Security / Resilience / Autonomous Systems
H-R07 — Autonomous Cyber Defense, Containment, and Safe Counteraction for Critical Infrastructure
Report summary
(Label: institutional analysis) The acceleration of adversarial offensive cyber capabilities, particularly those augmented by generative artificial intelligence, necessitates an evolution in defensive architectures from human-in-the-loop to human-on-the-loop paradigms1. High-consequence critical inf
Key topics
- Security / Resilience / Autonomous Systems
- Security
- Resilience
- Autonomous Systems
- AI
- Agentic Web
- GEO
- .NET
- SQL
Research provenance
For citation, use the report title and canonical URL. Archival presence does not establish authorship or promote report statements into portfolio evidence.
This page renders the archived Markdown as safe, formatted HTML. It is background research and does not become a portfolio claim without evidence review.
Full report
On this page
1. Executive Decision Brief
(Label: institutional analysis) The acceleration of adversarial offensive cyber capabilities, particularly those augmented by generative artificial intelligence, necessitates an evolution in defensive architectures from human-in-the-loop to human-on-the-loop paradigms1. High-consequence critical infrastructure systems require autonomous cyber defense mechanisms capable of executing machine-speed detection, containment, and bounded counteraction. However, integrating autonomy into cyber-physical systems introduces non-compositional security risks, where individually safe algorithmic decisions may unpredictably aggregate into systemic failures or unauthorized escalations3. (Label: reasoned inference) To safely automate defensive actions inside an owned environment, organizations must deploy constrained architectures, such as the Causal Multi-Agent Decision Framework (C-MADF) and Simplex runtime assurance models, which enforce strict, machine-readable safety envelopes4. Furthermore, the operationalization of these systems requires a rigorous distinction between internal network defense, consent-based hunt-forward operations, and outward-facing countermeasures. Misclassification of these actions risks violating international legal doctrines, particularly the principles of sovereignty, non-intervention, and the prohibition of the use of force6. This exhaustive report establishes the architectural, legal, and operational frameworks required to govern autonomous cyber defense, ensuring that algorithmic counteraction remains technically sound, legally compliant, and strategically contained.
2. Definitions and Scope
(Label: established standard or law) To constrain machine reasoning and ensure policy compliance, precise definitional boundaries must be programmed into Policy Decision Points (PDPs). The following categorizations govern the jurisdictional and operational scope of autonomous agents.
Jurisdictional and Operational Boundaries
- Internal Defensive Automation: Automated actions taken entirely within the boundaries of a legally owned, leased, or administered network. These actions are designed to preserve the confidentiality, integrity, and availability of resident data and infrastructure without projecting force or effects outside the perimeter8.
- Consent-Based Operations (Hunt-Forward): Defensive missions where cyber operators or autonomous agents deploy to a partner nation's or third-party entity's network. These agents hunt strictly on infrastructure for which explicit access and consent have been provided, mapping adversary tactics without violating sovereignty10.
- Law-Enforcement Support: Actions executed to preserve digital evidence (e.g., following the RFC 3227 order of volatility) or isolate infrastructure in direct compliance with lawful orders, maintaining a pristine forensic chain of custody12.
- Countermeasures: Pacific unilateral reactions that are intrinsically unlawful but are adopted by an injured State against a responsible State to induce compliance with international obligations. They must be proportionate, temporary, and reversible, and they absolutely cannot amount to a use of force (Articles on State Responsibility, Articles 22, 49–54)7.
- Anticipatory Self-Defense: Actions taken under the customary international law doctrine of self-defense (UN Charter Article 51\) to repel an imminent cyber operation that reaches the severity threshold of an armed attack14.
- Unauthorized Private Retaliation (Hack-Back): Unilateral, uncoordinated offensive actions taken by non-state actors or private corporations outside their owned infrastructure to disrupt or destroy adversary systems. This practice is widely considered illegal under domestic statutes and international law17.
Autonomous Action Categories
(Label: technical proposal) To prevent autonomous systems from causing greater harm than an initial attack, defensive actions must be categorized by their reversibility and constrained by the system's runtime assurance envelope.
| Category | Definition | Cyber Defense Examples |
|---|---|---|
| Reversible | Defensive maneuvers whose effects can be wholly undone via a simple state change without permanent data loss, hardware degradation, or logical corruption. | IP blocking, session termination, temporary workload suspension, stateless packet filtering7. |
| Conditionally Reversible | Actions that can be reverted but induce transient secondary effects, require complex reconciliation, or disrupt dependent business processes temporarily. | Automated patching requiring application reboots, dynamic routing changes causing brief latency, modifying active directory trust relationships21. |
| Irreversible | Defensive actions resulting in permanent state destruction, hardware bricking, or cryptographic unrecoverability. | Zero-wiping compromised firmware, physically severing a control system without a fallback channel, burning a zero-day exploit in a counter-strike9. |
3. Historical and Technical Context
(Label: observed deployment or practice) The transition from static, signature-based firewalls to dynamic, autonomous cyber defense relies on several competing and complementary technological paradigms. Integrating these paradigms requires understanding their functional distinctions and operational limitations.
Paradigm Comparisons
(Label: institutional analysis)
- Agentic Security Operations vs. Cyber Reasoning Systems (CRS): Agentic operations utilize Large Language Models (LLMs) equipped with tool-use capabilities (e.g., executing OpenC2 commands) to reason through incident response workflows dynamically, making semantic judgments about novel threats24. Conversely, a CRS (such as the Mayhem system developed for DARPA's Cyber Grand Challenge) operates without semantic reasoning, relying instead on formal symbolic execution, fuzzing, and binary rewriting to autonomously detect, prove, and patch software flaws at the machine-code level21.
- Moving-Target Defense (MTD) vs. Deception: MTD relies on continuously and structurally altering the attack surface (e.g., dynamic IP hopping, memory address space layout randomization) to invalidate an attacker's reconnaissance and disrupt the cyber kill chain9. Deception, alternatively, involves projecting fabricated vulnerabilities, honeytokens, and decoy infrastructure designed specifically to absorb adversarial engagement, thereby generating high-fidelity attribution intelligence1.
- Automated Patching vs. Runtime Assurance: Automated patching statically modifies source code or binary dependencies to eliminate a known vulnerability, permanently altering the software21. Runtime assurance (RTA) does not alter the underlying code; instead, it utilizes a Simplex architecture to monitor an unverified, complex primary controller. If the primary controller's actions near an unsafe state, a pre-verified safety controller (the "safety envelope") preempts it to ensure the cyber-physical system remains within defined operational bounds4.
- Causal Response vs. Zero-Trust Enforcement: Causal response frameworks, such as the Causal Multi-Agent Decision Framework (C-MADF), utilize Structural Causal Models (SCMs) to identify the root cause of an anomaly. They execute responses intended to disrupt the specific causal chain of the attack rather than merely treating symptoms5. Zero-Trust Architecture (ZTA) enforcement, governed by NIST SP 800-207A, ignores causality; it continuously evaluates signals at a Policy Decision Point (PDP) and strictly limits access via a Policy Enforcement Point (PEP), ensuring that implicit trust is never granted regardless of the attack's origin28.
4. Current Standards, Law, Policy, and Deployed Practice
(Label: policy proposal) Autonomous active defense must navigate the complex, often unresolved strata of international law governing state behavior in cyberspace. Without human intervention, mathematical constraints must perfectly mirror legal thresholds to prevent unauthorized escalation.
The Sovereignty Debate and the Tallinn Manual
(Label: disputed claim) The Tallinn Manual 2.0 acknowledges significant international debate regarding the threshold of sovereignty violation in cyberspace6. While non-de minimis physical damage or human injury caused by a cyber operation clearly violates sovereignty and potentially invokes UN Charter Article 51 (armed attack), a vast "grey zone" exists below this threshold17. Operations causing temporary computer dysfunctionality, data manipulation, or the usurpation of inherent government functions (e.g., election interference) remain contested6. Some states, such as France, have explicitly argued that any cyberattack by a foreign state against its digital systems constitutes a sovereignty violation, whereas others adopt a more restrictive view requiring permanent loss of functionality6.
