Cybersecurity Advances
Articles
Browse verified version-of-record research published by Cybersecurity Advances.
Vol. 3 No. 1 (2026) · pp. 1–11 · Open access
Queue Shock at Model Upgrades: A Longitudinal Audit of EPSS v2–v5 Rank Stability and Prioritization Workload
Ning Lu, Deris Stiawan · Published 2026-10-30Background: EPSS publishes daily probabilities and percentiles to help defenders prioritize vulnerabilities. Major model replacements may disrupt operational queues, but this discontinuity has not been quantified across public EPSS versions.
Vol. 3 No. 1 (2026) · pp. 12–21 · Open access
Beyond One-Hop Aliases: Measuring Identifier-Resolution Fragmentation in the OSV Vulnerability Graph Across Six Package Ecosystems
Stjepan Picek, Huyen Trang Phan · Published 2026-10-30Background: Open-source vulnerability records connect source-native identifiers through aliases. The Open Source Vulnerability (OSV) specification treats aliases as symmetric and transitive, but consumers that stop at one record's directly listed identifiers may recover an incomplete equivalence set.
Vol. 3 No. 1 (2026) · pp. 22–30 · Open access
Where Is the Fix? A Cross-Ecosystem Census of Machine-Actionable Remediation Endpoints in OSV
Fabrizio Pastore, Norrathep Rattanavipanon · Published 2026-10-30Background: Open Source Vulnerability (OSV) records can describe affected versions with fixed, last_affected, limit, and enumerated-version representations. Only an explicit fixed event directly identifies a version that contains a fix.
Vol. 3 No. 1 (2026) · pp. 31–39 · Open access
Severity Without a Common Scale: A Cross-Ecosystem Census of Machine-Readable Severity Signals in OSV
Vesa Kuikka, Gianfranco Nencioni · Published 2026-10-30Background: Package-security tools need severity metadata they can parse consistently. The Open Source Vulnerability (OSV) schema supports quantitative severity arrays at record and affected-package levels, while source databases can publish local qualitative labels. Their availability across package ecosystems has not been measured at scale.
Vol. 3 No. 1 (2026) · pp. 40–50 · Open access
Cross-Format Semantic Preservation in Vulnerability Exploitability Exchange: A Conformance and Round-Trip Benchmark of OpenVEX 0.2.0, CycloneDX 1.6, and CSAF 2.0
Ruxandra F. Olimid, Yi-Chun Yang · Published 2026-10-30Background: Vulnerability Exploitability eXchange (VEX) documents communicate whether a vulnerability affects a specific software product. OpenVEX, CycloneDX, and the Common Security Advisory Framework (CSAF) encode overlapping VEX concepts, but implementers lack controlled evidence about which semantics survive translation and which validators detect malformed or incomplete statements.
Vol. 3 No. 1 (2026) · pp. 51–56 · Open access
From Listing to Exploitation: Measuring KEV Entry Lag and Coverage Against Post-2024 Exploitation Evidence
M. F. Mridha, Taeshik Shon · Published 2026-10-30Background: CISA's Known Exploited Vulnerabilities (KEV) catalog is the most authoritative public statement that a vulnerability has been exploited — and, since 2024, the anchor of NIST's triage policy, with enriched analysis now promised for KEV entries within one business day of listing. Yet the catalog measures agency decisions , not exploitation itself, and the interval between the events that matter — CVE publication, KEV listing, and confirmed exploitation — has never been decomposed for the post-2024 period. Objective: This paper specifies a measurement framework for KEV entry lag and coverage, synthesizes the published record, and identifies the gaps that the 2026 enrichment policy leaves open. Methods: Documentary analysis of the KEV catalog's requirements and operations (2021–2026), the NVD prioritization policy of April 2026, and published exploitation-timing measurements; construction of a pipeline-lag decomposition and a gap-versus-mitigation matrix. Results: KEV listing is a lagged, decision-based signal: it requires an exploitation determination by CISA, not merely evidence, and its coverage is bounded by the catalog's statutory scope — non-federal, non-KEV high-risk vulnerabilities fall outside both the catalog and the new enrichment priority. We identify six residual gaps, of which the deepest is structural: the 2026 policy enriches the exploited minority within one business day while formally deprioritizing everything else, converting the enrichment gap into a permanent, policy-defined class. Conclusions: KEV-derived metrics should be reported as decision-lag measurements with explicit coverage bounds, complemented by predictive signals (EPSS) and community enrichment (ADP) — never as a complete map of exploitation.
