Systems Engineering Cybersecurity Measures

AI agents should never receive unrestricted access just because they can complete a task. The more tools, systems, and data an agent can reach, the more carefully its permissions must be designed. These five access control models provide different ways to keep agent actions scoped, secure, and auditable: → 𝗥𝗼𝗹𝗲-𝗕𝗮𝘀𝗲𝗱 𝗔𝗰𝗰𝗲𝘀𝘀 𝗖𝗼𝗻𝘁𝗿𝗼𝗹 Permissions are assigned through predefined roles. It works well when responsibilities are stable and agents can be mapped to roles such as support agent, finance agent, or administrator. → 𝗔𝘁𝘁𝗿𝗶𝗯𝘂𝘁𝗲-𝗕𝗮𝘀𝗲𝗱 𝗔𝗰𝗰𝗲𝘀𝘀 𝗖𝗼𝗻𝘁𝗿𝗼𝗹 Access decisions use attributes such as agent identity, resource type, requested action, location, time, risk, and business context. This enables more precise and dynamic policies. → 𝗔𝗰𝗰𝗲𝘀𝘀 𝗖𝗼𝗻𝘁𝗿𝗼𝗹 𝗟𝗶𝘀𝘁𝘀 Each resource maintains a list of agents or groups allowed to access it and the actions they may perform. This provides direct resource-level control but can become difficult to manage at scale. → 𝗠𝗮𝗻𝗱𝗮𝘁𝗼𝗿𝘆 𝗔𝗰𝗰𝗲𝘀𝘀 𝗖𝗼𝗻𝘁𝗿𝗼𝗹 Central authorities assign security labels to agents and resources. Strict policies determine access, and individual users or agents cannot override them. → 𝗖𝗮𝗽𝗮𝗯𝗶𝗹𝗶𝘁𝘆-𝗕𝗮𝘀𝗲𝗱 𝗔𝗰𝗰𝗲𝘀𝘀 𝗖𝗼𝗻𝘁𝗿𝗼𝗹 Agents receive scoped tokens that authorize a specific action, resource, limit, or time period. This avoids granting broad standing permissions and works well for temporary, task-specific execution. No single access control model fits every agent workflow. Role-based control provides simplicity. Attribute-based control adds context. ACLs offer direct resource permissions. Mandatory control enforces strict policy. Capability-based control provides narrow, temporary authority. Which access control model best fits the AI agents operating inside your enterprise?

𝗜𝗖𝗦 𝗔𝗰𝗰𝗲𝘀𝘀 𝗖𝗼𝗻𝘁𝗿𝗼𝗹: 𝗞𝗲𝗲𝗽𝗶𝗻𝗴 𝗖𝘆𝗯𝗲𝗿 𝗧𝗵𝗿𝗲𝗮𝘁𝘀 𝗢𝘂𝘁 𝟯:𝟬𝟬 𝗮.𝗺. 𝗶𝗻 𝗮𝗻 𝗲𝗻𝗲𝗿𝗴𝘆 𝗽𝗹𝗮𝗻𝘁: An operator sees the cursor moving—on its own. In 2021, hackers actually took control of a Florida water plant, nearly poisoning the water. Why? Shared passwords and open remote access. Access control in Industrial Control Systems (ICS) isn’t just IT hygiene—it’s a frontline defense. Unlike IT, ICS must balance security vs. uptime, making access control complex. 𝗞𝗲𝘆 𝗖𝗵𝗮𝗹𝗹𝗲𝗻𝗴𝗲𝘀 𝗶𝗻 𝗜𝗖𝗦 𝗔𝗰𝗰𝗲𝘀𝘀 𝗖𝗼𝗻𝘁𝗿𝗼𝗹 ❌ Default & Shared Credentials – Many OT devices still use factory-set or hardcoded passwords. ❌ Overprivileged Accounts – Admins using the same account for both daily tasks & critical operations. ❌ Uncontrolled Remote Access – Unrestricted RDP, TeamViewer, or VPN access directly into OT. ❌ Lack of Continuous Audits – Old user accounts lingering long after employees leave. 𝗣𝗿𝗮𝗰𝘁𝗶𝗰𝗮𝗹 𝗦𝗼𝗹𝘂𝘁𝗶𝗼𝗻𝘀 (Aligned with IEC 62443) ✏️ Kill Default Credentials – Change all default passwords before deployment. Use compensating controls if you can’t. ✏️ Unique, Least-Privilege Accounts – No shared logins. Admins should have separate work and privileged accounts. ✏️ Secure Remote Access – Jump servers, MFA, and firewalls between IT & OT. No direct access to controllers. ✏️ Regular Audits & Offboarding – Disable accounts immediately when employees or contractors leave. 𝙍𝙚𝙘𝙚𝙣𝙩 𝙇𝙚𝙨𝙨𝙤𝙣: The Florida water plant breach could have been prevented with MFA, segmented access, and unique passwords. Simple steps can block attackers from turning small mistakes into disasters. ICS security is about access—who gets in, what they can do, and when they’re removed. Every login should tell a secure story. #ICS #CyberSecurity #IEC62443 #AccessControl #OTSecurity