Countermeasures and ARSIWA Article 52
(Label: established standard or law) Under the Articles on State Responsibility (ARSIWA), countermeasures allow an injured State to breach a legal obligation to induce a responsible State to cease wrongful conduct7. However, ARSIWA Article 52 generally requires the injured State to notify the responsible State of its decision to take countermeasures15. (Label: current official policy) In the context of cyber operations, strict adherence to Article 52 is highly contested. Several states, notably the United Kingdom, assert that there is no absolute legal obligation to provide prior notification before taking cyber countermeasures, arguing that notification would expose sensitive capabilities and negate the countermeasure's efficacy7. Autonomous systems executing state-sponsored countermeasures must be programmed to recognize whether they are operating under a strict ARSIWA interpretation or an urgent, non-notified exemption7.
Distinction: Defense, Hunt-Forward, Countermeasure, and Offensive Effect
(Label: reasoned inference) An autonomous system's action catalog must distinctly map to legal definitions:
1. Defense: Passive or reactive shielding occurring within owned networks (e.g., blocking an IP). Universally lawful.
2. Hunt-Forward: Authorized by 10 U.S.C. 394, these operations involve U.S. Cyber Command operators deploying to partner networks with consent to identify threats10. This is distinct from countermeasures as it relies on host-nation authority.
3. Active Defense: A broad term encompassing internal deception and MTD, but occasionally misconstrued as "hack-back." If active defense crosses into third-party or adversary infrastructure, it must be legally justified as a countermeasure17.
4. Countermeasure: Must be directed at the responsible State, must be proportionate, and must cease when the wrongful act ends7.
5. Offensive Effect / Use of Force: Any operation resulting in physical destruction or injury. ARSIWA Article 50 explicitly prohibits the use of force in countermeasures7. Autonomous systems must never execute actions capable of crossing this threshold unless operating under the distinct legal authority of self-defense during an armed conflict.
5. Architecture and Data Models
(Label: technical proposal) To ensure autonomous systems do not cause cascading failures or exceed their legal mandates, authority, attribution, necessity, proportionality, purpose, and cessation must be represented in machine-readable form.
Machine-Readable Governance
- Authority and Purpose: Authority is codified using OASIS CACAO (Collaborative Automated Course of Action Operations) JSON-based playbooks33. These playbooks map organizational authority to specific threat conditions and utilize the Open Command and Control (OpenC2) language to issue precise, technology-agnostic commands (e.g., deny, contain, update) targeting specific assets35. Purpose is defined by the Actuator Profiles formatted in JSON Abstract Data Notation (JADN), ensuring that an autonomous agent only executes commands relevant to its assigned cyber defense function35.
- Attribution: Attribution is mathematically modeled using Structural Causal Models (SCMs) and Directed Acyclic Graphs (DAGs) within the C-MADF framework. By establishing causal relationships rather than mere correlations, the system mathematically scores the probability that a specific adversary infrastructure is responsible for an intrusion5.
- Necessity and Proportionality: These legal concepts are translated into engineering constraints using Linear Temporal Logic (LTL) and Neural Barrier Functions (NBFs). Necessity is proven if the LTL formula indicates an imminent violation of a critical safety state37. Proportionality is enforced by limiting the autonomous agent's "action catalog" to a defined blast radius, ensuring the operational cost of the defense does not exceed the projected impact of the attack1.
- Cessation: Represented via continuous feedback loops validating telemetry decay. Once the SCM confirms the causal indicators of the attack are no longer present, the OpenC2 orchestrator automatically issues reversion commands to lift reversible countermeasures7.
Functioning Under Communications Denial
(Label: observed deployment or practice) In highly contested environments, adversarial action may sever communication between the central SOAR/PDP and the local enforcement agents. Under communications denial, autonomous systems cannot "invent" authority4. Instead, they rely on a localized Simplex architecture. When connection is lost, the agent defaults to a pre-verified, immutable "Cyber Safe Mode" (CSM) policy23. CSM permits only strictly reversible, localized containment actions (e.g., severing external network interfaces or isolating specific memory processes) that maintain the physical safety envelope of the operational technology (OT) without executing complex or irreversible countermeasures23.
6. Failure Modes and Adversarial Cases
(Label: scenario) Autonomous systems must account for edge cases where the operating environment is intentionally corrupted by an adversary to provoke disproportionate or self-destructive responses.
60 Synthetic Scenarios for Autonomous Cyber Defense Testing
To robustly test runtime assurance and causal response systems, the following scenarios model complex edge cases across five critical vectors.
| ID | Scenario Category | Context / Attack Vector | Required Autonomous Constraint / Machine Action |
|---|---|---|---|
| 1 | False Attribution | Adversary spoofs an allied nation's IP to trigger a retaliatory block. | Defer blocking; require multi-factor telemetry verification (e.g., TCP handshake completion). |
| 2 | False Attribution | BGP hijack maliciously routes C2 traffic through a neutral hospital network. | Prohibit upstream infrastructure targeting; apply only local ingress containment. |
| 3 | False Attribution | Malware payload contains Russian metadata but originates from a local VPS. | Restrict response to endpoint isolation; suppress attribution-based playbooks. |
| 4 | False Attribution | Adversary uses a TOR exit node matching a key vendor's subnet. | Sandbox traffic; do not sever the B2B API without human-in-the-loop authorization. |
| 5 | False Attribution | SYN flood utilizing spoofed internal DNS server IPs. | Implement stateful inspection; bypass standard rate-limiting of internal DNS infrastructure. |
| 6 | False Attribution | Deepfake audio attempts to authorize an irreversible OpenC2 command. | Reject request; rely strictly on cryptographic identity verification (mTLS/DPoP JWT). |
| 7 | False Attribution | Logs injected with fake indicators of compromise (IoCs) belonging to a partner. | Correlate SIEM logs with physical network flow data before triggering a playbook. |
| 8 | False Attribution | Attacker replays historical nation-state attack patterns to misdirect defense. | Run causal inference (C-MADF); flag temporal inconsistencies and pause attribution. |
| 9 | False Attribution | Compromised threat intel feed pushes a benign critical IP as malicious. | Cross-reference with an immutable internal baseline; auto-whitelist critical infrastructure. |
| 10 | False Attribution | Deceptive beaconing directed to a widely used public cloud service (e.g., AWS). | Block specific tenant URIs or SNI headers, not the entire cloud provider ASN. |
| 11 | False Attribution | Adversary manipulates LLM prompt to classify a sysadmin as a threat actor. | Ground LLM decisions in deterministic Identity and Access Management (IAM) rule sets. |
| 12 | False Attribution | Phishing email mimics an automated threat alert from CISA to trigger panic. | Verify digital signatures of incoming threat feeds before automated processing. |
| 13 | Compromised Authority | Threat actor steals the API key for the OpenC2 orchestrator. | Require mutual TLS (mTLS) and proof-of-possession tokens for all command issuance. |
| 14 | Compromised Authority | Insider threat modifies a CACAO playbook to ignore data exfiltration. | Enforce cryptographic hashing and CI/CD pipeline signatures on all playbooks. |
| 15 | Compromised Authority | Attacker compromises the primary identity provider (IdP). | Trigger Cyber Safe Mode; fallback to local, immutable break-glass authentication. |
| 16 | Compromised Authority | Adversarial injection into the SOAR platform attempts wide-scale disruption. | Execute commands only within the mathematically verified Simplex safety envelope. |
| 17 | Compromised Authority | Malware escalates privileges to the system-level defense agent. | Hardware-based root of trust prevents unauthorized modification of the agent binary. |
| 18 | Compromised Authority | Attacker revokes the defense agent's access to the central SIEM. | Agent defaults to localized, aggressive containment (fail-secure posture). |
| 19 | Compromised Authority | Compromised executive account orders an enterprise-wide data wipe. | Enforce M-of-N cryptographic consensus logic for all irreversible actions. |
| 20 | Compromised Authority | Attacker modifies the ZTA Policy Decision Point access rules. | Detect configuration drift via hashing; immediately revert to a known-good immutable state. |