Vol. 3 No. 1 (2026) · pp. 57–63 · Open access
The Enrichment Gap: A Longitudinal Audit of the NVD Backlog and Its Propagation Through Downstream Vulnerability Feeds
Risto Vaarandi, Surafel Lemma Abebe · Published 2026-10-30Background: On 12 February 2024, the U.S. National Vulnerability Database slowed its enrichment of new CVE records, creating a backlog that grew past 18,000 unanalyzed vulnerabilities — at its peak, 93.4% of new CVEs went unanalyzed, and even 46.7% of CISA's Known Exploited Vulnerabilities added in that window waited months for analysis. Recovery reached pre-slowdown processing rates by March 2025, and NVD enriched approximately 42,000 CVEs in 2025 (+45% over any prior year), but CVE submissions grew 263% between 2020 and 2025, and in April 2026 NIST formally moved unenriched pre-March-2026 records to a "Not Scheduled" category, adopting prioritized enrichment (KEV-first within one business day). Objective: We audit the full 2024–2026 backlog record and analyze how the enrichment gap propagates through the downstream vulnerability ecosystem. Methods: Longitudinal documentary analysis of NIST/NVD operational announcements, third-party backlog measurements (VulnCheck), and the downstream data architecture (CVE List → NVD → ADP layer → consumer feeds); construction of a backlog-risk register. Results: The backlog's severity was concentrated in exactly the fields that downstream tools consume — CPE applicability, CWE classification, and NVD-CVSS scores — breaking asset matching, triage, and compliance scanning for the unenriched window. The community-layer response (CISA's ADP Vulnrichment from July 2024) demonstrated that parallel enrichment is feasible but arrived with coverage and quality variance. The 2026 prioritization policy converts a temporary gap into a permanent two-tier record. Conclusions: The enrichment gap is structural, not episodic: a triage-first enrichment policy plus 263% submission growth means the unenriched tier will persist and grow. Downstream consumers must diversify their enrichment inputs (ADP feeds, EPSS, exploit signals) and stop treating NVD CPE data as the sole asset-matching mechanism.
Vol. 3 No. 1 (2026) · pp. 64–69 · Open access
Five Feeds, One Truth? Cross-Source Consistency of Fix Status, Severity, and Identifier Mapping Across GHSA, NVD, and OSV
Jan G. Bazan, Ibrahim Gad · Published 2026-10-30Background: A single software vulnerability typically exists in four public records simultaneously: the CVE entry (CNA-authored), its NVD enrichment (CPE/CWE/CVSS), the GitHub Security Advisory (ecosystem-scoped, reviewed), and its OSV aggregation. These sources disagree — on affected version ranges, severity, and fix status — and consumers of vulnerability intelligence rarely reconcile them. Objective: We consolidate the published consistency evidence, formalize the inconsistency classes that matter to consumers, and assess the reconciliation mechanisms available in current tooling. Methods: Synthesis of the large-scale consistency literature (the VIEM measurement of 78,296 CVE/report pairs; the GHSA review-pipeline characterization), architectural analysis of the four-source data flow, and a six-class inconsistency-versus-reconciliation assessment. Results: The published record establishes that divergence is prevalent (only 59.82% of CVE/report pairs strictly matched NVD entries at VIEM's 2019 measurement, with inconsistency increasing over time), and the 2024-2026 structural changes — NVD enrichment triage, ADP parallel enrichment, GHSA's multi-source review pipeline — have multiplied the divergence surface. We identify six inconsistency classes and find that the strongest reconciliation mechanisms (canonical-record policies, field-level cross-validation) are organizational choices rather than shipped tooling: today's pipelines aggregate first and reconcile never. Conclusions: Cross-source consistency must become a measured property of vulnerability intelligence pipelines — with a declared canonical record, field-level validation, and time-stamped audits — or consumers will continue to receive silently conflicting answers to the same question.
Vol. 3 No. 1 (2026) · pp. 70–75 · Open access
Do VEX Claims Age Well? Longitudinal Validation of 'Not Affected' and 'Fixed' Statements Against Subsequent Exploitation Evidence
Yan Xiao, Bo Li · Published 2026-10-30Background: Vulnerability Exploitability eXchange (VEX) documents carry status claims — "not affected," "affected," "fixed," "under investigation" — that determine whether a consumer acts on a vulnerability. The 2024–2025 ecosystem produced the first meaningful VEX corpus (OpenVEX adoption, CISA SBOM/VEX guidance, community tooling), and the companion conformance work in this issue established that the formats preserve semantics across OpenVEX, CycloneDX, and CSAF. What no one has examined is the temporal property: every VEX statement is a claim frozen at issuance time, and exploitation evidence that arrives later — KEV listings, EPSS movement, new PoCs — can silently invalidate a "not affected" claim that was true when written. Objective: We define the statement-aging problem for VEX, specify a validation protocol that measures claim validity against subsequent exploitation evidence, and assess the mechanisms available to revalidate statements over time. Methods: Analysis of VEX semantics under status-lifecycle stress; specification of a longitudinal revalidation protocol keyed to exploitation signals; and a risk-versus-mechanism coverage assessment. Results: Six aging risks emerge, of which three are structural: "not affected" claims cannot be falsified by the consumer without new evidence channels; "fixed" claims degrade silently with build drift; and downstream consumers cache statements with no expiry semantics — the VEX specification defines a status, not a validity horizon. The strongest mitigation is a versioned re-issuance policy with expiry metadata and KEV/EPSS cross-checks at refresh points; none of these is standardized in 2026. Conclusions: VEX statements should be treated as measurements with a validity horizon — revalidated on schedule, versioned on change, and expired explicitly. The specification work that made VEX interoperable now needs the temporal layer that makes it trustworthy over time.
