Cybersecurity Fundamentals and the Domain Map

CORRECTED 15 Sept 2026. Later historical research superseded several US federal policy and EU AI Act claims in this file. See 19-corrections-and-updates.md before citing anything about BOD 22-01, secure software attestation, the SEC SolarWinds case, the Cyber Safety Review Board, or EU AI Act high-risk deadlines.

Research date: September 14–15, 2026. Educational material. Defensive scope only — this document explains how attacks work at a conceptual level and how to defend against them; it contains no procedures for unauthorized access.

Part A — Fundamentals

A1. Six words people use interchangeably that mean different things

A site aimed at beginners, executives, and policymakers should draw these lines on page one, because almost every public confusion about cybersecurity traces back to collapsing them.

The teaching frame: information security contains cybersecurity; privacy and security overlap without being identical; resilience is the outcome goal; cybercrime and nation-state activity are threat categories viewed through legal and geopolitical lenses.

A2. The CIA triad and its extensions

Confidentiality means only authorized parties can access data — enforced through encryption, access control, and data classification. Integrity means data and systems are accurate and unaltered — enforced through hashing, digital signatures, code signing, version control, and write-once storage. Availability means systems are usable when needed — enforced through redundancy, DDoS protection, backups, and capacity planning.

ENISA's 2025 data makes a useful teaching point here: distributed denial-of-service accounted for roughly 77% of tracked EU incident volume, yet only about 2% caused real service disruption. Availability attacks dominate by count while ransomware dominates by impact. Volume and severity are different axes.

Worth teaching alongside: authenticity and non-repudiation, both explicit in NIST definitions, and the Parkerian hexad's additions of possession and utility. In operational technology the priority order inverts — availability and human safety come first, confidentiality last.

A3. Authentication, authorization, and identity management

Identification is claiming an identity. Authentication is proving it. Authorization is what that proven identity may do. Accounting is recording what was done. Together, AAA.

Authentication factors are something you know, something you have, something you are; multi-factor authentication combines at least two. The critical 2026 nuance is that not all MFA is equal. The hierarchy is phishing-resistant MFA (FIDO2/WebAuthn passkeys, PIV and smart cards) above authenticator apps and number-matched push, above SMS and voice one-time codes. Attacker-in-the-middle proxy phishing kits and MFA-fatigue push bombing defeat the weaker factors at industrial scale. NIST SP 800-63B revision 4, finalized in 2025, dropped mandatory periodic password rotation, favors length over complexity, and endorses passkeys and syncable authenticators. Research published in August 2026 demonstrated attacks against synced passkey ecosystems under certain conditions — passkeys raise the bar enormously but are not magic, and that scope should be verified before the site makes specific claims about it.

Identity and access management spans directory services (Entra ID, Active Directory, Okta), SSO federation via SAML and OIDC/OAuth, lifecycle provisioning (joiner-mover-leaver, SCIM), privileged access management with vaulting and just-in-time elevation, identity governance with access reviews and separation of duties, customer identity, and — the fastest-growing concern of 2026 — non-human identity management for service accounts, API keys, workload identities, and AI agents, which outnumber human identities by large multiples in most estates.

Authorization models worth teaching: role-based, attribute-based, and relationship-based access control; least privilege; separation of duties. Identity threat detection and response (ITDR) is the emerging monitoring layer.

A4. Encryption, and the post-quantum migration that is now operational

In transit, TLS 1.3 is the norm and TLS 1.2 with modern ciphers is acceptable; everything older should be deprecated. Certificate lifetimes are shrinking — the CA/Browser Forum voted in 2025 to step public TLS certificate validity down toward 47 days by 2029, which makes automation through ACME mandatory rather than optional and pushes crypto-agility from theory into operations. Verify the exact milestone dates before publishing them.

At rest, AES-256 or AES-128 applied through full-disk, database (transparent data encryption), file and object, and application-layer encryption, with envelope encryption and KMS or HSM-protected keys, key rotation, and separation of keys from data. IBM's 2026 report found only about 37% of breached organizations encrypt sensitive data comprehensively, and only 34% have visibility into their own cryptographic assets.

Post-quantum status as of 2026. NIST finalized the first standards in August 2024: FIPS 203 (ML-KEM, from Kyber) for key encapsulation, FIPS 204 (ML-DSA, from Dilithium) and FIPS 205 (SLH-DSA, from SPHINCS+) for signatures. HQC was selected as a backup key-encapsulation mechanism in March 2025. NIST's draft transition guidance (IR 8547) proposes deprecating RSA-2048 and elliptic-curve cryptography around 2030 and disallowing them by 2035; NSA's CNSA 2.0 puts national-security systems on a similar phased schedule through 2033. The driving threat is harvest now, decrypt later — adversaries stockpiling encrypted traffic today against future quantum decryption. In practice 2025–26 adoption is led by hybrid key exchange in TLS, with X25519 plus ML-KEM now default in major browsers and CDNs, while enterprises run cryptographic inventories. The teaching sequence: inventory, prioritize long-lived secrets, demand vendor PQC roadmaps, adopt hybrids, stay crypto-agile.