| 21 | Compromised Authority | Rogue IoT device assumes a network controller role via protocol spoofing. | Enforce strict network micro-segmentation and rigid behavioral profiling. |
| 22 | Compromised Authority | Supply chain attack on the autonomous defense engine's software update. | Verify Software Bill of Materials (SBOM) and detached signatures before installation. |
| 23 | Compromised Authority | Attacker disables logging mechanisms to blind the SOAR system. | Initiate automated alerts on log-loss and isolate the affected subnet. |
| 24 | Compromised Authority | Adversary uses a legitimate VPN tunnel to bypass geo-blocking policies. | Implement continuous authentication based on behavioral biometrics and context. |
| 25 | Stale Evidence | Playbook triggers based on a 48-hour old transient IP address. | Enforce Time-to-Live (TTL) checks on all threat intelligence; abort action if expired. |
| 26 | Stale Evidence | Delayed network log arrives after a DHCP lease was reassigned to a benign user. | Correlate MAC addresses and host IDs, not just transient IPv4 addresses. |
| 27 | Stale Evidence | Memory dump analysis completes after the malicious process has terminated. | Preserve the forensic artifact (RFC 3227); do not target the reused PID for termination. |
| 28 | Stale Evidence | Threat feed lists a sinkholed domain as an active adversary C2 node. | Check current WHOIS/DNS resolution state before initiating a network block. |
| 29 | Stale Evidence | Old vulnerability scan triggers an unneeded emergency patch during peak hours. | Query the real-time runtime state before applying the conditionally reversible patch. |
| 30 | Stale Evidence | LLM agent hallucinates past network state as the current operational reality. | Ground the agent in a real-time context window via a continuously updated graph database. |
| 31 | Stale Evidence | Revoked certificate is cached as valid by the autonomous defense agent. | Force real-time OCSP stapling checks before executing any trust-based commands. |
| 32 | Stale Evidence | Automated firewall rule applies to an employee who recently changed roles. | Sync OpenC2 policy actions dynamically with HR and IAM databases. |
| 33 | Stale Evidence | Delayed telemetry causes out-of-order event reconstruction by the CRS. | Enforce strict timestamping and vector clocks in event processing algorithms. |
| 34 | Stale Evidence | Threat hunting tool flags a backdoor that was remediated a month prior. | Check the remediation ledger before issuing redundant alerts or actions. |
| 35 | Stale Evidence | Old cloud container image is flagged after the physical container is destroyed. | Ignore active mitigation action; log the event purely for historical auditing. |
| 36 | Stale Evidence | CTI report indicates a threat that has subsequently self-deleted from the network. | Verify file hash existence on disk before attempting quarantine procedures. |
| 37 | Third-Party Infrastructure | Attacker uses a shared SaaS platform (e.g., SharePoint) for data exfiltration. | Restrict API tenant access rather than blocking the entire SaaS IP block. |
| 38 | Third-Party Infrastructure | Malicious traffic originates from an unpatched, integrated vendor appliance. | Isolate the vendor VLAN; notify the vendor per CISA CPG guidelines. |
| 39 | Third-Party Infrastructure | Adversary leverages a public DNS resolver (e.g., 8.8.8.8) for tunneling. | Block specific DNS query strings via Deep Packet Inspection (DPI), not the global resolver. |
| 40 | Third-Party Infrastructure | C2 traffic is routed through an allied nation's primary ISP. | Do not execute active countermeasures; rely exclusively on local ingress blocking. |
| 41 | Third-Party Infrastructure | Attacker compromises a shared physical network switch in a colocation facility. | Utilize micro-segmentation at the hypervisor level to bypass the physical switch entirely. |
| 42 | Third-Party Infrastructure | Threat actor pivots through a public university network. | Classify as civilian infrastructure; prohibit any outward-facing disruption or retaliation. |
| 43 | Third-Party Infrastructure | Autonomous agent tracks exfiltrated data to a foreign sovereign cloud provider. | Halt tracking at sovereign borders to avoid violating international non-intervention laws. |
| 44 | Third-Party Infrastructure | Adversary leverages an industrial partner's Active Directory trust relationship. | Sever the AD trust autonomously; initiate out-of-band notification to the partner. |
| 45 | Third-Party Infrastructure | Content Delivery Network (CDN) edge node is compromised and serving malware. | Block the specific URI path; do not block the entire CDN edge node to preserve benign traffic. |
| 46 | Third-Party Infrastructure | Ransomware uses a public blockchain to manage encryption keys. | Block API calls to the blockchain ledger; do not attempt ledger disruption. |
| 47 | Third-Party Infrastructure | Attacker uses a legitimate GitHub repository to host malicious payloads. | Block access to the specific repository URL; do not blacklist GitHub entirely. |
| 48 | Third-Party Infrastructure | A primary supplier's telemetry feed is poisoned by an adversary. | Utilize multi-source validation and quorum logic before ingesting supplier data. |
| 49 | Collateral Risk | Isolating a compromised server will simultaneously shut down a hospital wing. | Fail to human-in-the-loop; apply strict physical safety override to maintain operations. |
| 50 | Collateral Risk | Patching an OT controller will cause a chemical centrifuge to desync. | Block the automated patch; execute a compensating control (e.g., network isolation) instead. |
| 51 | Collateral Risk | Blocking a malicious domain inadvertently blocks a critical emergency service API. | Maintain a whitelist of mission-essential functions; bypass the block for critical API routes. |
| 52 | Collateral Risk | Zero-trust enforcement cuts off backup data center replication during an attack. | Ensure the out-of-band management network retains heartbeat and replication access. |
| 53 | Collateral Risk | Active defense tool generates massive scanning traffic, causing a self-DDoS. | Implement strict rate-limiting and bandwidth caps on automated response tools. |
| 54 | Collateral Risk | Deleting compromised credentials locks out the CEO during an incident response crisis. | Issue a temporary, restricted-access token while resetting the primary credentials. |
| 55 | Collateral Risk | Honeypot accidentally provides an attacker with a pivot point into the production network. | Deploy honeypots strictly on physically or cryptographically isolated infrastructure. |
| 56 | Collateral Risk | Autonomous agent revokes certificates for a critical manufacturing pipeline. | Enforce "graceful degradation" policies for manufacturing systems to allow safe spin-down. |
| 57 | Collateral Risk | Quarantining a malware strain encrypts critical evidence needed for law enforcement. | Preserve state via a memory snapshot before executing the quarantine action. |
| 58 | Collateral Risk | Disabling a compromised AD controller causes a domain-wide authentication collapse. | Ensure secondary/tertiary controllers are verified clean before isolating the primary. |
| 59 | Collateral Risk | Automated response misidentifies an ICS safety shutdown signal as a cyberattack and overrides it. | Simplex safety controller physically prevents overriding safety instrumentation signals. |
| 60 | Collateral Risk | Countermeasure targets an attacker's IP, which is a dynamic IP reassigned to a civilian. | Strictly prohibit autonomous offensive countermeasures outside the network perimeter. |
7. Evidence and Currentness Requirements
(Label: peer-reviewed research finding) Autonomous action is fundamentally bounded by the quality and freshness of the evidence utilized by the PDP. Extrapolating from the traditional digital forensics order of volatility (RFC 3227\)12, AI-driven systems and autonomous defenders operate on a highly compressed timescale that necessitates automated forensic preservation prior to containment. An AI system's order of volatility dictates what must be preserved automatically before an autonomous agent terminates a process:
1. Accelerator memory: GPU/TPU activations and in-flight inference states (highly ephemeral)12.
2. Assembled context window: Full prompts and system prompts presented to the model at inference12.
3. In-flight network/tool call I/O: Requests, responses, and outbound tool invocations12.
4. Host memory and orchestration runtime state: Serving process and agent framework state12.
5. Serving and inference logs: Routing decisions and framework traces12.
6. RAG and vector store state: Retrieval corpus embeddings12.
7. Model checkpoints and weights: Trained parameters (highly stable)12.
(Label: reasoned inference) To mitigate attribution uncertainty, the system must utilize a Structural Causal Model to trace an anomaly backward through the Directed Acyclic Graph (DAG) of system telemetry5. If the causal chain relies on stale evidence (e.g., a DHCP lease older than five minutes, or threat intelligence past its TTL), the autonomous agent must mathematically downgrade its confidence score and restrict its action catalog strictly to reversible actions, preventing unwarranted operational disruptions.
