, reducing false positives when compared to isolated approaches. We conclude that the formalization of security policies combined with observable kernel instrumentation constitutes a promising path to strengthen the resilience of Kubernetes platforms against persistent adversaries. The work contributes an analytical model, a reference architecture, and experimental results that can guide the development of security strategies for large-scale cloud-native environments.

2008-09-14Read paper →Cloud

Formal and Operational Architecture for Threat Detection and Response in Multi-Cloud Environments Based on Unified Telemetry and Adversary Modeling

TITLE: Formal and Operational Architecture for Threat Detection and Response in Multi-Cloud Environments Based on Unified Telemetry and Adversary Modeling ABSTRACT: The consolidation of multi-cloud and cloud-native architectures has profoundly transformed organizations’ attack surfaces, shifting the traditional focus of perimeter security toward identity governance, APIs, supply chain chains, distributed control planes, and software-defined infrastructure. Widely documented incidents — such as the 2019 Capital One breach involving exploitation of Server-Side Request Forgery (SSRF) and unauthorized access to the AWS Instance Metadata Service — and the large-scale exploitation of the Log4Shell vulnerability (CVE-2021-44228) demonstrate that the combination of excessively privileged identities, fragmented visibility, and telemetry heterogeneity can result in large-scale systemic compromises. At the same time, intelligence reports published by cloud providers and independent organizations indicate that abuse of valid credentials, OAuth tokens, and API keys constitutes a recurrent vector in attacks against modern cloud environments. In this work, we present a formal and operational architecture for threat detection and response in multi-cloud environments based on three complementary pillars: (i) semantic unification of telemetry from the control plane, network, and runtime; (ii) formal modeling of adversary behavior through directed and annotated temporal graphs; and (iii) hybrid correlation mechanisms that combine declarative rules (Sigma), network signatures (Suricata), eBPF-based instrumentation (Falco), and structured analysis with Elastic Stack and normalized ingestion pipelines. We formalize the detection problem as a decision function f: G(E,T) → {0,1} defined over annotated temporal graphs and introduce formal properties of conditional completeness and bounded false positives under explicit assumptions about telemetry integrity and temporal granularity. We empirically evaluate the architecture in a multi-cloud environment involving Amazon Web Services, Microsoft Azure, and Google Cloud Platform, with instrumented Kubernetes clusters and experimental scenarios derived from the MITRE ATT&CK for Cloud framework executed with Atomic Red Team. Compared with baselines based exclusively on control plane logs, we observed a consistent reduction in mean time to detect (MTTD) and an increase in detection rate for chains involving identity manipulation, container execution, and data exfiltration. Our results indicate that semantic telemetry unification combined with formal modeling of attack chains provides measurable detection gains while maintaining false positive rates compatible with the operation of mature security operations centers (SOC).

2008-09-07Read paper →Cloud

Security in Cloud Computing Environments in 2023: Integration of CNAPP, Observability with eBPF, and Emerging Generative AI Risks

TITLE: Security in Cloud Computing Environments in 2023: Integration of CNAPP, Observability with eBPF, and Emerging Generative AI Risks ABSTRACT: The rapid adoption of cloud computing has transformed contemporary digital infrastructure, establishing models such as IaaS, PaaS, and SaaS as pillars of the digital economy. In 2023, this technological evolution occurred simultaneously with the expansion of cloud-native architectures, microservices, containers, and continuous integration pipelines, significantly increasing organizations’ attack surface. This paper systematically examines the main security challenges in modern cloud environments and presents an integrated analysis of three central trends observed in the security ecosystem up to 2023: Cloud-Native Application Protection Platform (CNAPP), observability and threat detection with eBPF, and emerging risks associated with the adoption of generative artificial intelligence models and large language models (LLMs). Initially, we discuss the architectural foundations of cloud security, including shared responsibility models, resource isolation, and cryptographic mechanisms for data protection. Next, we analyze contemporary attack vectors, such as infrastructure misconfigurations, credential compromise, API exploitation, and attacks targeting development pipelines. We also propose a formal risk assessment model for multi-cloud environments that integrates exposure metrics, asset criticality, and likelihood of exploitation. This model enables quantification of operational risk in elastic and highly distributed infrastructures. In addition, we empirically evaluate the role of CNAPP platforms in the convergence of CSPM, CWPP, and application security, demonstrating how these solutions reduce gaps in visibility and incident response. We also explore the use of eBPF for low-level monitoring in the Linux kernel, enabling real-time behavioral threat detection with minimal performance impact. Finally, we investigate new risks associated with the integration of LLM-based systems into corporate workflows, including prompt injection, data exfiltration, and context manipulation. We conclude that cloud security in 2023 requires an integrated approach that combines formal verification, deep observability, and AI governance. The results indicate that the convergence of cryptographic techniques, behavioral analysis, and policy-based automation is essential to mitigate threats in modern distributed infrastructures.