A5. Risk management and governance

Risk is the likelihood times the impact of a threat exploiting a vulnerability against an asset. The four treatments are mitigate, transfer (insurance), avoid, and accept. The frameworks are NIST's Risk Management Framework (SP 800-37), ISO/IEC 27005, and FAIR for quantification.

NIST CSF 2.0, released February 2024, added a sixth function — Govern — alongside Identify, Protect, Detect, Respond, and Recover, explicitly elevating governance, supply-chain risk, and executive accountability. It also broadened scope from critical infrastructure to organizations of any size and sector.

Governance now has regulators behind it. The SEC's cybersecurity disclosure rules require public companies to file a Form 8-K within four business days of determining an incident is material and to describe risk management and governance annually. In the EU, NIS2, DORA, and the Cyber Resilience Act each impose management-body accountability. The artifacts to teach: risk register, the policy/standard/procedure hierarchy, security metrics and key risk indicators, third-party risk management, and board reporting.

A6. Threat intelligence

Four levels: strategic (trends for leadership), operational (campaigns and actors), tactical (techniques), technical (indicators). The core frameworks are MITRE ATT&CK for technique taxonomy, the intelligence lifecycle, the Pyramid of Pain, and kill-chain models, with sharing through STIX/TAXII and sector ISACs.

Sources range from government (CISA advisories and the KEV catalog, FBI and NSA joint advisories, national CERTs, ENISA) through commercial feeds to OSINT and dark-web monitoring. The honest guidance for small teams: curated, actionable intelligence — the KEV catalog, vendor advisories, and ISAC membership — beats a threat intelligence platform they cannot staff.

A7. Vulnerability management

The lifecycle is discover (asset inventory plus scanning), prioritize, remediate or mitigate, verify, report. Prioritization inputs are CVSS (v4.0 since November 2023), EPSS for exploitation probability, the CISA KEV catalog as a due-care floor, and asset criticality and exposure. The field is rebranding toward continuous threat exposure management, unifying vulnerability, misconfiguration, identity, and attack-path exposure.

The 2026 reality check is uncomfortable and should be stated plainly: patching is losing the race. Median time-to-patch rose to about 43 days while exploitation of edge devices often begins within days or hours of disclosure, and only about 26% of KEV entries get remediated. Compensating controls — segmentation, virtual patching, exposure reduction — are first-class responses, not admissions of failure. The April 2025 near-lapse of MITRE's CVE program funding, resolved by a last-minute CISA contract extension and followed by the creation of the CVE Foundation, is worth teaching as a lesson in ecosystem fragility; verify current governance status before writing about it.

A8. Incident response, forensics, and continuity

Incident response follows NIST SP 800-61 revision 3, finalized April 2025, which recast IR as a CSF 2.0 community profile rather than a standalone four-phase lifecycle. SANS's PICERL model (Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned) remains the most teachable phase model and coexists with it. Full treatment in 07-incident-response-playbooks.md.

Digital forensics aims to reconstruct events and preserve legally admissible evidence. Its pillars are chain of custody, forensically sound imaging, order of volatility (RFC 3227), and timeline analysis, across disk, memory, network, mobile, and increasingly cloud forensics — which is API- and audit-log-centric, deals with ephemeral workloads, and represents a growing skills gap.

Business continuity keeps the business functioning; disaster recovery restores IT. The metrics are RTO (how fast to restore) and RPO (how much data loss is tolerable), derived from a business impact analysis. Standards: ISO 22301, NIST SP 800-34. Ransomware rewrote this discipline around 3-2-1-1-0 backups — three copies, two media, one offsite, one immutable or air-gapped, zero errors on a tested restore — plus recovery environments isolated from production identity systems, because modern ransomware targets Active Directory and Entra first.

A9. Security awareness and human risk

The field is evolving from annual computer-based training toward human risk management: role-based training, phishing simulations used carefully, just-in-time nudges, and a reporting culture that rewards rather than punishes. The 2025–26 priority topics are AI-enhanced phishing, deepfake voice and video verification procedures for payments, help-desk social engineering, and MFA fatigue. The honest caveat: training measurably reduces click rates, but independent research on durable behavior change is mixed — pair it with phishing-resistant MFA so that a click is not game over.

A10. Zero Trust and defense in depth

Zero Trust means never trust, always verify: no implicit trust from network location, with per-request, context-aware access decisions. The canonical source is NIST SP 800-207 (2020), with its policy engine, policy administrator, and policy enforcement point model, operationalized by NIST SP 1800-35 (finalized June 2025, with 19 example builds) and CISA's Zero Trust Maturity Model v2.0 (April 2023), which organizes work into five pillars — identity, devices, networks, applications and workloads, data — across four maturity stages. Adoption is mainstream but uneven; most organizations have Zero Trust initiatives rather than complete architectures, and published adoption percentages vary so widely across surveys that the site should avoid quoting a single number.

Defense in depth means layered, overlapping controls so that a single failure is not a compromise. Teach the two as complementary: Zero Trust redefines where trust boundaries sit; defense in depth ensures redundancy at each boundary. Pair both with "assume breach" and resilience engineering.

