J. Cybersecur. Priv., Volume 6, Issue 4 (August 2026) – 34 articles

The increasing dependence of financial supply chains on digital infrastructures has made it more necessary to design secure, resilient, and reliable networks than ever before. This research presents a self-healing framework based on blockchain and digital twins for multi-objective fuzzy optimization of financial supply chains under uncertainty. The proposed model, focusing on minimizing financial cost, cyber risk, and recovery time while simultaneously maximizing the level of trust and resilience, enables intelligent decision-making in the face of cyber threats. By combining real-time monitoring, secure transaction validation, fuzzy risk assessment, and automated recovery, the framework identifies the role of each component in maintaining the financial and operational stability of the network. The results showed that the complete model achieved an overall performance score of 0.944 in the component elimination study and increased the level of trust and resilience to 0.95 and 0.96, respectively. The cyber risk index was also maintained at 0.118, indicating the framework’s ability to control threats and maintain network stability. The findings show that the convergence of blockchain, digital twin, fuzzy logic, and self-healing mechanism can provide an effective basis for the development of smart, secure, and resilient financial supply chains. Full article

Risk registers remain static governance artefacts, manually maintained and weakly coupled to operational evidence. While organisations generate continuous security telemetry from vulnerability scanners, incident reports, and audit findings, this evidence is rarely synthesised into coherent, evolving risk structures. Existing approaches address fragments of the problem: SIEM systems correlate events but do not construct risk registers; GRC platforms manage risk documentation but depend on manual entry; and LLM applications assist with summarisation but introduce non-determinism incompatible with governance requirements. This paper presents a hybrid architecture that separates stochastic LLM-based extraction from deterministic risk correlation and aggregation. The system ingests heterogeneous evidence, extracts structured claims via schema-bounded LLM processing, and correlates events into stable risk trees using anchor-based tiered matching. All correlation and projection operations are deterministic and replayable. The contribution is an architectural design pattern for integrating probabilistic inference into governance systems without compromising auditability. The walkthroughs run on a reference prototype. Replaying the stored evidence three times rebuilt the same register state, and admission scores matched the values the rules predict. An injected malformed extraction was quarantined; the register did not change. Full article

Directive (EU) 2022/2555 (NIS2) designated healthcare a sector of high criticality, with a transposition deadline of 17 October 2024. Only four of twenty-seven Member States met it: Croatia transposed eight months early and Italy one day before the deadline. Because the formal regulatory gap between them is small—and, on the primary instrument, favours Croatia—this paper asks not whether but how two Member States with near-identical transposition timelines diverge in the operational practice and transparency of healthcare-sector incident reporting. Drawing on neo-institutional theory and the economics of information security, it synthesises the literature and compares the two transposition instruments against the primary legal texts. Both reproduce the NIS2 notification timeline faithfully, so divergence cannot be attributed to differing statutory obligations. Public-reporting transparency is therefore operationalised as a measurable dependent variable: Italy’s Agenzia per la Cybersicurezza Nazionale (ACN), an autonomous agency since 2021, publishes healthcare-specific data, whereas Croatia’s National Cybersecurity Centre (NCSC-HR)—competent authority only since 2025—publishes only aggregate figures. The asymmetry is autonomy and mandate, not institutional age. A portable four-indicator transparency index is proposed and demonstrated in a two-coder pilot (κ_w = 0.80); an independent incident-composition cross-check is consistent with the asymmetry. Full article