57% of major cyber incidents involve attack types teams never rehearsed. Too many tabletop exercises rely on familiar, dramatic attack scenarios... the kind people already expect. But the real danger is in what nobody saw coming: subtle lateral movement, quiet exfiltration, or chained compromises that don’t start with a big flash. To make exercises meaningful, they have to reflect your environment, your risks, your tech, your people. Teams should test contacting people, fallback comms, expired phone lists, even burner phone logistics. Those “mundane” failures often become the real showstoppers in a crisis. Real preparation is less about scripting a perfect drill and more about building adaptability, muscle memory for surprises, and resilience when chaos hits. #IncidentResponse #CyberReadiness #TabletopExercises

Most students study cybersecurity through theory. I decided to build it — Over the past few weeks, I’ve been working on a SOC Automation Homelab series — where I simulate real-world attacks, collect telemetry, trigger custom alerts (yep, Mimikatz too), and automate the detection process using tools like Wazuh, Filebeat, and more. If you’re curious about how blue teams operate, how SIEMs actually work, or want to build your own home SOC — this series is for you..... #cybersecurity #homelabs #medium #SEO

Most tabletop exercises fail for one boring reason. They are not exercises. They are meetings with a scary slide deck, everyone talks, nobody is tested. ENISA recently published a cybersecurity exercise methodology for planners. It treats an exercise like a product launch. You plan, scope, build, run, measure, then improve. Three things I now push in fintech, and planning time is first. It is not a vibe, it is math. ENISA suggests a minimum of six months. They even give a rough formula for preparation time. More complexity and more stakeholder groups means more months, fast. Second, scope kills more exercises than attackers. If your scope is "test everything", results dilute fast. If it is "test the email server", reality disappears. Pick two or three critical processes. Map the dependencies, including vendors, handoffs, and comms. Be explicit on who plays, who observes, and who decides. Third, evaluation is the point. Without it, you ran training, not readiness. Set smart objectives with a clear measure of success. Define indicators, then metrics, then data sources. Decide what success looks like before day one. Build injects that force real decisions, at realistic pace. Use a master scenario event list as your conductor score. Your after action report becomes evidence, not opinion. Your action plan becomes prioritised, not hand waving. If your tabletop felt pointless, this is why, make it measurable or do not run it. #ENISA