8. Operational and Institutional Implications
(Label: institutional analysis) Autonomous systems inherently risk causing greater harm than the attack itself if permitted to execute broad, unbounded commands. To mitigate this, operational policies must mandate "degradation constraints." Using a Council of Rivals design (as seen in C-MADF), a threat-optimizing Blue-Team policy is continually checked by a conservatively shaped Red-Team policy5. Inter-policy disagreement is quantified via a Policy Divergence Score5. If the score indicates high uncertainty, the system defaults to a fail-safe (e.g., transitioning to a minimal risk condition) or fail-degraded state, explicitly pausing irreversible containment to allow human-in-the-loop intervention, supported by an Explainability-Transparency Score (ETS)5.
9. Public-Versus-Protected Information Boundary
(Label: established standard or law) Threat intelligence sharing is a central tenet of the Integrated Adaptive Cyber Defense (IACD) framework, designed to break adversarial agility by sharing Indicators of Compromise (IoCs) across communities of trust42. However, autonomous dissemination of incident data risks breaching domestic privacy frameworks. Under statutes like the Illinois Personal Information Protection Act (815 ILCS 530), the unauthorized access or disclosure of personal data elements necessitates expedient notification44. Autonomous agents must be engineered to cryptographically strip, hash, or synthesize artifacts (e.g., memory dumps containing PII or proprietary OT schematics) before sharing IoCs to public or inter-agency clearinghouses, ensuring the preservation of the public-versus-protected boundary.
10. Implementation Roadmap
(Label: technical proposal)
Implementation Assurance Model
The deployment of autonomous defense requires an assurance model combining offline formal synthesis and online enforcement to guarantee safety39.
1. Design-Time Synthesis: Formalize system safety requirements and physical constraints using Signal Temporal Logic (STL) to create a provable mathematical safety envelope.
2. Policy Compilation: Map operational constraints, legal authorities, and business rules into an OASIS CACAO playbook and an OpenC2 Actuator Profile.
3. Runtime Monitoring: Deploy the Simplex architecture. The primary controller (the autonomous agent or LLM) operates freely to detect and respond to threats within the bounds of the STL rules.
4. Preemption: If an action generated by the agent approaches the boundary of safe operation (the blast radius), the runtime monitor halts the agent and enforces a deterministic safe fallback.
Authority-to-Action Matrix (40 Action Classes)
(Label: observed deployment or practice) The following matrix maps 40 distinct defensive actions to their OpenC2 semantic targets, their reversibility classification, and the requisite authority and attribution confidence required for autonomous execution.
| ID | Action Class | OpenC2 Action & Target | Reversibility | Required Authority | Attribution Confidence |
|---|---|---|---|---|---|
| 1 | Network Isolate | deny ipv4\_connection | Reversible | Local Agent | Medium |
| 2 | Port Block | deny tcp\_port | Reversible | Local Agent | Low |
| 3 | Route Nulling | update routing\_table | Conditionally Reversible | Network Admin | High |
| 4 | DPI Filtering | allow deep\_packet\_inspection | Reversible | Local Agent | Medium |
| 5 | Sinkhole DNS | update dns\_record | Reversible | Network Admin | Medium |
| 6 | Throttling | update bandwidth\_limit | Reversible | Local Agent | Low |
| 7 | VPN Disconnect | update vpn\_session | Reversible | Local Agent | Low |
| 8 | BGP Withdraw | delete bgp\_route | Conditionally Reversible | Tier 1 Gateway | High |
| 9 | MAC Ban | deny mac\_address | Reversible | Local Agent | Medium |
| 10 | Honeypot Route | update network\_flow | Conditionally Reversible | SOC Analyst | High |
| 11 | Process Kill | deny process | Reversible | Endpoint Agent | Medium |
| 12 | Memory Dump | investigate memory | Reversible | Forensic Agent | Low |
| 13 | Service Stop | update windows\_service | Conditionally Reversible | Endpoint Agent | Medium |
| 14 | Sandbox Exec | allow sandbox | Reversible | Endpoint Agent | Low |
| 15 | File Quarantine | deny file\_hash | Reversible | Endpoint Agent | Medium |
| 16 | Registry Lock | update registry\_key | Conditionally Reversible | Domain Admin | High |
| 17 | Firmware Flash | update firmware | Irreversible | Human-in-Loop | Absolute |
| 18 | Wipe Disk | delete volume | Irreversible | Human-in-Loop | Absolute |
| 19 | Disable USB | update peripheral | Reversible | Endpoint Agent | Low |
| 20 | Safe Mode Boot | update boot\_state | Conditionally Reversible | Sysadmin | High |
| 21 | Revoke Token | delete jwt\_token | Reversible | IAM Controller | Medium |
| 22 | Reset Password | update user\_credential | Conditionally Reversible | IAM Controller | High |
| 23 | Force MFA | update auth\_policy | Reversible | IAM Controller | Low |
| 24 | Disable Account | deny user\_account | Reversible | IAM Controller | Medium |
| 25 | Sever AD Trust | delete domain\_trust | Conditionally Reversible | Enterprise Admin | High |
| 26 | Expire Cert | delete x509\_cert | Conditionally Reversible | PKI Admin | High |
| 27 | Step-up Auth | investigate user\_auth | Reversible | IAM Controller | Low |
| 28 | Lock Admin | deny privileged\_role | Conditionally Reversible | Enterprise Admin | High |
| 29 | Clear Sessions | delete http\_cookie | Reversible | Web Gateway | Medium |
| 30 | Biometric Re-auth | investigate bio\_signal | Reversible | IAM Controller | Medium |
| 31 | Workload Migrate | update vm\_state | Conditionally Reversible | Orchestrator | High |
| 32 | Pause Container | update docker\_container | Reversible | Orchestrator | Medium |
| 33 | Destroy Pod | delete k8s\_pod | Conditionally Reversible | Orchestrator | Medium |
| 34 | Snapshot Data | investigate volume | Reversible | Storage Controller | Low |
| 35 | Encrypt Volume | update crypto\_key | Conditionally Reversible | Sysadmin | High |
| 36 | Halt Database | deny sql\_service | Conditionally Reversible | DBA/Sysadmin | High |
| 37 | Purge Cache | delete cache\_memory | Reversible | App Server | Low |
| 38 | Isolate App | deny microservice | Reversible | Orchestrator | Medium |
| 39 | Revert Config | update config\_file | Conditionally Reversible | GitOps Pipeline | High |
| 40 | Beacon Intercept | investigate c2\_traffic | Reversible | Network Agent | Low |
11. Test and Assurance Plan
(Label: institutional analysis) Assurance relies on continuous, dynamic validation against adversarial inputs. Static compliance checks are insufficient for autonomous systems. Validation must utilize tabletop exercises and digital twins of the OT and IT environments to rehearse multi-stage attacks47. Specifically, testing must focus on multi-turn "jailbreaks" and context drift, verifying that Neural Barrier Functions (NBFs) and Simplex architectures consistently intercept harmful behavior across prolonged temporal engagements without causing operational degradation or triggering catastrophic fail-secure states unnecessarily37.