2008-09-01Read paper →Cloud

Operational Architecture for Threat Detection and Response in Multi-Cloud Environments Based on Unified Telemetry, eBPF, and Formal Modeling of Attack Chains

TITLE: Operational Architecture for Threat Detection and Response in Multi-Cloud Environments Based on Unified Telemetry, eBPF, and Formal Modeling of Attack Chains ABSTRACT: The massive adoption of cloud computing has profoundly transformed enterprise system architecture, shifting the traditional security perimeter to a model centered on identity, APIs, and software-defined infrastructure. In multi-cloud environments, the heterogeneity of providers, telemetry formats, and control mechanisms makes it difficult to consistently detect distributed attacks. This work investigates how to architect an operational incident detection and response system capable of correlating events from multiple cloud providers in near real time. We propose an architecture based on unified telemetry, semantic normalization of logs, and formal modeling of attack sequences. The approach integrates data from native audit services (CloudTrail, Azure Activity Logs, and GCP Cloud Logging), network sensors, and low-level instrumentation based on eBPF for runtime observability in cloud-native workloads. From this heterogeneous telemetry, we define a mathematical model for risk assessment based on temporal event windows, enabling the identification of attack chains characterized by identity abuse, infrastructure manipulation, and lateral movement. The implemented correlation mechanism uses OpenSearch as an indexing and query engine, Sigma rules for behavior-based signature detection, and machine learning models for anomaly identification. The architecture also incorporates integration with the MITRE ATT&CK matrix, enabling observed events to be mapped to known adversarial techniques. We conducted an experimental evaluation in a multi-cloud environment with more than one billion events collected from distributed workloads across three providers. The results indicate significant improvement in operational security metrics, including reduction in mean time to detect (MTTD) and mean time to respond (MTTR), while maintaining a low false positive rate. In addition, we demonstrate how the mathematical formalization of attack chains enables systematic reasoning about cloud operational security. The study contributes to the literature by combining formal rigor, practical integration with tools used in security operations centers, and empirical validation at a realistic scale, offering architectural guidelines for detection and response in complex multi-cloud environments.

2008-08-25Read paper →Cloud

Formal and Operational Architecture for Threat Detection and Containment in Multi-Cloud Environments Based on Unified Telemetry and Adversarial Modeling

TITLE: Formal and Operational Architecture for Threat Detection and Containment in Multi-Cloud Environments Based on Unified Telemetry and Adversarial Modeling ABSTRACT: The rapid adoption of multi-cloud architectures has introduced substantial challenges for threat detection and containment in distributed enterprise environments. The elasticity of the infrastructure, the extensive use of programmatic APIs, and the complexity of identity and access policies significantly expand the attack surface. Widely documented incidents, such as the 2019 Capital One breach and the global exploitation of the Log4Shell vulnerability (CVE-2021-44228), demonstrate how combinations of misconfigurations, compromised credentials, and service exploitation can result in large-scale lateral escalation. Despite the availability of large volumes of telemetry — including API logs, network flows, container audits, and security events — these sources often remain fragmented across providers and tools, limiting the ability to perform contextual correlation. In this work, we present a formal and operational architecture for threat detection and containment in multi-cloud environments based on unified telemetry and graph-oriented adversarial modeling. We propose a mathematical formalization of the attack surface in which identities, resources, and authorization policies are represented as a weighted directed graph. On top of this model, we introduce incremental algorithms capable of correlating heterogeneous events from multiple cloud providers and identifying lateral escalation paths associated with MITRE ATT&CK tactics and techniques. The architecture is implemented using tools widely adopted in industry in 2023, including Elastic Stack, Apache Kafka, Neo4j, Kubernetes, and Sigma rules for detection normalization. We experimentally evaluate the system in a multi-cloud environment containing 420 instances distributed across AWS, Azure, and Google Cloud, executing 36 representative adversarial scenarios. The results indicate a significant improvement over traditional SIEM approaches, with an average detection rate of 94.7%, a 61% reduction in mean time to response (MTTR), and computational overhead below 7%. We also demonstrate, through a case study involving compromised exposed credentials, how graph-based modeling enables rapid identification of complex attack chains involving abuse of IAM permissions and temporary tokens. The results suggest that integrating unified telemetry with formal permission modeling constitutes a promising approach for defending modern cloud infrastructures.