Cilium is among the most widely deployed Container Network Interfaces (CNIs), serving as the default CNI in the Google Kubernetes Engine. It extends standard Kubernetes NetworkPolicy (KNP) with two additional types—CiliumNetworkPolicy (CNP) and CiliumClusterwideNetworkPolicy (CCNP)—each with distinct semantics. When all three coexist in a cluster, the resulting composition is difficult to reason about formally, leading to misconfiguration and security incidents. Existing verification tools, KANO and VeriKube, address subsets of the problem but share two critical limitations: neither provides a formal denotational semantics that precisely characterizes the three-layer composition, nor a canonical representation enabling policy-equivalence checking with completeness guarantees. We close this gap with three contributions. First, we develop the first formal denotational semantics for Cilium’s three-layer composed policy—KNP (additive), CNP (deny-wins), CCNP (cluster-override)—and prove that the composite function is Hyper-Rectangular Piecewise-Constant (HRPC)-like. Second, we construct a Reduced Ordered Interval Decision Diagram (ROIDD) for the composite policy space and prove a canonicity theorem—canonical for a fixed field order—enabling policy-equivalence checking as structural isomorphism in O(|ROIDD|) time. Third, we develop certified conflict-detection algorithms for shadow, redundancy, and cross-layer conflict anomalies across all three layers with formal proofs of soundness and completeness. Experimental evaluation on synthetic policies confirms zero mismatches between ROIDD evaluation and ground-truth brute force; detection of shadow, redundancy and cross-layer anomalies at precision and recall of 1.000, scored against exhaustive enumeration of the entire packet space; agreement with a live Cilium v1.19.5 data plane on every probe of a scenario built to exercise each clause of the composite semantics; ROIDD compression ratios of 5–15× over the unshared decision tree on the compressed evaluation domain; and low-microsecond (0.74–1.95 µs) per-packet lookup latency that is independent of policy size. A native C++ implementation, evaluated on the same policy dataset, reconstructs the identical decision-diagram structure and classifies each packet in under 60 ns—roughly 30× faster than the Python reference—confirming that sub-microsecond classification is inherent to the algorithm rather than an artifact of the implementation language. Full article

This paper presents a secure data sharing platform that organises KR-IBI, KR-IBE, KR-PEKS, and KR-PAEKS into an end-to-end Rust/Tauri workflow for registration, authentication, encrypted upload, searchable retrieval, and authorised decryption. The work addresses a deployment-level composition problem rather than proposing a new primitive: practical data sharing requires coordinated credential handling, payload representation, searchable indexing, session control, and record integrity across schemes with distinct interfaces. The platform supports text, file, and image payloads through a hybrid KR-IBE/HKDF-SHA-256/AES-256-GCM layer. Fresh KR-IBE key material is generated by uniformly sampling a nonzero scalar and multiplying the Ed25519 prime-order subgroup generator, providing approximately 252 bits of min-entropy before HKDF derivation. An evaluation with 100 repetitions per configuration over Enron-derived workloads containing 100–10,000 records and 1, 5, 10, or 20 authorised identities achieved 100/100 correctness for authorised retrieval and decryption, wrong-keyword and wrong-scheme rejection, and unauthorised-access rejection. KR-PEKS search latency ranged from 29.26 ms at 100 records to 3023.82 ms at 10,000 records, whereas KR-PAEKS ranged from 775.53 ms to 93,045.52 ms. These results quantify the performance distinction between the lower-latency KR-PEKS mode and the sender-authenticated searchable encryption provided by KR-PAEKS. Full article

The widespread use of Quick Response (QR) codes increases exposure to QR-code-based phishing, or quishing. This study examines the mechanisms, user behaviors, and contextual conditions that shape QR-mediated risk from a sociotechnical perspective. A structured literature review and narrative synthesis were conducted using four documented search strings. Following deduplication, screening, retrieval, and full-text assessment, 27 studies were included from 71 identified records. Two reviewers independently evaluated methodological quality using six criteria. The corpus comprised 16 technical-detection studies, five user-centered or behavioral studies, two attack demonstrations or simulations, and four reviews or preventive frameworks. The mean consensus quality score was 10.04 out of 12; 19 studies were classified as high quality and eight as moderate quality. The synthesis indicates that quishing exploits the interaction of contextual legitimacy, routine scanning, limited destination visibility, and insufficient verification before navigation or disclosure of sensitive information. These findings informed an attack lifecycle, a sociotechnical model, a user security decision flow, a risk–protection mapping, and multilevel recommendations. These literature-derived artifacts are conceptual and heuristic rather than empirically validated. Effective mitigation therefore requires QR-specific verification mechanisms combined with behavioral and technical safeguards for users, interfaces, organizations, and platforms, followed by expert, usability, and experimental validation. Full article