Vol. 3 No. 1 (2026) · pp. 76–81 · Open access
Proof-of-Concept Debt: Measuring the Timeliness and Noise of Public Exploit Disclosure as Exploitation Intelligence
Ning Lu, Deris Stiawan · Published 2026-10-30Background: Public proof-of-concept (PoC) exploits — on GitHub, in Exploit-DB, in security blogs — are consumed as exploitation intelligence: a working PoC is treated as evidence that a vulnerability is exploitable now . The published record supports the timeliness claim: CMU SEI's measurement of 75,807 CVEs found that, given a public exploit eventually appears, its median time-to-publication is just 2 days after patch release (mean 91 days) — and modern reporting (e.g., LLM-CVX, 2025) reaffirms the 2-day median against patched vulnerabilities. Objective: We analyze the PoC corpus as an intelligence source and expose its structural weakness: the corpus is not a signal but a debt — an accumulating body of artifacts whose quality, attribution accuracy, and safety properties vary without any verification standard. Methods: Synthesis of the published exploitation-timing measurements; construction of a PoC-corpus noise taxonomy; and a six-risk-versus-six-verification-mechanism assessment. Results: The corpus's value is real (2-day median timeliness for the exploited minority) but its consumption failure modes are severe and unmeasured: stale PoCs that no longer reproduce inflate "exploit exists" counts; malicious PoCs weaponize the verification step itself; PoC-CVE mislabeling corrupts attribution; and per-PoC verification cost is the reason none of this is routinely checked. We specify the verification harness — sandboxed reproduction with attestation, provenance scoring, and CVE/product binding validation — whose absence defines the debt. Conclusions: "Public exploit exists" should be treated as an unverified hypothesis, not a signal. The intelligence layer needs PoC verification as an infrastructure service, with attested reproduction results — and consumers should budget verification cost explicitly rather than treating corpus membership as evidence.
Vol. 3 No. 1 (2026) · pp. 82–87 · Open access
Machine-Reads the Advisory: Benchmarking LLM Extraction of Affected-Product Ranges and Fix Information Against Curated Records
Jing Sun, Mohamed Jamal Zemerly · Published 2026-10-30Background: The 2024–2026 vulnerability-intelligence record created both the problem and the candidate solution for curation at scale. On the problem side: the NVD enrichment backlog (CVE submissions grew 263% between 2020 and 2025) left thousands of records without CPE, CWE, or CVSS; community responses (CISA's ADP Vulnrichment, OpenCVE Enrichment) demonstrated that automated extraction can fill the gap — OpenCVE's LLM-driven enrichment covered nearly 30% of all CVEs published in 2025 within weeks of launch. On the solution side: a benchmark literature now exists — CVE-Bench (509 CVEs, NAACL 2025), JITVul, LLM-CVX — but none measures the extraction task that curation requires. Objective: We specify the extraction benchmark that the field is implicitly running without controls: LLM extraction of affected-product ranges and fix information from advisory text, scored against curated records. Methods: Benchmark-design analysis decomposing the extraction task into six measured fields, six failure modes documented in the LLM-security literature, and six control mechanisms; alignment against the existing benchmark corpus. Results: The failure profile is field-dependent: product names extract well, version-range boundaries and exploitability claims extract poorly — exactly the fields where curation errors have the highest operational cost. Prompt injection through advisory text (E6) is the failure mode the current tooling ignores entirely, despite advisories being attacker-influenceable content. Conclusions: LLM extraction is viable as an assist to curation with confidence scoring and human review for top-severity records — and unsafe as a replacement, with version-range precision the decisive open problem.
Vol. 3 No. 1 (2026) · pp. 88–93 · Open access
Advisory Staleness in Operational Technology: Measuring Coverage and Latency of ICS/OT Vulnerability Intelligence for Critical Infrastructure
Ahmad Sami Al-Shamayleh, Madhusanka Liyanage · Published 2026-10-30Background: Vulnerability intelligence for operational technology (OT) — the control systems behind water, energy, and manufacturing — lives in a structurally different ecosystem from IT vulnerability intelligence: CISA ICS advisories (OT-specific analysis published as HTML prose), thin CVE/NVD coverage for OT vendors, heterogeneous vendor advisories, and community-maintained datasets (the ICS Advisory Project's CSV conversions). The 2026 issue's companion papers mapped the IT-side intelligence infrastructure; the OT side diverges at every machine-consumable step. Objective: We analyze where OT vulnerability intelligence exists, where it decays, and what coverage and latency the OT advisory lifecycle actually delivers. Methods: Source-structure analysis of the four OT intelligence channels; funnel decomposition of the advisory lifecycle (CVE assignment → enriched advisory → machine-readable format → patch availability); and a six-risk-versus-six-mitigation coverage assessment aligned with IEC 62443-era needs. Results: The OT intelligence funnel decays sharply at the machine-consumable steps: CVE identifiers exist for most OT vulnerabilities, enriched advisories cover a subset, machine-readable formats are rare, and patch availability for embedded control devices is the weakest stage. The community-maintained conversion layer (the ICS Advisory Project) demonstrates both the demand for machine-readable OT intelligence and its sustainability fragility. Conclusions: OT vulnerability staleness is an infrastructure property, not a data problem: until OT vendors publish machine-readable advisories through CVE-grade channels, OT consumers will depend on community stewardship and manual analysis — and resilience planning should treat that dependency explicitly.