Part B — The Domain Map

Twenty-five domains, each with its main threats as of 2024–26, key controls, tool categories, compliance hooks, and required skills. Tools are named as category examples, not endorsements.

B1. Networks

Threats: exploitation of internet-facing edge devices — VPN concentrators, firewalls, and gateways from Ivanti, Fortinet, Citrix, Palo Alto, Check Point, and Cisco — often within days of disclosure and sometimes before a patch exists; record-volume DDoS, largely hacktivist; lateral movement and living-off-the-land techniques exemplified by Volt Typhoon; DNS abuse; attacker-in-the-middle interception. Controls: minimize internet-exposed services and manage external attack surface; patch edge devices aggressively with KEV as the floor; segment and microsegment; replace always-on VPN with ZTNA; egress filtering; protective and encrypted DNS; network detection and response; DDoS mitigation contracted before it is needed; out-of-band management; configuration integrity monitoring, because state actors implant in device configs and firmware. Tools: NGFW (Palo Alto, Fortinet), IDS/IPS (Suricata, Snort, Zeek), NDR (Corelight, Darktrace, ExtraHop), SASE/SSE and ZTNA (Zscaler, Netskope, Cloudflare), DDoS (Cloudflare, Akamai), NAC, attack-surface management. Compliance: PCI DSS 4.0 network requirements; NIS2; CISA Binding Operational Directives for federal agencies; ISO 27001 Annex A. Skills: TCP/IP and routing, firewall and segmentation design, packet analysis, cloud networking, ZTNA architecture. Certs: Network+, CCNA/CCNP Security, SANS SEC401/503.

B2. Endpoints

Threats: infostealer malware feeding the credential economy; ransomware payloads; malvertising, SEO-poisoned installers, and fake browser updates; "ClickFix"-style lures that trick users into running commands; abuse of built-in administrative tooling; EDR evasion and vulnerable-driver abuse; unmanaged and BYOD gaps. Controls: EDR everywhere with 24/7 monitoring (MDR for smaller organizations); patch automation; hardening baselines (CIS Benchmarks, Microsoft security baselines); no standing local admin; application allow-listing where feasible; full-disk encryption; browser management; phishing-resistant MFA to devalue stolen credentials; removable-media policy. Tools: EDR/XDR (CrowdStrike, Microsoft Defender, SentinelOne), UEM (Intune, Jamf), patch and vulnerability management (Tanium, Qualys, Rapid7), privilege management (BeyondTrust, Delinea), disk encryption (BitLocker, FileVault). Compliance: CIS Controls IG1–IG3, HIPAA device and media controls, PCI DSS, UK Cyber Essentials. Skills: OS internals, defensive malware triage, EDR query languages such as KQL, scripting. Current: the July 2024 CrowdStrike content-update outage that crashed roughly 8.5 million Windows hosts reshaped endpoint-agent governance around staged deployment and N-1 rings; Windows 10 end of support in October 2025 left a long tail of unpatched estates.

B3. Servers and infrastructure

Threats: unpatched internet-facing server software; exposed management planes (RDP, SSH, iLO/iDRAC, hypervisor consoles); hypervisor-targeting ransomware, with ESXi encryptors a major 2024–26 pattern; web shells; cryptomining on compromised servers; Active Directory as the dominant lateral-movement fabric. Controls: golden-image and infrastructure-as-code builds; CIS-hardened baselines; KEV-prioritized patching; management interfaces off the internet behind PAM and MFA; tiered administration with Tier 0 isolation for AD; file integrity monitoring; immutable backups; central logging. Tools: configuration management (Ansible, Puppet), scanners (Nessus, OpenVAS), PAM, SIEM, AD posture tools (Purple Knight, BloodHound used defensively), integrity monitoring (Wazuh, Tripwire). Compliance: PCI DSS hardening, NIST SP 800-53/FedRAMP, SOC 2. Skills: Linux and Windows administration, virtualization, IaC, AD architecture and hardening.

B4. Cloud infrastructure

Threats: misconfiguration — public storage, permissive IAM, exposed snapshots — repeatedly the top cloud failure mode; stolen and long-lived credentials, with the 2024 Snowflake customer-tenant campaign the canonical case; cross-tenant and control-plane flaws; identity privilege-escalation paths; cryptomining; insecure CI/CD-to-cloud trust. CrowdStrike reported cloud intrusions up 37% in 2025 and state-nexus cloud targeting up 266%. Controls: teach the shared-responsibility model explicitly; identity-first security with SSO and phishing-resistant MFA on all consoles; short-lived credentials and workload identity federation instead of static keys; CSPM/CNAPP for continuous misconfiguration detection; least-privilege IAM with access analyzers; org-wide guardrails; customer-managed keys where warranted; audit logging piped to detection; accounts and projects as blast-radius boundaries. Tools: CNAPP (Wiz, Orca, Prisma Cloud, Defender for Cloud), CIEM, IaC scanning (Checkov, tfsec), secrets managers (Vault, cloud KMS), cloud detection and response. Compliance: FedRAMP, ISO 27017/27018, SOC 2, CSA STAR/CCM, GDPR residency, DORA for financial workloads. Skills: provider architecture, IAM policy design, IaC, Kubernetes security, detection engineering on cloud logs.