FY2026 Signals Joint Defense Tech The Pentagon isn’t looking for more tech. It’s looking for tech that fits the fight. What wins? interoperable, multi-domain, coalition-ready tech that aligns with how the U.S. and its allies will fight. Hear me out… 1. Integration Is the Mission PE 0604826J is the COG for CJADC2. It funds interoperability pilots with NATO, secure data sharing across services, and cross-domain C2 experiments like Bold Quest. Your tech needs to plug into this joint ecosystem. 2. Multi-Domain C2 Is Non-Negotiable The budget holds firm on digital datalinks, secure comms, and allied data exchange. Your tech must talk across domains and allies, don’t expect traction. 3. Rapid Prototyping Isn’t Dead—It’s Evolving RDER may be gone, but its intent lives on. The budget still backs prototypes that can shape joint force design. Demo utility in a joint context and watch your TRL skyrocket. 4. Congress ‘All In on Joint Tech’ is a buying signal. • $400M → Joint Fires Network • $400M → Joint battle management tools • $1B → Accelerated tech fielding • $2B → DIU scaling commercial tech 5. AI/ML, Autonomy, C5ISR—Joint prioritization isn’t just lip service. Budget lines explicitly call out: • Multi-service unmanned systems • Maritime robotics • Coalition-ready EW and ISR

Ukraines success on the battlefield is not only courage, motivation and determination - it is also about Data! The Ukrainian Delta is a, cloud-based, indigenous Ukrainian command-and-control (C2) and situational awareness system that integrates real-time intelligence from drones, satellites, sensors, and human intelligence on a single Google Maps-style, digital map. Developed by the Ministry of Defense and Aerorozvidka since 2021, it enables,NATO-interoperable battlefield management from tactical to strategic levels, and has been used for major operations, including the defense of Kyiv and strikes on the Russian Black Sea Fleet. Key Features and Capabilities Situational Awareness: Delta provides a comprehensive,,real-time, picture of the battlefield, allowing commanders to see enemy positions, movements, and friendly troop locations. Targeting: The system has an integrated AI-based module for automatic detection of enemy equipment, supporting the targeting of over 2,000 enemy objects daily. Platform Flexibility: Accessible via laptops, tablets, and mobile devices, it does not require specialized hardware. Interoperability: Designed to meet NATO standards, it enables joint operations and integrates with Western-provided intelligence. Scalability: Used across all levels of the Ukrainian Defense Forces, from individual,Brigades to high-level command. Operational Impact As of August 2025, the system was adopted across all branches of the Ukrainian Defense Forces. It has significantly reduced, the time required to strike targets, enhancing, operational, efficiency. The system also includes specialized modules such as, "Vezha," used for managing, unmanned, systems in maritime and land operations. #DefenseTechnology #MilitaryInnovation #CommandAndControl #BattlefieldManagement #SituationalAwareness #NATO #Ukraine Marijn Markus Roman Sheremeta Lars Raae Steen Kjærgaard Jacob Kaarsbo Carlo Lippold

Data access isn’t just a technical challenge; it’s a foundation for responsible innovation across the enterprise. As organizations scale data, AI, and analytics initiatives, the ability to balance agility, security, and compliance becomes a boardroom conversation. RBAC (Role-Based Access Control) has been the workhorse for access management, straightforwardly granting permissions based on defined roles, think “Finance Analyst” or “HR Manager.” It’s clear, easy to audit, and effective for static user groups and simple business logic. But the real world rarely fits within fixed roles. This is where ABAC (Attribute-Based Access Control) in Databricks makes a difference. ABAC uses dynamic attributes such as time, geographic region, and data classification to govern access in real time. Suddenly, granting temporary collaboration rights for a cross-border team or restricting access to confidential records based on sensitivity becomes seamless, reducing the risk of overexposure and manual error. For data practitioners, this means less firefighting and more time building. For executives, it means a governance model that adapts to change, whether responding to new regulations, organizational shifts, or growth into new markets. The interplay between RBAC and ABAC in platforms like Unity Catalog gives organizations the best of both worlds: clarity, accountability, and agility. In practice, RBAC establishes the baseline (“who can access what”), while ABAC adds context and flexibility (“under what conditions”). This layered approach not only future-proofs data and AI governance, but it also unlocks new possibilities enabling secure data sharing, collaborative AI, and compliant innovation at scale. #ABAC #RBAC #DataGovernance #UnityCatalog #Databricks