Vol. 2 No. 1 (2025) · pp. 1–10 · Open access
Engineering the Post-Quantum Transition at Scale: Protocol Integration, Library Defaults, and the In-Between Era of Internet Security (2025)
Feng Hao, Danda B. Rawat · Published 2026-10-29Background: The August 2024 finalization of FIPS 203, 204, and 205 established the cryptographic core of the post-quantum transition; 2025 was the year that core was engineered into the default path of the Internet . Within twelve months, ML-KEM-based hybrid key exchange became a default, zero-configuration behavior across the major browser engines, a mainstream language runtime (Go 1.24's crypto/mlkem standard-library package), and — decisively for server operators — OpenSSL 3.5.0 (April 2025, LTS), whose default TLS keyshares offer X25519MLKEM768. By late October 2025, more than half of human-initiated traffic observed at a major CDN was post-quantum protected. Objective: This paper characterizes the 2025 state of the post-quantum transition as an engineering achievement, and identifies what the achievement does not yet cover. Methods: Following a design-analytical methodology, we (i) verify the 2025 default-enablement sequence against primary release documentation (OpenSSL, Go, browser engines, platform vendors, CDN telemetry), (ii) analyze the standards pipeline as it stood at year-end (the HQC selection of March 2025; the pending FN-DSA draft; the IR 8547 deprecation schedule), and (iii) construct a residual-risk register mapping six risk classes against six mitigation classes. Results: The deployment achievement is real but asymmetric: confidentiality (key establishment) has moved to post-quantum hybrids at scale, while authentication remains entirely classical — public post-quantum certificates are not expected to be widely issued before 2026 and broadly trusted later. We term this the in-between era and show that it closes the harvest-now-decrypt-later window for transit confidentiality while leaving an open window for identity forgery and server impersonation. The residual-risk register identifies implementation maturity (the KyberSlash-class timing-defect lesson), certificate and PKI latency, and the non-upgradeable long-tail client population as the dominant open risks. Conclusions: The engineering problem of 2025 was enabling post-quantum key exchange by default; the engineering problem of 2026–2027 is post-quantum authentication on the same schedule — and organizations should plan PKI re-issuance, validation pipelines, and legacy-exception registers against that window now.
Vol. 2 No. 1 (2025) · pp. 11–17 · Open access
Securing Agentic AI: Threat Models and Trust Boundaries for LLM-Based Agents and Tool-Use Protocols (2025)
Mianxiong Dong, M. F. Mridha, Muhammad Waqas · Published 2026-10-29Background: 2025 turned large language models from chat systems into agents — systems that read content, decide on actions, and invoke privileged tools. Two interoperability protocols industrialized this shift: Anthropic's Model Context Protocol (MCP), whose June 2025 revision re-specified MCP servers as OAuth 2.1 resource servers, and Google's Agent2Agent (A2A) protocol, donated to the Linux Foundation in June 2025 with broad industry backing. The same year produced the attack record that defines the threat model: Invariant Labs' tool-poisoning disclosure (April 2025) and GitHub-MCP "toxic agent flow" exploit (May 2025), and the formalization of the "lethal trifecta" — private data, untrusted content, and external communication combined in one agent (June 2025). Objective: We consolidate the 2025 agentic-AI security record into an engineering threat model for tool-using agents and evaluate the mitigations that the protocol layer, the platform layer, and application design can supply. Methods: Qualitative synthesis of the 2024–2025 primary disclosures, protocol specifications, and governance instruments; construction of a six-class attack taxonomy and a six-class mitigation-coverage assessment. Results: The defining property of agentic systems is boundary collapse: untrusted content becomes instructions that drive privileged actions, so the classical separation between "data" and "execution" — the foundation of most security architecture — does not hold. Every major 2025 exploit is an instance of one pattern; mitigations partition cleanly into classes that reduce blast radius (capability-scoped tools, OAuth-scoped delegation, confirmation gates) and classes that detect misuse (provenance labeling, toxic-flow analyzers), but no 2025 mechanism eliminates the confused-deputy problem itself. Conclusions: Agentic-AI security in 2025 is an exercise in boundary engineering under an acknowledged residual risk : scope every capability, bind identities to delegation chains, gate irreversible actions, and instrument for detection — while treating prompt injection as unsolved and designing so that its exploitation is survivable.