Artificial intelligence (AI) systems are increasingly deployed in high-stakes domains, where poisoning attacks can corrupt training data, manipulate model updates, or implant covert backdoors. This survey examines poisoning attacks in federated learning (FL), using centralized learning as a baseline to explain how distributed data, client heterogeneity, privacy-preserving aggregation, and untrusted coordination expand the threat surface. It positions prior surveys and synthesizes representative primary studies through an accountability-oriented lens focused on attribution, audit evidence, traceability, and forensic readiness. The review compares major attack classes, including data poisoning, model poisoning, backdoor insertion, server-side manipulation, Sybil behavior, collusion, and multi-round poisoning. It also evaluates countermeasures such as Byzantine-robust aggregation, anomaly detection, validation-based filtering, malicious-secure aggregation, authenticated update handling, provenance mechanisms, ledger-based evidence, and verifiable aggregation protocols. The analysis shows that robustness alone is insufficient for trustworthy FL unless defenses also preserve evidence that supports independent verification, post-incident reconstruction, and governance review. Persistent gaps remain in causal forensic attribution, privacy-preserving evidence governance, malicious-server threat modeling, scalable verifiability tooling, recovery after poisoning, and deployment-ready benchmarks. The survey concludes that accountable FL should be designed as an evidence-producing system, not merely as a privacy-preserving or attack-resistant training architecture, especially for regulated, cross-silo, and high-risk real-world deployments. Full article

Adversarial machine learning (AML), reinforcement learning (RL), and explainable artificial intelligence (XAI) are increasingly studied as separate problems, yet their interactions under realistic threat conditions remain poorly understood. This review addresses that gap through a systematic analysis of 207 studies selected from 4447 records following the PRISMA 2020 guidelines, covering work published between 2020 and 2026 across cybersecurity and computer vision. A taxonomy of adversarial attacks is constructed across training and inference phases, defense mechanisms are examined with attention to their documented failure modes, and robustness evaluation practices are assessed across the surveyed literature. RL is analyzed in both offensive and defensive roles. Attack agents using RL achieve evasion rates of 74–97% against ML-based detectors, while RL-based defenses report robustness gains of up to 3× over static baselines under comparable threat conditions. XAI receives particular attention because the field treats it almost exclusively as a transparency mechanism, whereas the reviewed evidence shows that it also functions as an attack surface. Attribution methods such as LIME, SHAP, and Grad-CAM produce unreliable explanations under adversarial perturbation, and no system in the reviewed literature certifies that attribution properties are maintained when inputs are manipulated. The review concludes with an analysis of open problems and research directions for building systems that are robust against adaptive adversaries, interpretable under operational constraints, and auditable in environments where AI accountability is a legal requirement. Full article

Small and medium-sized enterprises (SMEs) have limited resources and governance that might restrict their ability to conduct dynamic cyber risk assessment (DCRA) and maintain effective cyber situational awareness (CSA). This study investigates stakeholders’ perceptions of CSA, DCRA, and AI-enabled cybersecurity to develop a conceptual framework targeted for SMEs. The online survey was cross-sectional, and 302 completed responses were gathered. The valid sample size for the items ranged from 288 to 299. Out of 293 respondents, 54 (18.4%) indicated prior usage of CSA techniques, 21 (7.2%) reported prior use of DCRA tools, and 226 (77.1%) backed AI in the cybersecurity field. The highest rated DCRA requirements were continuous threat updates, identification of attacks and vulnerabilities, and prioritization of alerts based on risk. The highest rated implementation challenges were accuracy, relevance, and integration with current infrastructure. Four multi-item measures had good-to-outstanding internal consistency (α = 0.868–0.926; ω = 0.870–0.929), and parallel analysis supported a single factor for each. Exploratory findings suggested that Information Technology (IT) and cybersecurity professionals had greater familiarity with CSA and DCRA than did leaders and managers. There was a moderate-to-strong positive association between familiarity with CSA and DCRA (ρ = 54). The framework defines AI as a layer of analytical decision support, DCRA as the process of translating changing evidence into updated and prioritized risk information, and CSA as decision-relevant interpretation and use of that information. This framework will help SMEs to improve CSA and will help their leaders to make the right decisions when dealing with cyber threats. Full article