The largest published cUAS enterprise contract just dropped. $20 billion. 10 years. One vehicle. A nine-year-old startup just got the streamlined corporate contract treatment that Lockheed and Raytheon built over decades. The Army handed Anduril an enterprise contract (W9128Z-26-D-A001) that consolidates 120+ separate procurement actions into a single pipeline. Aberdeen Proving Ground issued it. Five-year base plus five-year option through March 2036. This isn't about Anduril's valuation. It's about what the Pentagon is replacing. Northrop Grumman's legacy FAAD C2 system. The backbone of Army counter-drone command and control. Gone. Brig. Gen. Matt Ross, director of Joint Interagency Task Force 401, the rapid-tech-transfer outfit that visited Ukraine operations, called it directly: "This enterprise contract is a critical step in establishing a common framework for counter-UAS interoperability. It provides a foundational command-and-control capability." The timing isn't coincidental. Drone attrition is spiking in current operations. Ukraine proved that whoever controls the C2 layer controls the fight. The Pentagon watched thousands of drones get neutralized not by better hardware, but by better software integration. Lattice is the answer they're buying. One operating system fusing thousands of sensors and effectors. One operator controlling swarms. Runs in degraded comms and contested EW environments. Battle-tested on Barracuda and Bolt-M systems in Ukraine. The contract structure tells you how urgent this is. Pre-negotiated pricing. Range discounts. Annual spend-volume discounts. No more weeks of negotiations per order. The Army explicitly said this "slashes admin costs and procurement timelines dramatically." Three implications for defense contractors. 1. C2 integration is the new battleground. If your cUAS solution can't integrate with open-architecture C2 systems like Lattice, you're building for yesterday's fight. 2. Battle-tested beats paper-tested. Anduril's hardware was battle-tested and underwent rapid improvements. That operational data won this contract. 3. Speed compounds. Enterprise vehicles eliminate procurement friction. Contractors inside the architecture get faster access. Those outside watch from the sidelines. The counter-UAS race just got a unified command structure. Can your solution integrate with it? ---------- Like this content? Join our newsletter. Link below my name 👆

18 Platforms That Simulate Real-World Cyber Attacks Most security teams don't get breached because they lack security tools. They get breached because they don't know which defenses actually work. The strongest security leaders I've followed all have one habit in common. They continuously test their security as if a real attacker already had a foothold. Here are 18 Cyber Attack Simulation Tools worth knowing: 1. SafeBreach ✦ Simulates sophisticated attacks to continuously validate security controls. 2. AttackIQ ✦ Tests detections and response against real-world attack scenarios. 3. Cymulate ✦ Measures security posture through continuous breach and attack simulations. 4. XM Cyber ✦ Maps attack paths to uncover and prioritize critical exposures. 5. Picus Security ✦ Continuously validates security controls and integrates with DevSecOps. 6. Foreseeti ✦ Models attacker behavior to identify exploitable weaknesses. 7. Infection Monkey (Open Source) ✦ Automates adversary simulations across Active Directory environments. 8. CALDERA (Open Source) ✦ Emulates real attacker behavior using automated post-exploitation techniques. 9. Randori ✦ Discovers external attack surfaces and validates exploitable risks. 10. Scythe ✦ Automates adversary emulation for realistic red team exercises. 11. Horizon3.ai ✦ Continuously identifies exploitable attack paths with autonomous pentesting. 12. Pentera ✦ Safely validates security controls through automated penetration testing. 13. Qualys ✦ Combines vulnerability management with continuous security validation. 14. FireMon ✦ Validates firewall policies and network security effectiveness. 15. Akamai Guardicore ✦ Simulates lateral movement to strengthen microsegmentation strategies. 16. Mandiant ✦ Delivers advanced attack simulations backed by real-world threat intelligence. 17. NetSPI ✦ Identifies exploitable vulnerabilities through expert-led offensive security testing. 18. Skybox Security ✦ Prioritizes cyber risk using attack path analysis and exposure management. The best security teams don't wait for attackers to expose weaknesses. They expose their own weaknesses first. Which attack simulation tool would you add to this list? ♻️ If you found this useful, repost it to help your network. 📌 Follow Marcel Velica for more cybersecurity tools, frameworks, and security insights.