Vol. 2 No. 1 (2025) · pp. 18–24 · Open access
After the Successors: Affiliate Collapse, Social-Engineering Mega-Hits, and Resilience Lessons from the 2025 Ransomware Ecosystem
Rodrigo Sanches Miani, Monica T. Whitty, Kyounggon Kim · Published 2026-10-29Background: The 2025 ransomware year put to its first test the ecosystem-churn model that the 2024 disruption record — Operation Cronos, the ALPHV exit scam, and the documented rise of successor brands — had suggested [3]. RansomHub — the successor brand that had absorbed LockBit's displaced affiliates — went dark on 1 April 2025, with its affiliate pool publicly claimed by the DragonForce "cartel" model within a day. The year's most consequential incidents were not encryption feats but social-engineering campaigns: the April 2025 attacks on Marks & Spencer (reported ~£300 million in lost profits; online orders halted for weeks) and the Co-operative Group (£206 million in lost first-half revenue, £80 million in operating-profit impact), both attributed to the Scattered Spider collective using help-desk and identity social engineering on the DragonForce platform. Meanwhile, on-chain ransomware payments fell roughly 35% year-over-year to approximately $813.55 million in 2024 (Chainalysis), even as single-incident impact reached record levels. Objective: We analyze the 2025 record as a test of the displacement-versus-dismantlement thesis and extract the resilience lessons that follow. Methods: Event-driven qualitative analysis of the 2025 record from primary disclosures, corporate statements, and law-enforcement reporting; payment-flow analysis from blockchain analytics; and a stage-versus-control coverage assessment. Results: The churn model performed: brand-level collapse produced affiliate migration, not dismantlement. Impact decoupled from payment volume: the signature 2025 incidents were human-vector attacks whose costs were driven by operational halt, third-party access compromise, and recovery duration — not by encryption sophistication. Disclosure worked: the year's impact figures became public within months, in the disclosure era the field entered in 2024. Conclusions: Resilience investment belongs at the identity and help-desk boundary, in third-party access governance, and in tested recovery — with disclosure-era accountability as the forcing function.
Vol. 2 No. 1 (2025) · pp. 25–30 · Open access
From Guidance to Measurement: Zero Trust Engineering Practice after the Final NIST SP 1800-35 Practice Guide (2025)
Hadis Karimipour, Taeshik Shon · Published 2026-10-29Background: In June 2025, NIST published the final version of Special Publication 1800-35, Implementing a Zero Trust Architecture — the National Cybersecurity Center of Excellence practice guide built with 24 collaborating vendors, documenting end-to-end zero-trust reference builds, the integration failures encountered, and the migration steps organizations can replay. Together with SP 800-207 (the architecture), CISA's Zero Trust Maturity Model v2.0 (the stages), and the 2024 federal zero-trust milestone, the guidance stack for zero trust is now, for the first time, complete. Objective: This paper assesses what the completed guidance stack changes for zero-trust engineering practice — and what it still does not supply. Methods: Documentary analysis of the final practice guide against the rest of the guidance corpus; alignment analysis across the three instrument classes (architecture, practice, measurement); and a coverage assessment of the guide's artifacts against the measurement dimensions an auditor or program owner needs. Results: SP 1800-35 converts zero trust from doctrine into engineering: its reference builds, documented integration failures, and vendor-validated interop turn SP 800-207's tenets into replayable configurations. But the guide is a build record, not a measurement instrument: it defines no evidence classes, no maturity semantics, and no weakest-link handling — a measurement gap remains open, now with a concrete artifact base that measurement instruments can finally consume. Conclusions: 2025 closes the guidance era of zero trust. The open engineering problems are now measurement and operations: instruments that score enforced behavior (not declarations), telemetry standards that make evidence collectable, and adoption paths for the long tail that the practice guide's 24-vendor, enterprise-scale builds do not represent.
Vol. 2 No. 1 (2025) · pp. 31–36 · Open access
Compliance Engineering under the EU Cyber Resilience Act: Timelines, Obligations, and SBOM-Driven Product Security
Abdelkarim Erradi, Leonardo Badia · Published 2026-10-29Background: The EU Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) entered into force on 10 December 2024, and 2025 was its preparation year: the Commission's delegated acts took shape, harmonized-standardization work began, and manufacturers confronted the obligations timetable — vulnerability and incident reporting from 11 September 2026 (24-hour early warning, 72-hour notification), full application including CE-marking consequences on 11 December 2027, and open-source steward duties from the same date. Objective: We translate the CRA's legal obligations into an engineering program: what a manufacturer of products with digital elements must build, in what order, to be compliant by construction rather than by remediation. Methods: Documentary analysis of the CRA's obligations and official Commission guidance; mapping of obligations to security-engineering practices (SSDF, SBOM, SLSA-class process evidence); and construction of an SBOM-driven vulnerability-management pipeline aligned with the Act's reporting duties. Results: The CRA converts product security from a best practice into a lifecycle obligation : secure-by-default configuration, risk assessment, security-update handling across a support period of at least five years, and 24/72-hour reporting of actively exploited vulnerabilities and severe incidents. The SBOM is the load-bearing artifact — it is what makes feed correlation, triage, and notification computable at product scale. The engineering-critical path runs through 2026: reporting obligations arrive a full fifteen months before full application, so the reporting pipeline must exist before the conformity machinery does. Conclusions: Organizations should treat 2025-2026 as the compliance-engineering window: build the SBOM pipeline, stand up the reporting process, and align development practice with the harmonized standards — because the CRA makes security a property of the market, enforced through product-safety law.