12. Open Research Questions
(Label: hypothesis) The integration of Neuro-Symbolic AI into cyber defense architectures poses several unresolved questions regarding standardizing deterministic behavior, instructing multi-agent systems, and establishing community-driven benchmarks48. To frame these inquiries, the following constructs are provided.
30 Direct-Answer Items on Autonomous Defense
| \# | Question | Direct Answer |
|---|---|---|
| 1 | Can a private entity hack back legally? | No, unauthorized offensive operations violate domestic and international law18. |
| 2 | What defines active defense? | Defensive maneuvers short of a use of force that seek to detect, deceive, or mitigate threats, usually inside the network17. |
| 3 | What is a Hunt-Forward operation? | A consent-based, outward-facing defensive mission conducted by military/state cyber forces on a partner's infrastructure10. |
| 4 | Do countermeasures require an armed attack? | No, countermeasures are responses to any internationally wrongful act, not strictly armed attacks14. |
| 5 | Is notification required for cyber countermeasures? | Legally contested; ARSIWA Article 52 requires it, but state practice increasingly rejects it for covert cyber ops15. |
| 6 | What makes an action irreversible? | The inability to restore the previous operational state without manual reconstruction or hardware replacement9. |
| 7 | How does OpenC2 standardize actions? | By providing a technology-agnostic language specifying a standard action (e.g., deny) and target (e.g., ipv4\_connection)36. |
| 8 | What is an SCM? | A Structural Causal Model, used to infer the root cause of an event rather than relying solely on statistical correlation5. |
| 9 | What is a Simplex architecture? | A safety mechanism pairing an unverified complex controller with a pre-verified safety controller to guarantee bounds4. |
| 10 | Why is evidence freshness critical? | Blocking stale IPs/MACs can disrupt legitimate services and allow attackers to evade detection by rotating infrastructure5. |
| 11 | What is the first step in RFC 3227? | Collect the most volatile evidence first (e.g., CPU registers, RAM) before preserving long-term disks12. |
| 12 | Can autonomous agents authorize themselves? | No, they must rely on cryptographically bound identity, such as mTLS or DPoP-bound JWTs51. |
| 13 | What is IACD? | Integrated Adaptive Cyber Defense, a framework prioritizing orchestration, automation, and information sharing2. |
| 14 | How is necessity defined in countermeasures? | The action must be the only means to safeguard an essential interest against a grave and imminent peril16. |
| 15 | What is zero-trust enforcement? | Eliminating implicit trust; continuously validating every access request at a Policy Enforcement Point28. |
| 16 | How does deception differ from MTD? | Deception lures attackers to fake assets; Moving-Target Defense shifts the real assets continuously to avoid detection22. |
| 17 | What is CACAO? | A JSON-based schema for cybersecurity playbooks maintained by the OASIS framework33. |
| 18 | Can countermeasures be disproportionate? | No, ARSIWA requires them to be commensurate with the injury suffered7. |
| 19 | What role does JADN play? | JSON Abstract Data Notation is used to model the complex information structure of OpenC2 profiles35. |
| 20 | What is Cyber Safe Mode? | A fallback state that strips unverified processes to preserve core physical system authority during an attack23. |
| 21 | How do LLM agents pose a security risk? | Non-compositional risks allow individually safe agents to interact and create emergent, unsafe systemic behaviors3. |
| 22 | What is an indicator of compromise (IoC)? | A forensic artifact, such as a file hash or malicious IP, identifying unauthorized activity55. |
| 23 | What is a Policy Divergence Score? | A metric quantifying the disagreement between threat-optimizing and conservative AI models in a Council of Rivals5. |
| 24 | How is proportionality judged? | It is assessed against the gravity of the internationally wrongful act and the specific rights in question7. |
| 25 | Can AI orchestrate defense across multi-agent environments? | Yes, via frameworks like ORCH which utilize deterministic coordination for discrete reasoning and EMA-guided routing25. |
| 26 | What is the most volatile AI system evidence? | Accelerator memory (e.g., GPU/TPU activations and in-flight inference states)12. |
| 27 | Do countermeasures permit the use of force? | No, ARSIWA strictly prohibits the threat or use of force in any countermeasure7. |
| 28 | What is a "hack-back"? | Unauthorized offensive retaliation by a private entity, universally condemned by state actors18. |
| 29 | What is the function of a ZTA Policy Decision Point? | To evaluate contextual signals continuously and determine if an access request should be granted28. |
| 30 | How does BGP hijacking affect automation? | It causes false attribution by maliciously routing C2 traffic through benign ASNs, potentially triggering misdirected counter-blocks. |
30 Page Concepts for Defensive Architecture
| \# | Architectural Concept | Description |
|---|---|---|
| 1 | Agentic Tool-Use Boundary | Constraining LLM responses to a finite, deterministic catalog of OpenC2 actions to prevent hallucinated commands. |
| 2 | Runtime Verification Envelopes | Continuous mathematical validation of system output against Signal Temporal Logic definitions. |
| 3 | Causal Dual-Policy Control | Using competing Red/Blue policies to generate a verifiable divergence score for escalation. |
| 4 | Cryptographic Playbook Provenance | Requiring detached signature verification for CACAO playbooks to prevent insider or supply-chain manipulation. |
| 5 | Deterministic Fallback (CSM) | Disabling advanced controllers in favor of hard-coded minimal risk states during severe compromise. |
| 6 | Volatility-Ordered Acquisition | Automating forensic snapshotting ordered strictly by hardware transience to preserve chain-of-custody. |
| 7 | Countermeasure Notification Exemption | The legal doctrine supporting unannounced retaliation to preserve capability secrecy. |
| 8 | Asynchronous Telemetry Reconciliation | Handling out-of-order logs using vector clocks to prevent temporal hallucination in AI agents. |
| 9 | Ephemeral Action Workflows | Defensive responses that self-terminate based on cryptographic TTLs to guarantee reversibility. |
| 10 | Stateful Deception Topologies | Decoy systems that maintain persistent behavioral illusions across multi-stage intrusions. |
| 11 | Non-Compositional Agent Evaluation | Auditing multi-agent defense swarms for emergent, unpredictable systemic behaviors. |
| 12 | Micro-Segmented PEPs | Distributing Zero-Trust Policy Enforcement Points directly to the hypervisor or container level. |
| 13 | Proof-of-Possession Automation | Enforcing cryptographic possession checks (e.g., DPoP) for autonomous agents issuing commands. |
| 14 | Cross-Domain Sovereign Boundaries | Geofencing autonomous tracking agents to prevent violations of foreign sovereignty during active defense. |
| 15 | Attribution-Agnostic Containment | Defaulting to internal network isolation when external attribution cannot meet the "clear and convincing" standard. |
| 16 | Dynamic Exploit Nullification (CRS) | Using binary rewriting to patch software vulnerabilities dynamically at machine speed. |
| 17 | Neural Barrier Functions | Mathematical safeguards preventing LLMs from suffering context drift during multi-turn attacks. |
| 18 | Human-on-the-loop Escalation | Permitting AI execution for reversible actions but requiring human approval for irreversible ones. |
| 19 | Adversarial Input Sanitization | Cleaning telemetry feeds of crafted adversarial perturbations before ingestion by the Structural Causal Model. |
| 20 | Out-of-Band Management Resilience | Guaranteeing physical or cryptographic isolation of the defense orchestrator's command channel. |
| 21 | Due Diligence Failure Attribution | Establishing state responsibility when a host nation fails to stop hackers originating from its territory. |
| 22 | Collateral Risk Quantification | Scoring the physical-world impact of a cyber defense action before execution. |
| 23 | Proportionality Matrixing | Aligning the severity of an automated response with the financial/operational impact of the intrusion. |
| 24 | Decentralized Threat Intelligence (AIS) | Utilizing machine-speed indicator sharing across industry ISACs to preempt attacks globally. |
| 25 | Hardware-Backed Root of Trust | Securing autonomous defense agents inside Trusted Execution Environments (TEEs) to prevent subversion. |
| 26 | Autonomous Compliance Auditing | Mapping automated defensive actions against CISA CPG and NIST SP 800-160 controls in real-time. |
| 27 | Semantic Interoperability (JADN) | Using standardized abstract syntax to allow dissimilar security tools to communicate natively. |
| 28 | Graceful Service Degradation | Designing infrastructure to lose non-essential functions safely while preserving critical OT paths. |
| 29 | Federated Identity Revocation | Automating the termination of compromised access tokens across multi-cloud environments simultaneously. |
| 30 | Cyber Kill Chain Disruption | Mapping autonomous responses directly to specific phases of adversary intrusion to break causal links. |
13. Contradiction Register
(Label: institutional analysis)
- Countermeasures and Notification: A primary contradiction exists in international law regarding countermeasures. ARSIWA Article 52 explicitly mandates that an injured state must notify the responsible state before implementing countermeasures and offer to negotiate7. However, modern state practice contradicts this formal requirement. The United Kingdom Attorney General has explicitly stated that prior notification in cyberspace defeats the operational viability of the countermeasure, arguing that covert cyber responses are exempt from Article 52's notification requirement17.
