https://security-resilience.ai/articles.htmlNew articles, research, and primers from Cyber Resilience.Mon, 10 Aug 2026 00:00:00 +0000https://security-resilience.ai/article_enisa_landscape.htmlhttps://security-resilience.ai/article_enisa_landscape.htmlarticleMon, 10 Aug 2026 00:00:00 +0000Our analysis: ENISA ranks exploited vulnerabilities sixth — why that undersells them, cross-referenced against the EU Vulnerability Database, KEV and EU-vs-NVD divergence.https://security-resilience.ai/d3fend-coverage.htmlhttps://security-resilience.ai/d3fend-coverage.htmlresearchThu, 30 Jul 2026 00:00:00 +0000MITRE's D3FEND defensive-technique catalog counters 44% of the enterprise ATT&CK matrix; two whole attack stages (reconnaissance, resource development) have no defensive technique at all, and coverage is thinnest at execution and impact.https://security-resilience.ai/was-hugging-face-just-misconfiguration.htmlhttps://security-resilience.ai/was-hugging-face-just-misconfiguration.htmlarticleThu, 30 Jul 2026 00:00:00 +0000A signed, first-person analysis, updated after OpenAI's 28 July disclosure: the errors that enabled the Hugging Face incident sit on the evaluation side, and the target side looks like a real software flaw, not an open door. Whether it was a known bug or a zero-day is still unstated.https://security-resilience.ai/thirty-ai-risks.htmlhttps://security-resilience.ai/thirty-ai-risks.htmlresearchWed, 29 Jul 2026 00:00:00 +0000We mapped all 30 OWASP AI risks (LLM, Agentic, ML) to CWE and ATLAS: 18 have no named weakness, and one agentic risk (cascading agent failures) maps to neither a weakness nor an attack technique.https://security-resilience.ai/ai-attack-surface.htmlhttps://security-resilience.ai/ai-attack-surface.htmlresearchWed, 29 Jul 2026 00:00:00 +0000We mapped all 170 MITRE ATLAS techniques ourselves: the CWE catalog has just four AI-specific weaknesses to blame them on, and 61% of AI attacks have no enterprise ATT&CK equivalent.https://security-resilience.ai/what-controls-prevent.htmlhttps://security-resilience.ai/what-controls-prevent.htmlresearchSun, 26 Jul 2026 00:00:00 +0000A new interactive coverage map shows what a control catalog cannot prevent: NIST 800-53 covers access-control weaknesses well but reaches the code-correctness families (wrong comparisons, bad arithmetic) far less.https://security-resilience.ai/broad-and-deep.htmlhttps://security-resilience.ai/broad-and-deep.htmlresearchSun, 26 Jul 2026 00:00:00 +0000NIST 800-53 covers each weakness family more completely than ISO 27002; ISO reaches about as wide with a fifth of the controls (93 vs 421). Breadth versus depth, not better versus worse.https://security-resilience.ai/asvs-coverage.htmlhttps://security-resilience.ai/asvs-coverage.htmlresearchSun, 26 Jul 2026 00:00:00 +0000OWASP ASVS covers a narrow slice of weaknesses but covers it more completely than any control catalog; read an app-sec pass as deep on what it verifies, not broad.https://security-resilience.ai/csf-translation-layer.htmlhttps://security-resilience.ai/csf-translation-layer.htmlresearchSun, 26 Jul 2026 00:00:00 +0000NIST CSF 2.0 covers every weakness family evenly because it describes outcomes, not controls: great for communicating posture and translating between frameworks, useless for finding gaps.https://security-resilience.ai/coverage-is-directional.htmlhttps://security-resilience.ai/coverage-is-directional.htmlresearchSun, 26 Jul 2026 00:00:00 +0000Between two frameworks, how much A covers B differs from how much B covers A in 50 to 73% of mappings; we store both directions and mark where they disagree, where public crosswalks average it away.https://security-resilience.ai/which-framework.htmlhttps://security-resilience.ai/which-framework.htmlresearchSun, 26 Jul 2026 00:00:00 +0000A framework buys two