Vol. 2 No. 1 (2025) · pp. 37–42 · Open access
Trust at Infrastructure Scale: Cryptographic Architecture and Resilience Engineering for the EU Digital Identity Wallet
Veelasha Moonsamy, Hamid Bostani · Published 2026-10-29Background: eIDAS 2.0 (Regulation (EU) 2024/1183, in force 20 May 2024) obliges every member state to offer citizens a European Digital Identity Wallet (EUDI Wallet) by the end of 2026. The regulatory build-out ran on schedule through 2025: five implementing regulations on core functionalities and interfaces (December 2024), and seven further trust-services regulations plus an electronic-attestations regulation (July 2025) — the largest deployment of verifiable-credential infrastructure ever attempted. Objective: We analyze the wallet's cryptographic architecture and its resilience-engineering requirements: what must hold for a credential infrastructure at the scale of 450 million residents to be trustworthy, and which failure classes its design must survive. Methods: Documentary analysis of the regulation, the implementing regulations, and the underlying open standards (W3C Verifiable Credentials 2.0, ISO/IEC 18013-5 mobile driving licence, SD-JWT-class selective disclosure); construction of an ecosystem architecture model; and a risk-versus-mechanism coverage assessment. Results: The wallet's trust model distributes cryptographic authority across issuers, holders, and registered relying parties — an architectural inversion of centralized identity that removes the standing honeypot but creates a new resilience surface: revocation latency, verifier over-collection, certification gaps between wallet solutions, and cross-border interoperability failures. The 2025 implementing regulations address the governance layer (trust services, attestations) but leave the operational-resilience layer — revocation infrastructure guarantees, ecosystem-scale incident response — as open engineering work. Conclusions: Digital identity at infrastructure scale is the decade's most consequential trust build; its security will be decided less by cryptography (which is largely settled) than by operational resilience engineering — revocation with guarantees, recovery with rehearsals, transparency for components that fail silently, and the humility to keep manual fallbacks while the ecosystem itself is the newest and least-tested component.
Vol. 2 No. 1 (2025) · pp. 43–48 · Open access
Resilience Engineering for Operational Technology: The 2023-2025 Critical-Infrastructure Attack Record and the IEC 62443 Path
Cristina Alcaraz, Yanxia Sun · Published 2026-10-29Background: Operational technology (OT) — the control systems behind water, energy, and manufacturing — became a headline cyber target in 2023-2025, not through novel exploits but through failures of basic hygiene: the November 2023 compromise of a western Pennsylvania water authority's Unitronics PLC by Iran-affiliated "Cyber Av3ngers" (default credentials, Internet-exposed device), the CISA advisory that followed (AA23-335A, updated December 2024), and the EPA's May 2024 enforcement alert reporting that over 70% of inspected drinking-water systems did not fully comply with Safe Drinking Water Act risk-assessment requirements. Objective: We analyze the 2023-2025 OT attack record and construct the resilience-engineering program it implies — one that accepts unpatchable legacy devices as a permanent condition and engineers around them. Methods: Incident-record analysis from government advisories and enforcement documents; architectural analysis using the Purdue hierarchy and IEC 62443's zones-and-conduits model; and a risk-versus-control coverage assessment. Results: The record shows a consistent mechanism: IT-side compromise traveling into flat OT networks to reach exposed, under-credentialed control devices — with real-world impact bounded not by cyber defense but by manual fallback (operators running treatment processes by hand). IEC 62443's zones-and-conduits segmentation, credential hygiene at the OT boundary, and rehearsed manual fallbacks are the highest-leverage controls; exotic threat intelligence ranks last. Conclusions: OT resilience is not IT security transplanted; it is engineered degradation tolerance. The 2023-2025 record tells utilities and industrial operators exactly what to build first.