B5. SaaS

Threats: account takeover through credential stuffing and AiTM phishing into SSO; OAuth consent abuse and over-scoped third-party integrations; misconfigured sharing; shadow SaaS and shadow AI; token sprawl; compromise of the SaaS vendor itself. The 2025 Salesloft Drift incident — stolen OAuth tokens for a chat integration cascading into 700-plus organizations' Salesforce data — is the defining case. Controls: SSO everywhere with phishing-resistant MFA; SCIM-driven deprovisioning; SSPM for continuous tenant-config checks; OAuth app governance (review scopes, block unverified apps, expire tokens); DLP on sharing; session policies via SSE/CASB; vendor risk management; monitor SaaS audit logs and demand vendors expose them. Tools: SSPM (AppOmni, Adaptive Shield, Obsidian), CASB/SSE, ITDR, SaaS backup, enterprise browsers. Compliance: SOC 2 and ISO 27001 as vendor table stakes; GDPR processor obligations; sector rules flowing down through BAAs and PCI. Current: device-bound session credentials and token binding to blunt stolen-cookie replay; AI-agent connections to SaaS as the 2026 governance frontier.

B6. APIs

Threats: broken object-level authorization and other authorization failures, still the top API risk class; broken authentication; excessive data exposure; shadow and zombie APIs; business-logic abuse and scraping; leaked keys; server-side request forgery. Vendor percentage claims about API attack share vary so widely that the site should avoid single-number assertions. Controls: complete API inventory and discovery; centralized authentication and authorization at a gateway plus per-endpoint object-level checks; OpenAPI-driven schema validation; rate limiting and bot management; short-lived tokens and mTLS for service-to-service; secrets scanning; API-specific testing in CI; anomaly detection on abuse patterns. Tools: gateways (Kong, Apigee), API security platforms (Salt, Akamai API Security, Traceable, 42Crunch), WAAP, contract and fuzz testing, secrets scanners (GitGuardian, TruffleHog). Compliance: PCI DSS 4.0 covers APIs in scope; PSD2 open-banking standards; HIPAA where PHI flows; US healthcare FHIR API rules. Current: AI agents consuming APIs at machine speed means authorization and quota design must now assume non-human callers; MCP-style agent-tool protocols raise new authorization questions.

B7. Web applications

Threats: the OWASP Top 10:2025 classes — broken access control at number one, security misconfiguration, software supply-chain failures (new), cryptographic failures, injection, insecure design, authentication failures, integrity failures, logging and alerting failures, and mishandling of exceptional conditions (new); credential stuffing and AiTM session hijacking; zero-days in enterprise web apps, with file-transfer software the recurring template since MOVEit; client-side skimming; bot-driven fraud. Controls: secure-by-design patterns (centralized authorization, parameterized queries, output encoding, CSP); current framework defenses; SAST/DAST/SCA gates in CI; WAF/WAAP with virtual patching; session security; subresource integrity and client-side script monitoring, which PCI DSS 4.0 requirements 6.4.3 and 11.6.1 have made mandatory since March 2025; a vulnerability disclosure program. Tools: SAST (Semgrep, SonarQube, Checkmarx), DAST (Burp Suite Enterprise, ZAP), WAF (Cloudflare, Akamai, AWS WAF), RASP, secrets and dependency scanning. Skills: secure coding in the organization's stack, deep HTTP and browser security model knowledge, code review, STRIDE threat modeling.

B8. Mobile applications and devices

Threats: smishing and QR-code phishing at record volumes; Android banking trojans and overlay malware; commercial spyware and stalkerware against journalists and officials; trojanized and sideloaded apps; insecure local storage and over-permissive SDKs; SIM swapping defeating SMS-based authentication. Controls: UEM with compliance gating; OS auto-updates; app vetting and store-only installs; OWASP MASVS/MASTG for builders; mobile threat defense for high-risk users; Lockdown Mode and advanced protection for targeted individuals; eliminate SMS one-time codes where possible. Tools: UEM (Intune, Jamf, Workspace ONE), MTD (Zimperium, Lookout), testing (MobSF, NowSecure, Corellium for authorized research), app-shielding SDKs. Compliance: app-store policies, GDPR/CCPA, PCI mobile payment standards; the EU Digital Markets Act's sideloading provisions complicate the iOS threat model.

B9. Databases and data stores

Threats: internet-exposed databases and object stores; SQL injection through front-ends; stolen credentials to data warehouses; ransomware deleting databases and backups; insider misuse and over-broad analyst access; unsecured snapshots; vector databases and data lakes as weakly governed new stores for AI pipelines. Controls: no direct internet exposure; strong authentication with MFA for admins and workload identity for applications; least-privilege grants and just-in-time elevation; TDE plus in-transit plus field-level encryption for the most sensitive data; tokenization and masking for non-production; database activity monitoring; DSPM to find sensitive-data sprawl; tested immutable backups. Tools: DAM (Imperva, Guardium), DSPM (BigID, Cyera, Varonis), KMS/HSM and Vault, masking, immutable backup platforms (Rubrik, Veeam). Compliance: GDPR minimization and storage limitation, PCI PAN storage rules, HIPAA, GLBA Safeguards, state privacy laws. Current: the DSPM boom is driven by AI projects copying data everywhere; confidential computing is maturing; long-retention archives are the clearest harvest-now-decrypt-later exposure.