2008-08-18Read paper →IAM

Formal and Operational Architecture for Identity and Access Management (IAM) Resilient to Credential Compromise in Multi-Cloud Environments

TITLE: Formal and Operational Architecture for Identity and Access Management (IAM) Resilient to Credential Compromise in Multi-Cloud Environments ABSTRACT: Identity and Access Management (IAM) has established itself as a central element of security in distributed enterprise architectures. In multi-cloud environments, in which applications and services are executed simultaneously across multiple infrastructure providers, identity-based access control progressively replaces traditional network perimeters as the main defense mechanism. However, empirical evidence from incident reports indicates that credential compromise remains among the most recurrent vectors of data breaches. Attacks involving OAuth token reuse, exposure of API keys, and abuse of excessive permissions demonstrate that conventional authentication and authorization mechanisms do not ensure effective containment when legitimate credentials are obtained by adversaries. This work presents a formal and operational architecture for IAM resilient to partial credential compromise in multi-cloud environments. We propose a formal model that represents identity systems as a tuple composed of users, resources, permissions, tokens, and policies, enabling the definition of mathematical resilience properties under a threat model with graded adversaries. We introduce a security game that captures the scenario in which subsets of credentials are compromised and demonstrate how mechanisms such as ephemeral tokens, cryptographic key derivation, authorization domain segmentation, and risk-based adaptive authentication reduce the operational blast radius. The proposed architecture integrates Zero Trust principles, identity federation based on OpenID Connect and SAML, as well as behavioral monitoring mechanisms and coordinated revocation across multiple cloud providers. Experimental evaluations and case studies in critical infrastructure and financial sector contexts indicate that the approach significantly reduces the temporal window for exploiting compromised credentials while maintaining marginal computational overhead. By formalizing security properties often treated only at an architectural level in the literature, the work helps bring cryptographic models closer to operational guarantees in modern IAM systems. The results indicate that identity architectures explicitly designed to operate under partial compromise can measurably limit the impact of credential-based attacks.

2008-08-11Read paper →IAM

Adaptive Identity and Access Management Architecture with Continuous Risk Assessment and Telemetry-Based Credential Abuse Detection

TITLE: Adaptive Identity and Access Management Architecture with Continuous Risk Assessment and Telemetry-Based Credential Abuse Detection ABSTRACT: Identity and access management (Identity and Access Management – IAM) has become a critical component of corporate security in distributed environments characterized by hybrid infrastructures, cloud computing, and intensive service integration. However, contemporary attacks often exploit compromised legitimate credentials, bypassing traditional mechanisms based solely on initial authentication and static permission control. Empirical reports indicate that credential misuse is one of the leading causes of security breaches in modern organizations. In this context, security architectures inspired by the Zero Trust paradigm emphasize continuous verification of identity and context throughout the entire session. This work proposes an adaptive IAM architecture that incorporates continuous risk assessment based on operational telemetry from endpoints, networks, and identity systems. We formalize a dynamic risk mathematical model R(u,s,t) associated with user u, session s, and time t, integrating metrics of behavioral deviation, access anomalies, and environmental context. The proposed architecture integrates components widely used in corporate and academic environments, including Keycloak as the identity provider, Open Policy Agent (OPA) as the policy decision mechanism, Elastic Stack as the event analytics infrastructure, and security sensors such as Sysmon and Suricata. In addition, we employ Sigma rules to standardize the detection of techniques associated with the MITRE ATT&CK framework. The experimental evaluation was conducted in a simulated corporate environment with more than 480 million log events collected over three months. Results indicate a significant reduction in operational incident response metrics, including a decrease in mean time to detect (MTTD) and mean time to respond (MTTR) when compared to models based exclusively on RBAC. A case study involving an attack chain with phishing, credential dumping, and lateral movement demonstrates the architecture’s ability to detect credential abuse at an early stage. The results indicate that the integration of IAM, operational telemetry, and continuous risk assessment mechanisms constitutes a viable approach to strengthening identity security in modern corporate environments.