- Threshold of Sovereignty Violation: The Tallinn Manual 2.0 notes a fundamental lack of consensus on whether cyber operations that do not cause physical damage—but cause functional disruption or data manipulation—constitute a violation of sovereignty6.
- Private Active Defense: Some legal theorists and private sector entities argue for the necessity of accredited private-sector active defense (hack-back) due to law enforcement delays18. Conversely, established consensus (Tallinn Manual 2.0) and domestic statutes explicitly prohibit private entities from conducting offensive actions outside their networks17.
14. Claim-Status Table
| Label | Description / Application in Report |
|---|---|
| established standard or law | ARSIWA guidelines on countermeasures; UN Charter Article 51; NIST SP 800-160 Vol 2 and 800-207A; RFC 3227; Illinois PIPA 815 ILCS 530\. |
| current official policy | DoD US Cyber Command Hunt-Forward operations under 10 U.S.C. 394; UK stance on ARSIWA Article 52; CISA CPGs. |
| observed deployment or practice | Use of OASIS CACAO playbooks, JADN, and OpenC2 in SOAR platforms; IACD frameworks. |
| peer-reviewed research finding | AI volatility ordering; Causal Multi-Agent Decision Framework (C-MADF); Simplex logic; Non-compositional AI risks. |
| institutional analysis | Tallinn Manual 2.0 interpretations of grey-zone sovereignty violations; Comparisons of agentic systems vs. CRS. |
| reasoned inference | Deductions regarding the necessity of bounding autonomous agents with SCMs to prevent escalation. |
| technical proposal | Definitions of reversible vs. irreversible autonomous action limits; Neural Barrier Functions; Implementation Assurance Models. |
| policy proposal | Restricting autonomous action under communications denial to Cyber Safe Mode. |
| scenario | The 60 specific failure modes outlining adversarial context and appropriate defensive constraints. |
| hypothesis | Future capabilities of Neuro-Symbolic AI to provide deterministic, explainable autonomous defense. |
| disputed claim | The necessity of prior notification for cyber countermeasures (ARSIWA vs State practice). |
| unknown | Concrete global legal consensus on non-destructive data manipulation as a use of force. |
| unavailable | Exhaustive case law strictly defining "proportionality" in cyber-to-cyber automated countermeasures. |
| stale or superseded | Static, signature-based intrusion detection systems relying on human-in-the-loop response for millisecond-scale attacks. |
15. Source-Quality Table
| Source Material Profile | Attributes and Reliability |
|---|---|
| Primary Law & Statutes | 10 U.S.C. 394 (Military Cyber Operations)10; 815 ILCS 530 (Illinois PIPA)44. Highly authoritative, load-bearing for domestic legal compliance. |
| International Law Frameworks | Tallinn Manual 2.06; ARSIWA7. Foundational for sovereignty, intervention, and countermeasure analysis. Represents the consensus of international groups of experts. |
| Standards & Specifications | NIST SP 800-160 Vol 258; NIST SP 800-207A29; RFC 322712; OpenC2/JADN35. Authoritative for technical architecture and cyber resiliency. |
| Peer-Reviewed Research | IEEE/ACM/arXiv papers on Simplex architectures, C-MADF, and LLM constraints3. High technical validity; demonstrates the bleeding edge of autonomous defense capabilities. |
| Government/Military Doctrine | US Cyber Command Year in Review (Hunt Forward)11; CISA Cross-Sector Cybersecurity Performance Goals (CPGs)8. Definitive for current state practice and baseline expectations. |
| Institutional Reports | IACD framework (Johns Hopkins APL)2; OASIS CACAO33. Represents current state-of-the-art in automated orchestration and playbook modeling. |
(Research cutoff date: August 16, 2026\. Source retrieval verified up to cutoff).
16. Detailed Bibliography with Direct Links
(Label: observed deployment or practice) The following primary and authoritative secondary sources were utilized to construct this report, providing the foundation for the technical architectures, legal thresholds, and operational models discussed herein.
1. Unilateral Remedies to Cyber Operations: Countermeasures. Cambridge University Press.14.
2. Active Defense for Cyber: A Legal Framework for Covert Countermeasures. Tallinn Manual Analysis.30.
3. International Law as a Limit on Active Defense in Cyberspace. Hebrew University of Jerusalem, Cyber Security Research Center.17.
4. Sovereignty, Intervention, and Autonomous Cyber Capabilities. US Naval War College, International Law Studies.6.
5. Public and Private Just Wars: Distributed Cyber Deterrence. Policy Review.18.
6. Policy Cards: Machine-Readable Runtime Governance for Autonomous AI Agents. ResearchGate.64.
7. Cyber Reasoning System Architecture (DARPA Cyber Grand Challenge). IEEE / ResearchGate.21.
8. Autonomous Cyber Capabilities and International Law. Australian Army Research Centre.65.
9. Autonomous Cyber Defense Systems Against Generative AI-Based Attacks. ResearchGate.1.
10. Large Language Models for Cybersecurity: SecureFalcon and HackMentor. GitHub / arXiv.24.
11. Machine Learning and Cybersecurity. Center for Security and Emerging Technology (CSET).66.
12. NIST SP 800-82: Guide to Industrial Control Systems (ICS) Security. NIST.47.
13. Digital Forensics: ISO/IEC 27037 and RFC 3227 Guidelines. Cyooda / IETF.69.
14. An Order of Volatility for AI Systems. arXiv.12.
15. OASIS CACAO Security Playbooks. OASIS Open / University of Regensburg.33.
16. CACAO Ontology and Cyber Threat Intelligence. EU Cordis / PHOENI2X.34.
17. Illinois Personal Information Protection Act (815 ILCS 530\). Illinois General Assembly.44.
18. 10 U.S.C. 394: Authorities Concerning Military Cyber Operations. Office of the Law Revision Counsel (US Code).10.