B10. Email and collaboration

Threats: phishing as a top initial-access vector, roughly 60% of EU intrusion entry points per ENISA; BEC and payment fraud, persistently among the costliest IC3 categories at about $3.05B reported in 2025; AiTM proxy kits that phish sessions past weak MFA; AI-generated spear phishing and deepfake voice and video in payment-authorization fraud; QR-code phishing; malicious OAuth consent lures; abuse of legitimate file-share and e-signature services; phishing spilling into Teams and Slack. Controls: a modern secure email gateway or API-based integrated cloud email security with behavioral detection; DMARC at p=reject with SPF and DKIM, now near-universal for bulk senders after Google, Yahoo, and Microsoft mandates; phishing-resistant MFA; out-of-band verification for payment and bank-detail changes as an anti-deepfake process control; a user reporting button with fast SOC response; lookalike-domain monitoring. Tools: Abnormal, Proofpoint, Mimecast, Microsoft Defender for Office; DMARC management (dmarcian, Valimail); awareness platforms. Compliance: DMARC required for US federal agencies under BOD 18-01 and expected under PCI DSS 4.0 anti-phishing requirements.

B11. Identity systems — the new perimeter

Threats: credential abuse as a leading breach factor; AiTM session-token theft defeating one-time-code MFA; MFA fatigue; help-desk social engineering to reset credentials and MFA, the Scattered Spider signature used against retail, insurance, and aviation through 2025; SIM swapping; compromise of the identity provider itself; dormant accounts and unmanaged non-human identities; federation abuse. Controls: phishing-resistant MFA prioritized for administrators and high-risk applications; conditional access with device trust and risk signals; hardened help-desk verification procedures — callback to known numbers, identity proofing, never an MFA reset on a single unverified call; PAM with just-in-time privileges; ITDR monitoring for impossible travel, token anomalies, and new MFA method registration; lifecycle automation to kill orphaned accounts; vaulting and rotation for non-human credentials moving toward short-lived workload identity. Tools: IdPs (Entra ID, Okta, Ping), PAM (CyberArk, Delinea, BeyondTrust), IGA (SailPoint, Saviynt), ITDR (Semperis, Silverfort, Push, Falcon Identity), machine-identity managers. Compliance: SOX access controls, PCI DSS 4.0 MFA requirements, NIST SP 800-63-4, EU eIDAS 2.0 wallet rollout. Current: passkey adoption at billions-of-accounts scale; device-bound session credentials; identity for AI agents — scoped, auditable, revocable — as the emerging frontier.

B12. Supply chains and third parties

Threats: third-party involvement in roughly 48% of breaches per DBIR 2026, up 60% year over year; one vendor's compromise cascading to thousands of customers; managed-service-provider compromise; hardware and firmware provenance; counterfeit components. Controls: tiered third-party risk management based on criticality rather than questionnaire volume; contractual security and notification clauses; least-privilege, monitored, time-bound vendor access with no standing VPN trust; SBOM requirements; concentration-risk analysis, which DORA makes explicit for financial firms; exit and continuity plans per critical vendor; continuous external monitoring of key vendors. Tools: TPRM platforms (OneTrust, ProcessUnity), security ratings (Bitsight, SecurityScorecard), vendor-access brokers, SBOM tooling. Compliance: NIST SP 800-161r1 for C-SCRM, NIS2 supply-chain obligations, DORA's ICT third-party register, FDA premarket requirements for medical-device suppliers, CISA's Secure Software Development Attestation Form. Current: the regulatory shift is from "assess your vendors" to "regulate the vendors" — the Cyber Resilience Act and DORA's oversight of critical ICT providers both do this directly.

B13. Software development and DevSecOps

Threats: vulnerable code shipped at AI-accelerated speed; CI/CD pipeline compromise through poisoned build steps, stolen pipeline secrets, and malicious pull requests; leaked secrets in repositories; maintainer compromise; insecure AI coding-assistant output accepted without review; artifact tampering between build and deploy. Controls: NIST SSDF (SP 800-218) as the backbone, with SP 800-218A profiling generative-AI development; threat modeling in design; SAST, SCA, and secret scanning as pull-request gates; signed commits and artifact provenance (Sigstore, SLSA); isolated ephemeral build runners; least-privilege pipeline credentials via OIDC federation rather than long-lived deploy keys; mandatory review of AI-generated code; dependency pinning and lockfiles; SBOM per release. Tools: GitHub Advanced Security, GitLab Ultimate, ASPM (ArmorCode, Apiiro, Cycode), SCA (Snyk, Sonatype, Mend), secrets scanning (GitGuardian), signing (Cosign, in-toto). Compliance: CISA secure-software attestation for federal sales; the EU Cyber Resilience Act's secure-development and vulnerability-handling requirements, with mandatory reporting of actively exploited vulnerabilities from September 2026; the PCI Secure Software Standard. Current: the memory-safe languages push — CISA and NSA's June 2025 joint guidance urging Rust, Go, Java, and Swift over C and C++ for new code, with memory-safety roadmaps now an expectation in CISA's product-security bad-practices criteria.