2008-08-04Read paper →IAM

Threat-Oriented Resilient IAM Architecture: Formalization, Implementation, and Empirical Evaluation of an Adaptive Model Based on Zero Trust and Behavioral Detection

TITLE: Threat-Oriented Resilient IAM Architecture: Formalization, Implementation, and Empirical Evaluation of an Adaptive Model Based on Zero Trust and Behavioral Detection ABSTRACT: The growing adoption of hybrid and multicloud environments has transformed digital identity into the primary vector for organizational security control. Identity and Access Management (IAM) systems, originally conceived as administrative mechanisms for account and permission provisioning, have come to play a central role in mitigating advanced attacks, particularly those based on credential compromise, session token abuse, and privilege escalation. Recent reports indicate that valid credentials continue to be one of the main intrusion vectors in enterprise environments. However, traditional IAM architectures remain predominantly based on static authorization models, such as Role-Based Access Control (RBAC), and are often unable to respond dynamically to contextual and behavioral changes associated with operational risk. In this work, we propose a threat-oriented resilient IAM architecture that integrates Zero Trust principles, dynamic risk assessment, and behavioral detection based on security telemetry. We mathematically formalize an adaptive risk model that combines identity sensitivity, operational context, behavioral deviation, and the criticality of the requested action. Based on this formalization, we design an access decision mechanism capable of applying adaptive authentication and blocking controls based on dynamic risk thresholds. We implemented an operational prototype using technologies widely adopted in enterprise environments in 2023, including Azure Active Directory, AWS IAM, Elastic Stack, Suricata, and Open Policy Agent. We conducted an empirical evaluation using an experimental environment containing thousands of simulated identities and operational telemetry collected over thirty days. The results demonstrate a substantial reduction in the mean time to detect credential abuse and a significant decrease in excessive permissions compared to a baseline based on static RBAC. In addition, we analyze operational implications for security teams and discuss limitations related to telemetry quality and model parameter calibration. We conclude that the integration of behavioral analysis, contextual assessment, and adaptive policies represents a significant advance in the construction of resilient IAM architectures in modern enterprise environments.

2008-07-29Read paper →IAM

Threat-Oriented Resilient Identity and Access Management Architecture: Formal Modeling, Behavioral Detection, and Operational Hardening in Hybrid Environments

TITLE: Threat-Oriented Resilient Identity and Access Management Architecture: Formal Modeling, Behavioral Detection, and Operational Hardening in Hybrid Environments ABSTRACT: The consolidation of digital identities as the primary vector of compromise in corporate environments has transformed Identity and Access Management (IAM) into the core of modern security architecture. Hybrid and multi-cloud infrastructures, combined with the massive adoption of SaaS, APIs, and service identities, have significantly expanded the attack surface based on credentials and authentication tokens. Empirical reports indicate that most contemporary breaches involve abuse of legitimate accounts, privilege escalation, or exploitation of misconfigured authorization policies. This paper proposes a threat-oriented resilient IAM architecture that integrates three complementary dimensions: formal modeling of effective privileges, behavioral detection of anomalous identity usage, and automated operational hardening in hybrid environments. We initially formalize the privilege surface using directed graphs that represent relationships among users, roles, and permissions. Based on this model, we define quantitative metrics for measuring the identity attack surface and for analyzing privilege escalation paths. We then present an anomaly detection mechanism based on multidimensional behavioral vectors and Mahalanobis distance, applied to authentication events collected at scale. This mechanism makes it possible to identify abuse of valid accounts with a low false-positive rate, even in environments with thousands of identities and multiple identity providers. In addition, we describe an operational framework that integrates widely used tools in corporate environments — including federated identity providers, policy mechanisms based on Open Policy Agent, log analysis in Elastic Stack, and graph modeling in Neo4j — enabling continuous assessment of effective privilege and automated reduction of excessive permissions. The experimental evaluation was conducted in a simulated corporate environment containing more than twelve thousand identities and millions of authentication events. The results indicate a significant reduction in mean time to detect credential abuse, as well as a substantial decrease in excessive privileges. The study demonstrates that the integration of formal modeling, behavioral analysis, and operational automation constitutes an effective approach to strengthening identity security in zero trust architectures and contemporary hybrid environments.