19. US Cyber Command: Hunt Forward Operations. CYBERCOM Media.11.
20. Runtime Safety Assurance Methods for Cyber-Physical Systems (Simplex Architecture). ResearchGate.27.
21. Open Command and Control (OpenC2) Language and Architecture. OASIS OpenC2 TC.35.
22. Integrated Adaptive Cyber Defense (IACD). Johns Hopkins University Applied Physics Laboratory (JHU/APL).2.
23. Runtime Verification and Linear Temporal Logic for Autonomous Systems. ProQuest / arXiv.38.
24. Causal Multi-Agent Decision Framework (C-MADF). arXiv.5.
25. Formal Assurance and Monitoring Environment (FAME). arXiv.39.
26. Cyber Safe Mode Policy for Spacecraft and Cyber-Physical Systems. OSTI.23.
27. Structural Causal Models and Neuro-Symbolic AI in Cybersecurity. arXiv.48.
28. Non-Compositional Security Risks in Multi-Agent Systems. arXiv.3.
29. CISA Cross-Sector Cybersecurity Performance Goals (CPGs). Cybersecurity and Infrastructure Security Agency.8.
30. NIST SP 800-207A: A Zero Trust Architecture Model. NIST.28.
31. Beyond Self-Defense: Countermeasures in Cyberspace. Texas Law Review.16.
32. Countermeasures in International Law and their Role in Cyberspace. Chatham House.20.
33. NIST SP 800-160 Vol. 2: Developing Cyber-Resilient Systems. NIST.58.
Works cited
1. (PDF) Autonomous Cyber Defense Systems Against Generative AI-Based Attacks in the Dark Web \- ResearchGate, https://www.researchgate.net/publication/391331035\_Autonomous\_Cyber\_Defense\_Systems\_Against\_Generative\_AI-Based\_Attacks\_in\_the\_Dark\_Web
2. About IACD, https://www.iacdautomate.com/aboutiacd
3. Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents, https://arxiv.org/html/2505.02077v2
4. Run Time Assurance for Safety-Critical Systems \- Sam Coogan \- Georgia Tech, https://coogan.ece.gatech.edu/papers/pdf/hobbs2022csm.pdf
5. Explainable Autonomous Cyber Defense using Adversarial Multi-Agent Reinforcement Learning \- arXiv, https://arxiv.org/html/2604.04442v1
6. Autonomous Cyber Capabilities and the International Law of Sovereignty and Intervention \- U.S. Naval War College Digital Commons, https://digital-commons.usnwc.edu/cgi/viewcontent.cgi?article=2932\&context=ils
7. Countermeasures \- International cyber law: interactive toolkit, https://cyberlaw.ccdcoe.org/wiki/Countermeasures
8. Cross-Sector Cybersecurity Performance Goals (CPGs) \- CISA, https://www.cisa.gov/topics/cybersecurity-best-practices/cross-sector-cybersecurity-performance-goals-cpgs
9. Cloud Security Playbook Overview | PDF \- Scribd, https://www.scribd.com/document/854573670/Cloud-Security-Playbook-Vol-1
10. 10 USC 394: Authorities concerning military cyber operations, https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title10-section394\&num=0\&edition=prelim
11. “Committed Partners in Cyberspace”: Following cyberattack, US conducts first defensive Hunt Operation in Albania \- Cyber Command, https://www.cybercom.mil/Media/News/Article/3337717/committed-partners-in-cyberspace-following-cyberattack-us-conducts-first-defens/
12. AI Forensics Across White-, Grey-, and Black-Box Access: A Process Model and Research Agenda for Post-Incident Investigation of AI Systems \- arXiv, https://arxiv.org/html/2608.03520v1
13. intel-codex/Security/Analysis/sop-forensics-investigation.md at main \- GitHub, https://github.com/gl0bal01/intel-codex/blob/main/Security/Analysis/sop-forensics-investigation.md
14. Countermeasures (Chapter 5\) \- Unilateral Remedies to Cyber Operations, https://www.cambridge.org/core/books/unilateral-remedies-to-cyber-operations/countermeasures/DB80AFF82AD4FCB171C17031BE8D37A0
15. The lawfulness of countermeasures taken in response to a breach of provisional measures \- Oxford Academic, https://academic.oup.com/jids/article/17/3/idag033/8759956
16. Beyond Self-Defense and Countermeasures \- Texas Law Review, https://texaslawreview.org/beyond-self-defense-countermeasures/
17. International Law as a Limit on Active Defense in Cyberspace, https://csrcl.huji.ac.il/node/88308
18. Public and private just wars: distributed cyber deterrence based on Vitoria and Grotius, https://policyreview.info/articles/analysis/public-and-private-just-wars-distributed-cyber-deterrence-based-vitoria-and
19. An Accreditation Model for Private Sector Offensive Cyber Operations \- RUSI, https://my.rusi.org/resource/an-accreditation-model-for-private-sector-offensive-cyber-operations.html
20. Countermeasures in international law and their role in cyberspace \- Chatham House, https://www.chathamhouse.org/2024/05/countermeasures-international-law-and-their-role-cyberspace/02-conditions-taking
21. A League of Extraordinary Machines: The First Steps to Autonomous Cyber Reasoning Systems \- ISSISP 2017, https://issisp2017.github.io/assets/slides/Cyber\_Grand\_Challenge\_Talk\_V1\_Opt.pdf
22. An Adaptive Architecture for Cybersecurity Threat Intelligence: A Case Study on Kenyan Courts \- ResearchGate, https://www.researchgate.net/publication/399732033\_An\_Adaptive\_Architecture\_for\_Cybersecurity\_Threat\_Intelligence\_A\_Case\_Study\_on\_Kenyan\_Courts
23. DISCLAIMER This report was prepared as an account of work sponsored by an agency of the United States Government. Neither the Un \- OSTI.GOV, https://www.osti.gov/servlets/purl/3005460
24. Awesome-LLM4Cybersecurity/LITERATURES.md at main \- GitHub, https://github.com/tmylla/Awesome-LLM4Cybersecurity/blob/main/LITERATURES.md
25. Daily Papers \- Hugging Face, https://huggingface.co/papers?q=deterministic%20feedback
26. The International Journal on Advances in Security is published by IARIA. \- ResearchGate, https://www.researchgate.net/profile/Hans-Joachim\_Hof/publication/315784278\_International\_Journal\_on\_Advances\_in\_Security\_2016\_vol9\_nr\_34/links/58e49b530f7e9bbe9c94da41/International-Journal-on-Advances-in-Security-2016-vol9-nr-3-4.pdf
27. Runtime safety assurance methods for cyber physical systems based on simplex architecture \- ResearchGate, https://www.researchgate.net/publication/380747654\_Runtime\_safety\_assurance\_methods\_for\_cyber\_physical\_systems\_based\_on\_simplex\_architecture
28. Strengthening Zero Trust with Effective Policy Enforcement Points, https://pwnsentinel.org/where-zero-trust-actually-happens/
29. A Zero Trust Architecture Model for Access Control in Cloud-Native, https://tsapps.nist.gov/publication/get\_pdf.cfm?pub\_id=956524
30. Fake news, (dis)information and principle of non-intervention. \- The Cyber Defense Review, https://cyberdefensereview.army.mil/Portals/6/Documents/CyConUS18%20Conference%20Papers/Session4-Paper3.pdf
31. Autonomous cyber capabilities and the international law of sovereignty and intervention \- CentAUR, https://centaur.reading.ac.uk/94547/1/Sovereignty%20Intervention%20and%20Autonomous%20Cyber%20Capabilities.pdf
32. Adverse Cyber Operations: Causality, Attribution, Evidence, and Due Diligence \- U.S. Naval War College Digital Commons, https://digital-commons.usnwc.edu/cgi/viewcontent.cgi?article=2913\&context=ils
33. Dissertation \- Publikationsserver der Universität Regensburg, https://epub.uni-regensburg.de/52399/1/Dissertation\_Vielberth\_Manfred.pdf
34. HORIZON EUROPE PROGRAMME HORIZON-CL3-2021-CS-01-01 \- European Commission, https://ec.europa.eu/research/participants/documents/downloadPublic?documentIds=080166e51eba33c9\&appId=PPGMS