different things, real risk reduction and certification value, and they are not the same: the highest-scoring one (CSF) is the worst at finding gaps, and the ones that close code-level risk (ASVS) earn no certificate.https://security-resilience.ai/taxonomy-shortcut.htmlhttps://security-resilience.ai/taxonomy-shortcut.htmlresearchFri, 24 Jul 2026 00:00:00 +0000Why we retired the NAICS-to-TRBC crosswalk: across 976 classifications it invented a sector 19% of the time, and direct authoring corrected cases the table got wrong.https://security-resilience.ai/software-is-not-an-industry.htmlhttps://security-resilience.ai/software-is-not-an-industry.htmlarticleFri, 24 Jul 2026 00:00:00 +0000A uniform industry-code triple made a research lab and a hosting provider look identical, and why coding each victim's actual business directly fixes it.https://security-resilience.ai/ai-weakness-gap.htmlhttps://security-resilience.ai/ai-weakness-gap.htmlresearchFri, 24 Jul 2026 00:00:00 +0000The NVD tagged the AI-specific weakness (CWE-1427) on zero of 95 prompt-injection CVEs, filing them as generic injection instead.https://security-resilience.ai/reading-vendor-cve-counts.htmlhttps://security-resilience.ai/reading-vendor-cve-counts.htmlarticleFri, 24 Jul 2026 00:00:00 +0000Oracle published 1,108 vulnerabilities in a month and nothing was wrong; why raw vendor counts mislead and what to read instead.https://security-resilience.ai/absent-beats-derived.htmlhttps://security-resilience.ai/absent-beats-derived.htmlarticleFri, 24 Jul 2026 00:00:00 +0000One rule under a lot of our work: map frameworks directly, and where you cannot, show a gap rather than a derived guess.https://security-resilience.ai/article_patch_diff_curve.htmlhttps://security-resilience.ai/article_patch_diff_curve.htmlresearchSun, 28 Jun 2026 00:00:00 +0000https://security-resilience.ai/article_llm_credit_robustness.htmlhttps://security-resilience.ai/article_llm_credit_robustness.htmlresearchSun, 28 Jun 2026 00:00:00 +0000https://security-resilience.ai/article_xwalk_illusion.htmlhttps://security-resilience.ai/article_xwalk_illusion.htmlresearchSat, 27 Jun 2026 00:00:00 +0000https://security-resilience.ai/article_llm_scanner.htmlhttps://security-resilience.ai/article_llm_scanner.htmlarticleSat, 27 Jun 2026 00:00:00 +0000https://security-resilience.ai/mythos_defenders.htmlhttps://security-resilience.ai/mythos_defenders.htmlarticleWed, 03 Jun 2026 00:00:00 +0000https://security-resilience.ai/article_kev_gap.htmlhttps://security-resilience.ai/article_kev_gap.htmlarticleWed, 20 May 2026 00:00:00 +0000https://security-resilience.ai/mythos_attackers.htmlhttps://security-resilience.ai/mythos_attackers.htmlarticleFri, 15 May 2026 00:00:00 +0000https://security-resilience.ai/mythos_hype.htmlhttps://security-resilience.ai/mythos_hype.htmlresearchSat, 02 May 2026 00:00:00 +0000https://security-resilience.ai/mythos.htmlhttps://security-resilience.ai/mythos.htmlresearchWed, 15 Apr 2026 00:00:00 +0000https://security-resilience.ai/vulnerabilities_intro.htmlhttps://security-resilience.ai/vulnerabilities_intro.htmlarticleSun, 01 Sep 2024 00:00:00 +0000https://security-resilience.ai/rce.htmlhttps://security-resilience.ai/rce.htmlbackgroundSun, 01 Sep 2024 00:00:00 +0000Running attacker-supplied code on a target machine from across the network — the highest-impact vulnerability class.https://security-resilience.ai/lpe.htmlhttps://security-resilience.ai/lpe.htmlbackgroundSun, 01 Sep 2024 00:00:00 +0000Elevating from a low-privilege foothold to root or SYSTEM on the same host — the second stage of most multi-step attacks.https://security-resilience.ai/ddos.htmlhttps://security-resilience.ai/ddos.htmlbackgroundSun, 01 Sep 2024 00:00:00 +0000Overwhelming a service with traffic from many sources to make it unavailable to legitimate users.