2008-07-22Read paper →AI Security

Integrated Defense Architecture for AI-Based Systems: Formal Threat Modeling, Adversarial Attack Detection, and Operational Monitoring in Production Environments

TITLE: Integrated Defense Architecture for AI-Based Systems: Formal Threat Modeling, Adversarial Attack Detection, and Operational Monitoring in Production Environments ABSTRACT: The adoption of machine learning-based systems in corporate environments has transformed artificial intelligence models into critical components of operational decision-making. These systems are now used in fraud detection, malware classification, image-assisted medical triage, recommendation systems, and behavioral analytics on digital platforms. However, unlike traditional software, machine learning models are parametric functions trained from data, which introduces additional attack surfaces associated with input manipulation, contamination of the training process, and exploitation of inference interfaces. Recent literature documents multiple classes of attacks against machine learning systems, including adversarial examples, data poisoning, model extraction, and membership inference. At the same time, the integration of these systems into DevOps pipelines and container-based infrastructures introduces additional risks related to the software and model supply chain. This work proposes an integrated defense architecture for artificial intelligence systems deployed in production, combining formal threat modeling, statistical anomaly detection mechanisms, cryptographic integrity verification, and continuous operational monitoring. We formalize the concept of aggregated adversarial risk as a function of conditional probabilities associated with different attack classes under a parameterized adversary model. We then introduce a hybrid detector based on Mahalanobis distance and the Isolation Forest algorithm applied to latent model representations. Complementarily, we propose an integrity verification mechanism that combines cryptographic hashing, digital signatures, and behavioral tests based on output distribution divergence. The architecture is integrated into a Kubernetes-based operational pipeline, with telemetry correlated to techniques described in frameworks such as MITRE ATT&CK and MITRE ATLAS. Experimental evaluations in controlled scenarios indicate a consistent increase in empirical robustness against evasion attacks and improved detection of unauthorized changes in model artifacts. The analysis also shows moderate latency impacts when defense mechanisms are properly dimensioned. The results suggest that approaches combining cryptographic controls, statistical analysis, and operational monitoring offer a pragmatically viable path to improving the security of artificial intelligence systems deployed in production.

2008-07-15Read paper →AI Security

Operational Architecture for Security of Artificial Intelligence Systems: Threat Modeling, Defense in Depth, and Empirical Evaluation in Critical Environments

TITLE: Operational Architecture for Security of Artificial Intelligence Systems: Threat Modeling, Defense in Depth, and Empirical Evaluation in Critical Environments ABSTRACT: The rapid incorporation of artificial intelligence (AI) systems into critical infrastructures has introduced new classes of vulnerabilities that are not fully captured by traditional information security models. Unlike deterministic software, machine learning models depend heavily on training data and statistical distributions, creating attack surfaces associated with data manipulation, exploitation of inference interfaces, and compromise of the data supply chain. This work proposes an operational architecture for protecting AI systems based on defense-in-depth principles, integrating formal threat modeling, statistical mechanisms for detecting data manipulation, and operational controls integrated with security operations centers (SOC). We initially formalize a mathematical model to characterize desirable security properties in supervised learning pipelines, including statistical data integrity and parametric model confidentiality. We then introduce data poisoning detection mechanisms based on Kullback–Leibler divergence and sample influence analysis, combined with adaptive query limiting strategies to mitigate model extraction attacks. The proposed architecture integrates security controls throughout the full AI model lifecycle, including data ingestion, training, packaging, and deployment in orchestrated environments. The experimental implementation uses a contemporary technology stack composed of Kubernetes, PyTorch, MLflow, Suricata, and integration with an enterprise SIEM. We empirically evaluate the approach in a laboratory environment representing critical infrastructure, using public security datasets and controlled adversarial scenarios. The results indicate a significant reduction in the effectiveness of adversarial and model extraction attacks, with moderate operational impact in terms of latency and computational resource consumption. A case study in an anti-fraud detection scenario demonstrates the feasibility of the architecture in real operational contexts. We also discuss implications for AI governance and alignment with emerging normative frameworks, such as the NIST AI Risk Management Framework. The results suggest that statistical mechanisms combined with traditional operational controls constitute an effective strategy for reducing risks associated with the growing adoption of AI in critical environments.