B14. Open-source dependencies

Threats: malicious packages at unprecedented scale (Sonatype's counts run into the hundreds of thousands cumulatively; other 2026 analyses claim over a million, using incompatible methodologies — cite Sonatype's method rather than a bare number); maintainer-account takeover via phishing driving mass npm compromises, including the self-replicating Shai-Hulud worm of September 2025 that hit 500-plus packages and prompted a CISA alert; typosquatting and dependency confusion; slopsquatting, registering package names hallucinated by AI assistants; the XZ Utils backdoor (CVE-2024-3094, March 2024) as the canonical long-game social-engineering case; nation-state campaigns seeding packages; abandoned dependencies; IDE and browser extension marketplaces as adjacent vectors. Controls: SCA with reachability analysis; lockfiles, pinned versions, and cooldown periods before adopting brand-new releases; private registry proxies with quarantine; provenance verification; SBOMs per release and consumption of vendors' SBOMs; scoped tokens and mandatory MFA for maintainers; advisory monitoring (OSV, GitHub Advisory Database); OpenSSF Scorecard for assessing critical dependencies. Tools: Snyk, Sonatype, Mend, Dependabot/Renovate, registry firewalls, Syft and Trivy for SBOMs, OpenSSF Scorecard and Sigstore.

B15. IoT

Threats: default credentials feeding Mirai-descendant botnets — the Aisuru/Kimwolf botnet of 2 million-plus devices set a 31.4 Tbps DDoS record in November 2025; unpatched firmware with hardcoded secrets; device lifetimes far exceeding vendor support; insecure companion apps and cloud backends; enterprise IoT (cameras, printers, badge readers) as unmonitored footholds; smart-home privacy exposure. Controls: segment all IoT onto separate VLANs and SSIDs with no lateral access; discover unmanaged devices; change defaults and disable unneeded services; automatic firmware updates; certificate-based device identity at scale; procurement standards requiring security attestations, SBOMs, and update commitments; monitor egress from IoT segments. Tools: Armis, Claroty, Forescout, Palo Alto IoT Security; firmware analysis (Finite State, Exein); NAC. Compliance: the EU Cyber Resilience Act is the landmark — CE-marked cybersecurity for connected products, with vulnerability-handling and exploited-vulnerability reporting from September 11, 2026 and full application December 2027; the US Cyber Trust Mark voluntary labeling program; the UK PSTI Act, in force since April 2024, which banned universal default passwords; ETSI EN 303 645; NIST IR 8259.

B16. OT and industrial control systems

Threats: ransomware halting production even when only IT is hit; state pre-positioning, with Volt Typhoon in US water, energy, communications, and transport the headline concern; hacktivist attacks on internet-exposed HMIs and PLCs, especially at water utilities; insecure vendor remote access; legacy protocols without authentication; IT/OT convergence expanding attack paths. Controls: asset inventory first — you cannot protect PLCs you do not know about; segmentation per ISA/IEC 62443 zones and conduits with Purdue-model DMZs; remove OT from the internet; secure remote access with MFA and session recording; OT-aware passive monitoring; engineering-workstation hardening; tested manual-operations fallback; strict change control; safety-instrumented-system isolation. Tools: Claroty, Dragos, Nozomi; unidirectional gateways and data diodes; OT-capable firewalls and secure remote access. Compliance: ISA/IEC 62443; NERC CIP; TSA security directives; EPA water-sector guidance; NIS2; CISA's Cybersecurity Performance Goals. Skills: the control-systems-plus-security hybrid is scarce and highly paid. Certs: GICSP, ISA 62443 certificates, Dragos and SANS ICS courses.

B17. Wireless

Threats: rogue access points and evil twins; deauthentication and jamming; legacy Wi-Fi security and shared pre-shared keys still common on enterprise networks; Bluetooth and BLE tracking and pairing weaknesses; RFID badge cloning on legacy card systems; Wi-Fi as an entry point to flat networks. The 2024 "nearest neighbor" research — a state actor compromising a nearby organization's Wi-Fi to reach a target — is worth citing once its details are verified. Controls: WPA3-Enterprise with 802.1X and EAP-TLS certificate authentication; separate guest and IoT SSIDs mapped to segmented VLANs; wireless IDS and rogue-AP detection; disable WPS; treat Wi-Fi as untrusted transport under Zero Trust; modern credential-based access cards instead of legacy 125 kHz proximity. Compliance: PCI DSS wireless scanning requirements; FCC rules making jammers illegal.