35. Information Modeling: JADN and OpenC2 \- GitHub, https://github.com/oasis-tcs/openc2-tc-ops/blob/main/JADN-and-OpenC2.md
36. A Nonproprietary Language for the Command and Control of Cyber Defenses \- OpenC2, https://www.researchgate.net/publication/343535399\_A\_Nonproprietary\_Language\_for\_the\_Command\_and\_Control\_of\_Cyber\_Defenses\_-\_OpenC2
37. Publications \- Intelligent Control Lab \- Carnegie Mellon University, https://icontrol.ri.cmu.edu/publication
38. Predictive Runtime Monitoring for Safe Autonomy \- ProQuest, https://search.proquest.com/openview/0049489d991e5a67269e19ec72e40a4c/1?pq-origsite=gscholar\&cbl=18750\&diss=y
39. Taming Silent Failures: A Framework for Verifiable AI Reliability \- arXiv, https://arxiv.org/html/2510.22224v1
40. openc2-ia-considerations-v1.0-wip \- Google Docs, https://docs.google.com/document/d/1lmN9EQGUaj-HdpJFFtdonpHgcukImB3bnf9s0AV1u0U/edit
41. AI Forensics Across White-, Grey-, and Black-Box Access \- arXiv, https://arxiv.org/pdf/2608.03520
42. FAQs \- IACD, https://www.iacdautomate.com/faqs
43. IACD and the Quest for an Orchestrated Cyber Defense | by OWN Team \- Medium, https://medium.com/@OWN\_team/iacd-and-the-quest-for-an-orchestrated-cyber-defense-8f78324ddc7b
44. Illinois Data Destruction & E-Waste Compliance Guide 2025, https://datadestruction.com/compliance/state-laws/illinois/
45. Ransomware Protection for Small Business | Illinois Guide 2026 \- Future Link IT, https://futurelinkit.com/ransomware-protection-small-business/
46. Data Privacy and Cyber Liability: What You Don't Know Puts Your Mission at Risk, https://nonprofitrisk.org/resources/data-privacy-and-cyber-liability-what-you-dont-know-puts-your-mission-at-risk/
47. Cyber security of OT networks: A tutorial and survey \- arXiv, https://arxiv.org/html/2502.14017v2
48. Neuro-Symbolic AI for Cybersecurity: State of the Art, Challenges, and Opportunities \- arXiv, https://arxiv.org/pdf/2509.06921
49. Neuro-Symbolic AI for Cybersecurity: State of the Art, Challenges, and Opportunities \- arXiv, https://arxiv.org/html/2509.06921v2
50. Extending OpenC2 for the Unified Control of Modern Security Functions \- WebThesis, https://webthesis.biblio.polito.it/39720/1/tesi.pdf
51. NLIP Security Guidelines and Best Practices \- GitHub, https://github.com/nlip-project/security\_guidelines
52. Design and Implementation of an Authentication and Authorization Framework for OpenC2 \- WebThesis, https://webthesis.biblio.polito.it/38712/1/tesi.pdf
53. Zero Trust Guidance for Achieving Operational Resilience \- Cloud Security Alliance (CSA), https://cloudsecurityalliance.org/artifacts/zero-trust-guidance-for-achieving-operational-resilience
54. Attribution and Other Conditions of Lawful Countermeasures to Cyber Misconduct \- NDLScholarship, https://scholarship.law.nd.edu/cgi/viewcontent.cgi?article=2453\&context=law\_faculty\_scholarship
55. Formats and Protocols \- Critical Sectors Community, India, https://cscin.org.in/docs/frameworks/protocols/index.html
56. 10 USC Ch. 19: CYBER AND INFORMATION OPERATIONS MATTERS, https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title10-chapter19\&edition=prelim
57. Illinois General Assembly \- Full Text of SB3890, https://www.ilga.gov/Legislation/BillStatus/FullText?GAID=18\&DocNum=3890\&DocTypeID=SB\&LegId=0\&SessionID=114
58. Draft NIST SP 800-160 Vol. 2 Rev. 1, Developing Cyber-Resilient Systems \- CSRC, https://csrc.nist.rip/external/nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-160v2r1-draft.pdf
59. Developing Cyber-Resilient Systems \- CSRC, https://csrc.nist.rip/external/nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-160v2r1.pdf
60. U.S. Cyber Command 2022 Year in Review, https://www.cybercom.mil/Media/News/Article/3256645/us-cyber-command-2022-year-in-review/
61. CISA updates cybersecurity benchmarks for critical infrastructure organizations, https://www.cybersecuritydive.com/news/cisa-cybersecurity-performance-goals-update/807766/
62. Cybersecurity | Johns Hopkins University Applied Physics Laboratory, https://www.jhuapl.edu/work/impact/cybersecurity
63. legal regulation of cyber warfare: reviewing the contribution of the tallinn manual to the advancement of international law, https://open.uct.ac.za/bitstreams/b8878d96-7b4f-4ba6-a17b-dbcdb42d04da/download
64. Policy Cards: Machine-Readable Runtime Governance for Autonomous AI Agents, https://www.researchgate.net/publication/397007270\_Policy\_Cards\_Machine-Readable\_Runtime\_Governance\_for\_Autonomous\_AI\_Agents
65. Autonomous Cyber Capabilities and International Law on the Use of Force, Self-Defence, Intervention, and Sovereignty \- Australian Army Research Centre, https://researchcentre.army.gov.au/library/occasional-papers/autonomous-cyber-capabilities-and-international-law-use-force-self-defence-intervention-and-sovereignty
66. Machine Learning and Cybersecurity \- CSET, https://cset.georgetown.edu/wp-content/uploads/Machine-Learning-and-Cybersecurity.pdf
67. Category Attachment \- SWS System Admininstration, https://sws.gsa.gov/sws-search/viewSolDocument.do?method=view\&solNum=NDdRU01EMjBSMDAwMQ==\&solRefresh=MzI=\&solDoc=MDkwMDI5YjQ4ZTMwMjU1MA==
68. NIST SP 800-82r3 Ipd | PDF | Security \- Scribd, https://www.scribd.com/document/616114618/NIST-SP-800-82r3-ipd
69. Digital Forensics: A Comprehensive Guide to Investigation, Recovery, and Analysis, https://cyooda.com/blog/digital-forensics-a-comprehensive-guide-to-investigation-recovery-and-analysis
70. Cloud Forensics BEST PRACTICE AND CHALLENGES FOR PROCESS EFFICIENCY OF INVESTIGATIONS AND DIGITAL FORENSICS, http://icofcs.org/2013/ICoFCS-2013-003.pdf
71. Incident Response for the Internet of Things \- Publikationsserver der Universität Regensburg, https://epub.uni-regensburg.de/59795/1/Empl\_Dissertation\_Pubserver.pdf
72. A Comparative Study on Cyber Threat Intelligence: The Security Incident Response Perspective \- ResearchGate, https://www.researchgate.net/publication/355075815\_A\_comparative\_Study\_on\_Cyber\_Threat\_Intelligence\_The\_Security\_Incident\_Response\_Perspective
73. 10 U.S. Code Subtitle A Chapter 19 Part I \- CYBER AND INFORMATION OPERATIONS MATTERS \- Law.Cornell.Edu, https://www.law.cornell.edu/uscode/text/10/subtitle-A/part-I/chapter-19
74. S3A: Secure System Simplex Architecture for Enhanced Security and Robustness of Cyber-Physical Systems \*, https://sibin.github.io/papers/2013\_HiCONS\_S3A\_SibinMohan.pdf
75. OpenC2 in the News, https://openc2.org/news.html
76. Compositional Security Enforcement of Timed Properties for Cyber Physical Systems, https://www.researchgate.net/publication/410815806\_Compositional\_Security\_Enforcement\_of\_Timed\_Properties\_for\_Cyber\_Physical\_Systems
77. Final Public Draft NIST SP 800-160 Vol. 2, Developing Cyber Resilient System, https://csrc.nist.gov/CSRC/media/Publications/sp/800-160/vol-2/draft/documents/sp800-160-vol2-draft-fpd.pdf
78. Final Public Draft NIST SP 800-160 Vol. 2, Developing Cyber Resilient System, https://csrc.nist.gov/CSRC/media/Publications/sp/800-160/vol-2/draft/documents/sp800-160-vol2-draft-fpd-with-line-nums.pdf