Vol. 1 No. 1 (2024) · pp. 1–13 · Open access
From Standards to Systems: A Crypto-Agility Framework for Post-Quantum Cryptography Migration in Enterprise and Internet Infrastructure
Sepideh Malektaji, Carla Mouradian · Published 2024-12-01Background: In August 2024, the U.S. National Institute of Standards and Technology (NIST) finalized the first three post-quantum cryptography (PQC) standards — FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) — and, in November 2024, published the initial public draft of NIST IR 8547, which schedules the deprecation of classical public-key cryptography by 2030 and its disallowance after 2035. Organizations therefore face, for the first time, a regulator-defined deadline for a global cryptographic transition. Objective: This paper characterizes the state of PQC deployment as of the end of 2024 and develops a structured, reusable migration framework that converts the new standards into an actionable organizational process. Methods: We apply a design-science methodology combining (i) documentary analysis of the 2024 standards and transition guidance, (ii) a structured synthesis of publicly documented, at-scale PQC deployments in transport, messaging, and shell protocols during 2022–2024, (iii) characterization of wire-size and throughput overheads using published benchmark data, and (iv) construction and cross-validation of a five-phase Crypto-Agility Migration Process (CAMP) against NIST transition guidance and NCCoE migration practices. Results: Deployment evidence shows that hybrid key establishment (X25519 + ML-KEM-768) is already operational at Internet scale, adding approximately 1.2 KB to the TLS 1.3 handshake with negligible latency impact, whereas post-quantum signatures remain the dominant constraint (ML-DSA-65 signatures are 3309 bytes versus 256 bytes for RSA-2048). We identify four systemic migration bottlenecks — FIPS validation lead times, embedded device lifecycles, PKI signature-size pressure, and organizational cryptographic invisibility — and operationalize CAMP to address them, anchoring prioritization in Mosca's inequality and the 2030/2035 deadlines of NIST IR 8547. Conclusions: The 2024 finalization of the PQC standards transforms post-quantum readiness from a research question into an engineering and governance problem. Organizations that establish cryptographic inventory, hybrid piloting, and crypto-agile library interfaces during 2025 will be positioned to meet the 2030 deprecation horizon; organizations that do not will face compressed, higher-risk migrations later in the decade.
Vol. 1 No. 1 (2024) · pp. 14–24 · Open access
Digital Trust in Public Funds: An Explainable AI Framework for Continuous Compliance Monitoring of U.S. Federal Grant Subrecipients
Ayesha Arobee · Published 2024-12-01Background: Federal grants flow through thousands of state agencies and subrecipients, yet oversight remains largely periodic and document-driven. Two 2024 regulatory developments transformed this environment: the revised OMB Uniform Guidance (2 CFR Part 200, effective 1 October 2024) directs pass-through entities toward risk-based, continuous subrecipient monitoring and raised the Single Audit threshold to one million dollars, while OMB Memorandum M-24-10 (March 2024) established risk-management expectations for artificial intelligence in federal use — including requirements for explainability and human oversight. Together they create both the mandate and the guardrails for AI-assisted compliance monitoring. Objective: We design and specify an explainable AI (XAI) framework — the Grant Risk Assessment and Compliance Engine (GRACE) — for continuous monitoring of subrecipient compliance that couples cross-system anomaly detection with tamper-evident evidence preservation. Methods: Following a design-science methodology, we (i) analyzed the 2024 regulatory corpus (2 CFR 200, GAO fraud-risk guidance, NIST AI Risk Management Framework), (ii) derived a cross-system red-flag taxonomy spanning financial, payroll, procurement, and performance-reporting systems, (iii) specified a five-component architecture, and (iv) evaluated it through regulatory-requirement mapping and a fully synthetic case demonstration. Results: GRACE maps onto every major obligation of the 2024 Uniform Guidance monitoring cycle; the synthetic walkthrough shows how feature-level attributions (e.g., duplicate-invoice rate +1.82, payroll-to-performance mismatch +1.45) translate into a triaged composite score (89/100 → site review) with a plain-language explanation and an immutable ledger entry for every monitoring event. Tamper-evident logging via hash chains and periodic Merkle-root anchoring gives auditors and pass-through entities a shared, verifiable evidence base. Conclusions: Explainable, provenance-preserving anomaly detection can convert subrecipient oversight from episodic document review into continuous, defensible, and auditable practice — a foundational mechanism of digital trust in the stewardship of public funds. Empirical validation on operational data is the required next step and is specified as such.
Vol. 1 No. 1 (2024) · pp. 25–34 · Open access
Trust but Verify: The xz-utils Backdoor (CVE-2024-3094) and the Foundations of Open-Source Software Supply-Chain Trust
Bin Cao, Yishuai Chen · Published 2024-12-01Background: In March 2024, a multi-year social-engineering operation culminated in the injection of a sophisticated backdoor into xz/utils versions 5.6.0 and 5.6.1 (CVE-2024-3094, CVSS 10.0), reaching OpenSSH on rolling-release GNU/Linux distributions before a fortuitous performance anomaly led to its discovery and containment. Objective: This paper treats the xz-utils incident not as an anomaly to be patched but as a diagnostic event that exposes the load-bearing assumptions of trust in open-source software supply chains — and evaluates, stage by stage, whether the security instruments now in circulation would have prevented, detected, or contained it. Methods: We conduct a qualitative single-case study built exclusively from primary sources (the disclosure thread, the CVE record, distribution advisories, and the CISA alert), reconstruct the attack chain as a sequence of six trust transitions, and perform a counterfactual control analysis mapping six classes of supply-chain controls (maintainer-support programs, provenance attestation, reproducible builds, SBOM and binary analysis, runtime isolation, and coordinated response) against each stage. Results: No single instrument spans the full chain. Provenance attestation and reproducible builds would have raised the cost of the build-time activation stage dramatically; maintainer-support and criticality programs address the social-engineering stage that every technical control leaves untouched; runtime isolation (SELinux) actually prevented exploitation on some systems; and the coordinated response within hours demonstrated that recovery-side trust mechanisms are the field's most mature layer. We further show that SBOMs — the most-cited 2024 remedy — would not have detected this attack, and argue that trust in supply chains must be built on verifiable process evidence rather than identity or reputation. Conclusions: The xz-utils incident defines the research and policy agenda for supply-chain trust: fund maintainers of critical-but-invisible infrastructure, instrument trust transitions with verifiable process guarantees, and design for the adversary who behaves like an ideal contributor.