B18. Telecom and 5G

Threats: Salt Typhoon — China-linked compromise of major US and global carriers, reportedly touching 80-plus countries and 600 organizations, including access tied to lawful-intercept systems, described by officials as among the worst telecom intrusions in US history, with a 13-nation joint advisory issued August 27, 2025; SS7 and Diameter signaling abuse for location tracking and SMS interception; SIM-swap fraud; IMSI catchers; carrier DDoS; submarine-cable sabotage concerns after Baltic incidents in 2024–25. Controls (carrier side): harden and monitor routing and core management planes; patch edge and router fleets; signaling firewalls; STIR/SHAKEN for call authentication; 5G standalone security features; lawful-intercept system isolation and auditing. Subscriber side: treat SMS as untrusted for authentication; use encrypted messaging for sensitive communications — notably, CISA and the FBI recommended exactly this in their December 2024 Salt Typhoon guidance. Compliance: FCC action after Salt Typhoon (verify final rule status, which shifted with FCC leadership); the EU 5G Toolbox; NIS2.

B19. Automotive

Threats: the remote attack surface of connected cars — telematics units, cellular interfaces, companion apps, and APIs, with researchers repeatedly demonstrating fleet-wide control through web and API flaws rather than CAN-bus access; keyless-entry relay theft and CAN-injection theft driving real-world car crime; EV charging infrastructure; over-the-air update integrity; large-scale vehicle telemetry and location privacy exposure; ransomware against suppliers and dealer software, with CDK Global's June 2024 incident shutting roughly 15,000 dealerships. Controls: ISO/SAE 21434 engineering lifecycle with threat analysis and risk assessment from the concept phase; secure boot and HSM-anchored ECU identity; signed, staged OTA updates; in-vehicle network segmentation between infotainment and drive systems; vehicle SOC monitoring; API security for companion and cloud services; a PSIRT with coordinated disclosure. Compliance: UNECE R155 and R156, mandatory for type approval in roughly 60 markets and applying to all new vehicles produced in scope markets since July 2024; ISO/SAE 21434 beneath them; China's GB 44495/44496 standards; NHTSA's non-binding best practices; the US Commerce rule restricting Chinese and Russian connected-vehicle software and hardware, finalized January 2025.

B20. Healthcare

Threats: ransomware as a patient-safety issue, with ambulance diversions and weeks-long EHR downtime; the Change Healthcare attack of February 2024, which disrupted US claims and pharmacy flows nationally and exposed roughly 193 million people's data — the largest US healthcare breach, entered through a Citrix portal lacking MFA; third-party and clearinghouse concentration risk; medical-device vulnerabilities on legacy operating systems; PHI theft for fraud. Healthcare consistently posts the highest per-breach costs of any sector. Controls: MFA everywhere (the Change lesson); segmentation of clinical devices; immutable backups plus downtime procedures drilled with clinicians for 30-day outages; IoMT inventory with compensating controls for unpatchable devices; vendor risk and single-point-of-failure mapping; email defenses; ePHI encryption. Compliance: the HIPAA Security Rule and its pending overhaul — the NPRM published January 6, 2025 would remove "addressable" flexibility and mandate MFA, encryption, asset inventories, segmentation, and annual audits, but final action is now not expected before 2027; FDA premarket cybersecurity requirements for devices since October 2023; state laws such as New York's hospital cyber regulations; HHS voluntary performance goals.

B21. Financial services

Threats: BEC and payment fraud; deepfake-enabled impersonation of executives and customers; ransomware and extortion; credential stuffing and account takeover at scale; third-party and fintech API risk; hacktivist DDoS; insider threats; crypto-ecosystem theft, including North Korea's record $2.02B in 2025 led by the $1.5B Bybit heist. IBM put financial-sector breach costs at about $6.3M, above the global mean. Controls: strong customer authentication with behavioral fraud analytics; deepfake-resistant callback procedures for high-value transfers; resilience engineering in the DORA mold — critical-function mapping, scenario testing, threat-led penetration testing; third-party ICT risk registers; ITDR and PAM for payment environments; encryption and tokenization; a 24/7 SOC with sector intelligence through FS-ISAC. Compliance: DORA since January 2025; SEC disclosure rules; GLBA Safeguards; NYDFS Part 500 with its final tranche effective November 1, 2025; PCI DSS 4.0.1; the SWIFT Customer Security Programme.

B22. Government and public sector

Threats: the most-targeted sector in the EU at 38.2% of ENISA-tracked incidents; nation-state espionage through cloud-identity weaknesses; ransomware against municipalities, courts, and schools; hacktivist DDoS tied to geopolitics; election-infrastructure interference and influence operations; legacy-system sprawl. Controls: for US federal, FISMA plus NIST SP 800-53, CISA Binding Operational Directives (KEV remediation under BOD 22-01, exposed interfaces under BOD 23-02, logging under M-21-31), zero-trust mandates, phishing-resistant MFA, EDR and centralized logging through CDM, and .gov protective DNS. For state and local: CIS Controls, MS-ISAC and EI-ISAC membership, whole-of-state programs. Compliance: FISMA/FedRAMP; CMMC, whose 32 CFR program rule took effect December 16, 2024 and whose 48 CFR acquisition rule became effective November 10, 2025, starting Phase 1 in DoD contracts; StateRAMP; CJIS; IRS 1075. Current: 2025–26 US federal churn — reported CISA workforce reductions of roughly a third and debates over the Cybersecurity Information Sharing Act of 2015 — raised continuity concerns that the site should cover with sourcing rather than advocacy framing.