2008-07-08Read paper →AI Security

Operational Architecture for Securing Artificial Intelligence Systems: Threat Modeling, Defense in Depth, and Empirical Evaluation in Critical Environments

TITLE: Operational Architecture for Securing Artificial Intelligence Systems: Threat Modeling, Defense in Depth, and Empirical Evaluation in Critical Environments ABSTRACT: The rapid adoption of artificial intelligence (IA) systems in critical infrastructure has introduced new classes of vulnerabilities that are not fully captured by traditional information security models. In contrast to deterministic software, machine learning models depend significantly on training data and statistical distributions, thereby creating attack surfaces associated with data manipulation, exploitation of inference interfaces, and compromise of the data supply chain. This work proposes an operational architecture for defending IA systems based on defense in depth principles, integrating formal threat modeling, statistical mechanisms for detecting data manipulation, and operational controls integrated with Security Operations Centers (SOC). First, we formulate a mathematical model for characterizing desired security properties in supervised learning pipelines, including statistical integrity of the data and parametric confidentiality of the model. Next, we present detection mechanisms for data poisoning based on Kullback–Leibler divergence and sample influence analysis, combined with adaptive query-rate limiting strategies to mitigate model extraction attacks. The proposed architecture incorporates security controls throughout the entire lifecycle of IA models, including data ingestion, training, packaging, and deployment in orchestrated environments. The experimental implementation uses a contemporary technology stack including Kubernetes, PyTorch, MLflow, Suricata, and integration with an enterprise SIEM. We empirically evaluate the approach in a laboratory environment representing critical infrastructure, using public security datasets and controlled adversary scenarios. The results indicate a significant reduction in the effectiveness of adversarial attacks and model extraction attacks, with moderate operational impact in terms of latency and computational resource consumption. A case study in an antifraud detection scenario demonstrates the applicability of the architecture in real operational contexts. We also discuss implications for IA governance and alignment with emerging normative frameworks, such as the NIST AI Risk Management Framework. The results suggest that statistical mechanisms integrated with traditional operational controls constitute an effective strategy for mitigating risks associated with the growing adoption of IA in critical environments.

2008-07-08Read paper →AI Security

Operational Architecture for the Security of Artificial Intelligence Systems: Threat Modeling, Defense in Depth, and Empirical Evaluation in Critical Environments

TITLE: Operational Architecture for the Security of Artificial Intelligence Systems: Threat Modeling, Defense in Depth, and Empirical Evaluation in Critical Environments ABSTRACT: Operational Architecture for the Security of Artificial Intelligence Systems: Threat Modeling, Defense in Depth, and Empirical Evaluation in Critical Environments RESUMO: Operational Architecture for the Security of Artificial Intelligence Systems: Threat Modeling, Defense in Depth, and Empirical Evaluation in Critical Environments Abstract: The rapid integration of artificial intelligence (AI) systems into critical infrastructure has introduced a new class of vulnerabilities that conventional information security models cannot adequately capture. Unlike deterministic software, machine learning models depend heavily on training data and statistical distributions, creating attack surfaces related to data poisoning, abuse of inference interfaces, and supply chain compromise of data. This study proposes an operational architecture for securing AI systems based on the principle of Defense in Depth, integrating formal threat modeling, statistical mechanisms to detect data poisoning, and operational controls integrated into a Security Operations Center (SOC). First, we formalize a mathematical model that characterizes the desired security properties in supervised learning pipelines, namely the statistical integrity of the data and the parametric confidentiality of the models. Next, we introduce a data poisoning detection mechanism based on Kullback–Leibler divergence and sample influence analysis, combined with an adaptive query rate limiting strategy to mitigate model extraction attacks. The proposed architecture integrates security controls throughout the entire AI model lifecycle, including data ingestion, training, packaging, and deployment in orchestration environments. The implementation uses a modern technology stack composed of Kubernetes, PyTorch, MLflow, Suricata, and integration with an enterprise SIEM. We empirically evaluate this approach in a laboratory environment representative of critical infrastructure, using public security datasets and controlled adversarial scenarios. The results showed a substantial reduction in the effectiveness of adversarial attacks and model extraction attacks, with moderate operational impact in terms of latency and computational resource consumption. A case study in a fraud detection scenario demonstrates the feasibility of the architecture in an operational environment. We also discuss implications for AI governance and alignment with emerging normative frameworks, such as the NIST AI Risk Management Framework. These results suggest that combining statistical mechanisms with conventional operational controls is an effective strategy for reducing the risks associated with the growing adoption of AI in critical environments.

