Cybersecurity¶

March 19, 2025
in Cybersecurity, Defense AI, AI Engineering
3 min read

Cyber defense needs machines that can explain the patch

The Defense Advanced Research Projects Agency's (DARPA) March 19 release sets the final competition procedures for its Artificial Intelligence Cyber Challenge (AIxCC). Seven teams are set to test cyber reasoning systems against real-world open-source software, with scoring for finding vulnerabilities, generating patches, and analyzing bug reports.

That is a demanding and useful test. The harder transition begins after a machine writes a patch that appears to work.

January 23, 2024
in Cybersecurity, Government Technology, Innovation Management
5 min read

Cyber Disclosure Is a Decision Architecture

The Securities and Exchange Commission’s cybersecurity rules are often summarized through a deadline: a public company generally must file a Form 8-K within four business days after determining that a cybersecurity incident is material.

The operative phrase is not “four business days.” It is “after determining.”

A company cannot make a timely, defensible materiality decision if technical telemetry, business context, legal judgment, operational impact, and executive authority remain in separate systems and organizations. The disclosure rule therefore reaches deeper than reporting. It tests whether the company possesses a coherent decision architecture for cyber risk.

January 16, 2024
in Zero Trust, AI Security, Cybersecurity, Automation
5 min read

AI in Zero Trust: Automate Evidence, Not Accountability

Originally published in 2024; substantially revised in 2026 to deepen the analysis and incorporate additional sources.

Zero trust creates an appealing environment for artificial intelligence. Every access request can generate context: identity, device posture, workload state, data sensitivity, behavior, location, threat intelligence, and prior activity. AI and machine learning can help correlate those signals faster than human analysts can review them individually.

But there is a design trap. If the organization uses AI to make opaque access decisions inside an architecture intended to improve security visibility and control, it can reproduce the very problem zero trust was meant to solve.

AI should automate the collection, interpretation, and routing of security evidence—not dissolve accountability into an inscrutable risk score.

December 14, 2023
in Cybersecurity, Defense Technology, Innovation Management
3 min read

A cyber challenge can build an ecosystem, not just a winner

The Defense Advanced Research Projects Agency (DARPA) has opened registration for the Artificial Intelligence Cyber Challenge (AIxCC), published an exemplar challenge and scoring approach, and added prize funding. Competitors will work toward systems that can find and repair vulnerabilities in widely used software at scale.

Prizes attract teams. The lasting value of a challenge can be the common infrastructure and professional community built around the competition.

August 9, 2023
in Cybersecurity, Defense Technology, Innovation Management
3 min read

AI cyber defense needs a transition path

The Defense Advanced Research Projects Agency (DARPA) has launched the Artificial Intelligence Cyber Challenge (AIxCC), a two-year competition aimed at using artificial intelligence to find and fix vulnerabilities in widely used software. Anthropic, Google, Microsoft, OpenAI, and the Open Source Security Foundation are participating in the effort, with competitions planned around DEF CON.

The challenge is ambitious for good reason. Software underpins critical infrastructure, and human defenders cannot manually inspect every dependency at the speed new vulnerabilities appear. The difficult work will begin when a winning technique meets a real maintainer's backlog.

February 23, 2023
in Cybersecurity, Digital Engineering, Knowledge Strategy
3 min read

A digital twin can preserve operational judgment

The National Institute of Standards and Technology (NIST) is exploring how digital twins could help manufacturers detect cyberattacks. By comparing a physical process with its virtual representation, a team may recognize changes that ordinary information-technology monitoring misses: a machine behaving differently, a process drifting, or a control command producing an unexpected physical result.

The cybersecurity potential is important. So is the knowledge-management lesson. A useful digital twin does not merely mirror equipment. It preserves an organization's understanding of what normal operation means.