B23. Critical infrastructure

Threats: state pre-positioning for disruptive contingencies using living-off-the-land techniques that are hard to detect; ransomware with kinetic-adjacent impact on pipelines, food, ports, and hospitals; interdependency cascades, with Change Healthcare demonstrating single-vendor systemic risk; physical sabotage of cables and substations paired with cyber activity. Controls: CISA's Cybersecurity Performance Goals, reissued as CPG 2.0 on December 11, 2025 and reorganized around CSF 2.0's six functions with merged IT/OT goals, new third-party and MSP goals, and cost/impact/ease ratings to sequence work; sector risk management agency partnership; the OT controls in B16; BC/DR with manual fallbacks; ISAC participation; exercise programs such as GridEx and Cyber Storm. Compliance: sector regimes (NERC CIP, TSA directives, EPA, FDA, FCC) plus CIRCIA's 72-hour incident and 24-hour ransom-payment reporting once the final rule is in force; EU NIS2 and the CER Directive.

B24. AI and machine-learning systems

Threats (defensive framing): prompt injection, direct and indirect, is the number-one risk in the OWASP Top 10 for LLM Applications in both the 2025 and 2026 editions, amplified by agents with tool access; sensitive-data leakage through prompts and outputs, and shadow AI — unsanctioned tools, which IBM associated with roughly 20% of studied breaches and about $670K in added cost; insecure LLM-generated code; training-data poisoning and malicious models on public hubs; model theft and extraction; excessive agency in over-permissioned agents; adversarial evasion of ML detectors; and attackers using AI, which IBM put at roughly a quarter of malicious breaches in 2026, up 56%. Controls: an AI governance program first — inventory of AI use, approved-tool policy, data-handling rules, since IBM's central 2026 finding is that governance gaps rather than AI itself drive cost; treat all model input from untrusted sources as untrusted, with privilege separation between model and tools and human approval for consequential actions; output validation and sandboxing; least-privilege auditable identities for agents; content provenance (C2PA); red-teaming against the OWASP LLM Top 10; data-loss controls on prompts; model and dependency provenance; logging of AI interactions. Tools: AI-SPM (Wiz AI-SPM, Prisma AIRS), guardrails (Lakera, Prompt Security, Protect AI), model scanning (Guardian, HiddenLayer), defensive evaluation frameworks (PyRIT, garak, DeepTeam), AI-DLP. Compliance: the EU AI Act, with high-risk obligations including Article 15's accuracy, robustness, and cybersecurity requirements scheduled for August 2, 2026 — though the Commission's November 2025 digital-omnibus proposal contemplates delays, so final dates need verification; NIST AI RMF and its Generative AI Profile (NIST AI 600-1); ISO/IEC 42001.

B25. Physical security (converged)

Threats: tailgating and social engineering into facilities; theft of devices and media; badge cloning of legacy credentials; insider threats; attacks on the physical infrastructure supporting IT, including substation and submarine-cable sabotage incidents in 2024–25; compromise of physical security systems themselves, since IP cameras and badge controllers are network devices; drones; datacenter perimeter risk. Controls: layered physical access from perimeter to rack; modern smartcard and mobile credentials; anti-tailgating measures; visitor management; CCTV on secured, segmented networks; environmental monitoring; secure media disposal per NIST SP 800-88; console and USB lockdown; converged governance that produces one risk picture across physical and cyber. Compliance: ISO 27001 Annex A physical controls; PCI DSS physical requirements; the EU CER Directive as the physical counterpart to NIS2.

Part C — Eight cross-cutting developments to track

1. Post-quantum migration is operational, not theoretical. FIPS 203/204/205 final; HQC as backup; hybrid TLS at internet scale; NIST IR 8547's deprecate-by-2030, disallow-by-2035 trajectory; CNSA 2.0 mandates. Only about a third of organizations have cryptographic visibility.
2. Memory-safe languages. CISA/NSA June 2025 guidance; memory-safety roadmaps expected of vendors.
3. Secure by Design. CISA's pledge exceeded roughly 300 signatories with published progress reports, though the program's champions left CISA in 2025 and momentum now rests with signatories and international counterparts. Buyer-side "Secure by Demand" is the durable mechanism.
4. A regulatory wave cresting 2025–2027. SEC enforcement, DORA, NIS2, CRA, CMMC, UNECE R155/156, HIPAA's pending overhaul, the EU AI Act.
5. AI on both sides. Roughly a quarter of malicious breaches AI-enabled; AI-supported phishing above 80% of social engineering; defenders saving roughly $2M per breach with AI plus automation; shadow AI as the cost driver.
6. Identity is the battleground. Credential abuse, AiTM, help-desk social engineering; passkeys scaling; machine and agent identity next.
7. Edge devices and exploitation speed. Vulnerability exploitation is now the leading breach vector; KEV grew roughly 50% in 2025; the patch gap is widening. Exposure management and compensating controls are essential curriculum.
8. Resilience over prevention. DORA, NIS2, CRA, and CER codify it; ransomware downtime proves it. Teach RTO/RPO, immutable backups, and manual fallbacks as first-class subjects.