2008-07-08Read paper →AI Security

An Integrated Security Architecture for Artificial Intelligence Systems: Formal Threat Modeling, Adversarial Attack Detection, and Operational Hardening in Corporate Environments

TITLE: An Integrated Security Architecture for Artificial Intelligence Systems: Formal Threat Modeling, Adversarial Attack Detection, and Operational Hardening in Corporate Environments ABSTRACT: The rapid incorporation of Artificial Intelligence (AI) systems into critical corporate infrastructures has introduced a new class of security risks that transcends traditional cybersecurity defense models. Deep learning models, inference services exposed via API, and more recently Large Language Models (LLMs) have become part of operational pipelines responsible for sensitive decisions, including fraud detection, automated classification, and incident response. However, recent research demonstrates that such systems exhibit structural vulnerabilities, including adversarial attacks, model extraction, membership inference, and data poisoning. In addition, the operational ecosystem that supports AI applications remains susceptible to traditional infrastructure threats, expanding the attack surface. In this work, we propose an integrated security architecture for AI systems that combines formal threat modeling, adversarial attack detection mechanisms, and operational hardening practices tailored to corporate environments. First, we develop a unified threat model that integrates the MITRE ATT&CK and MITRE ATLAS taxonomies, enabling the mapping of machine learning–specific attack vectors within established cybersecurity defense frameworks. Next, we formalize the adversarial robustness problem from a min–max optimization perspective and introduce a detection mechanism based on output entropy and local intrinsic dimensionality estimation to identify potentially adversarial inputs at inference time. The proposed architecture also incorporates statistical drift monitoring, data pipeline integrity validation, and integration with SIEM platforms for operational response. The implementation was carried out using PyTorch, Suricata, Elastic Stack, and Kubernetes infrastructure, reflecting widely adopted practices in corporate environments up to 2023. Experimental evaluation was conducted in computer vision and intrusion detection scenarios using the CIFAR‑10 and UNSW‑NB15 datasets. The results indicate substantial improvement in robustness against FGSM and PGD attacks, as well as a significant reduction in mean operational response time in security operations centers (SOC). The findings suggest that isolated approaches to adversarial robustness are insufficient and that AI security must be treated as a systemic problem that integrates mathematical methods, secure software engineering, and continuous infrastructure monitoring.

2008-07-01Read paper →DevSecOps

Risk-Driven DevSecOps Architecture with Multi-Stage, MITRE ATT&CK-Based Correlation and Empirical Evidence in Cloud-Native CI/CD Pipelines

TITLE: Risk-Driven DevSecOps Architecture with Multi-Stage, MITRE ATT&CK-Based Correlation and Empirical Evidence in Cloud-Native CI/CD Pipelines ABSTRACT: The increasing adoption of cloud-native architectures and highly automated CI/CD pipelines has significantly expanded the attack surface associated with the software development lifecycle. Well-documented incidents, including supply chain compromises and the exploitation of widely deployed vulnerabilities, show that isolated security controls are insufficient when they are not integrated into mechanisms for context-aware prioritization and behavior-based correlation. In this work, we present a risk-driven DevSecOps architecture that integrates static code analysis, dependency analysis, SBOM generation and verification, infrastructure as code validation, runtime behavioral detection, and a formal engine for computing contextual risk. The architecture uses the MITRE ATT&CK framework as an ontology for multi-stage correlation of events across the entire development and execution pipeline. We provide a critical analysis of the limitations of approaches based solely on CVSS and show that the lack of operational contextualization often leads to inappropriate prioritization of vulnerabilities and to alert fatigue. We propose a mathematical formulation of risk as a composite function of exploitability probability estimated by EPSS, normalized technical impact, and dynamic factors of operational exposure. We introduce formal definitions of the attacker, correctness properties of the build-blocking mechanism, and a probabilistic correlation model between adversarial techniques. The architecture was implemented in a Kubernetes environment using GitLab CI, SonarQube, Semgrep, Trivy, Syft, Grype, OWASP ZAP, Falco, Suricata, and Open Policy Agent. We evaluated the system empirically over a period of six months on a set of distributed enterprise microservices in two distinct organizational domains. The results show a consistent reduction in mean time to remediation, a relative decrease in false positives, and a limited operational impact on overall build time. The empirical findings suggest that the integration of formal risk modeling, threat intelligence, and policy automation can significantly improve the operational effectiveness of DevSecOps programs in cloud-native environments.

2008-06-24Read paper →