Vol. 1 No. 1 (2024) · pp. 35–44 · Open access
Measuring Zero Trust Maturity: An Evidence-Based Assessment Instrument Aligned with NIST SP 800-207, CISA's Maturity Model, and the 2024 Federal Milestone
Sujit Biswas, Md Monjurul Karim, Anindya Nag · Published 2024-12-01Background: Zero trust has become the organizing security paradigm of the mid-2020s, but its adoption is routinely claimed more often than it is demonstrated. The 2024 policy environment sharpened this problem: OMB M-22-09's federal zero-trust goals came due in September 2024, NIST's Cybersecurity Framework 2.0 (February 2024) elevated governance to a first-class function, and the NIST NCCoE's zero-trust practice guide drafts (2023–2024) pressed implementers toward measurable outcomes — yet the instruments most organizations use to report "zero trust maturity" remain largely self-assessed, declarative, and insensitive to the difference between a policy that exists and a control that is enforced. Objective: We design ZT-MMI, a Zero Trust Maturity Measurement Instrument that scores maturity on an evidence-tier basis — distinguishing declared policies (E0), configured controls (E1), observed behavior (E2), and enforced outcomes (E3) — across the five pillars and three cross-cutting capabilities of CISA's Zero Trust Maturity Model v2.0, anchored to the tenets of NIST SP 800-207. Methods: Following a design-science methodology, we (i) analyzed the authoritative zero-trust corpus (NIST SP 800-207, CISA ZTMM v2.0, OMB M-22-09, DoD Zero Trust Strategy, NIST CSF 2.0, NIST SP 1800-35 drafts), (ii) extracted requirements that any credible maturity instrument must satisfy, (iii) constructed the instrument's indicator set, evidence tiers, and aggregation model, and (iv) evaluated it through requirements mapping, cross-model alignment, and an illustrative synthetic assessment. Results: Existing instruments are complementary but incomplete: CISA's ZTMM defines stages but not evidence requirements; CSF 2.0 defines functions and tiers but not zero-trust-specific outcomes; DoD's strategy defines deadlines but not measurement semantics for civilian adopters. ZT-MMI composes their semantics into a single instrument in which every maturity claim carries an evidence tier; the synthetic walkthrough shows how evidence tiering surfaces the characteristic failure mode of declarative maturity reporting — high policy coverage with low enforcement. Conclusions: Zero trust maturity is only meaningful as a measured property of enforced behavior . Evidence-tiered scoring converts maturity from a label into an auditable claim, providing the digital-trust foundation that zero-trust transitions require as they move from aspiration to accountability.
Vol. 1 No. 1 (2024) · pp. 45–54 · Open access
After the Takedown: Ecosystem Resilience, Affiliate Churn, and the Foundations of Cyber Resilience after Operation Cronos (2024)
Anushka Nehra, Nishu Bansal · Published 2024-12-01Background: On 19 February 2024, an international law-enforcement operation codenamed Cronos disrupted LockBit — until then the most prolific ransomware-as-a-service (RaaS) brand — seizing infrastructure, source code, and victim data. The following month, the ALPHV/BlackCat cartel imploded in a $22 million exit scam against a victim (Change Healthcare) whose attack had already caused the most consequential U.S. healthcare disruption of the decade, and new brands such as RansomHub absorbed the displaced affiliate pool. Objective: This paper analyzes the 2024 ransomware ecosystem as a resilient adversarial system and asks what its post-Cronos behavior teaches about the design of defensive resilience. Methods: We conduct a qualitative event-driven analysis of the 2024 disruption sequence from primary and authoritative secondary sources (law-enforcement releases, blockchain analytics, incident-response and industry reports), reconstruct the RaaS value chain and its post-takedown dynamics, and synthesize a resilience-lifecycle framework aligned with NIST CSF 2.0 and the 2024 regulatory instruments (NIS2 transposition deadline, SEC incident-disclosure rule). Results: The ecosystem absorbed its largest ever law-enforcement shock within weeks: brands are substitutable but the affiliate economy persists; payment flows, already at a record ~$1.1 billion in 2023, re-concentrated under successor brands; and the most damaging 2024 incidents (Change Healthcare; the Synnovis/NHS disruption) were produced not by the most sophisticated malware but by systemic vulnerabilities in recovery and sectoral interdependence. Defensive resilience — not attacker attribution — emerges as the decisive variable. Conclusions: Ransomware defense should be designed against an ecosystem, not a brand: fund the boring controls (tested immutable backups, segmentation, identity hygiene), prepare for the disclosure era, and treat sector-level interdependence as a resilience parameter.