Digital financial reporting depends on identity services, enterprise systems, cloud platforms, automated controls and system-generated evidence. Cybersecurity weaknesses therefore enter external audit when a governance condition or control deficiency affects a material reporting process, an assertion, a disclosure, an estimate or the reliability of audit evidence. This article develops a non-deterministic control-to-assertion framework through a structured integrative review. The search, completed on 16 July 2026, covered English-language journal work published from 2000 to 15 July 2026 through Google Scholar and publisher search services. The final analytic set contains 32 peer-reviewed journal articles, four institutional sources and two public company filings used for worked application. The revision separates organisation-level cybersecurity governance deficiencies from process-level cyber control deficiencies. It also locates the model against COSO, COBIT 2019, NIST CSF 2.0, IT general control methods and relevant International Standards on Auditing. Existing sources provide taxonomies for governance, internal control, security outcomes and audit procedures. The new framework supplies the missing translation route between those taxonomies: governance condition, control state, financial reporting dependency, assertion-level misstatement risk, audit-evidence reliability, audit response and reassessment. Compensating, detective and corrective controls might interrupt or reduce the route, so no governance deficiency automatically produces a control failure or a material misstatement. Two worked documentary applications, The Clorox Company and MGM Resorts International, show how public incident facts enter account, assertion, evidence and procedure analysis. The framework does not estimate incident probability, expected loss or a cyber risk score. It provides a file-ready reasoning structure for entity-specific risk assessment under the auditing standards. Its main contribution lies in the separate treatment of misstatement risk and evidence reliability, followed by a traceable link to accounts, assertions, evidence sources, specialist input and audit procedures. Full article

Personalized phishing is difficult to defend against because messages can be tailored to a target’s work, interests, and social context. Large language models may make such tailoring faster and easier, but it remains unclear whether messages produced from simple prompts are more convincing than those written by people. This 25-target pilot study compared personalized smishing messages generated by GPT-4 with messages written by novice student authors working under time constraints. Using the proposed Threshold Ranking Approach for Personalized Deception (TRAPD), participants ranked 12 messages written for them, indicated the point at which they would intend to click, explained their reasoning, and judged whether each message was authored by GPT-4 or a human. GPT-4-generated messages elicited an intention to click more often than student-authored messages (28% versus 21%), although the difference was uncertain. More broadly, our findings suggest that a simple prompt can produce personalized messages that participants found comparably convincing within the uncertainty of this pilot study. Job-related messages were significantly more likely to elicit an intention to click than hobby- or social-media-related messages. When asked whether a message was written by a human or generated by AI, participants identified the source no more accurately than chance, although the two study-specific message sets remained computationally distinguishable based on their text. Together, these findings suggest that accessible AI-assisted personalization may increase the practical scale of social-engineering threats, while also demonstrating both the value and current limitations of TRAPD for controlled and ethical comparison. Full article

Tokens are widely used to secure client–server communications in systems based on automatic authentication. These tokens can be vulnerable to hacking, as an attacker can impersonate a real user by eavesdropping on their communications. In this paper, we propose a new authentication mechanism that generates a random token for each authentication. The token consists of confidential data and is encrypted using random coordinates from a securely stored confidential image. The client uses a random session key to encrypt the confidential image, then encrypts the token using randomly selected coordinates by matching ASCII character values with pixel values. The results and analysis demonstrate improved resistance to credential theft, replay attacks, and passive eavesdropping under the stated security assumptions. Even if hackers crack the encrypted token, decryption is difficult because the encryption method relies on values unrelated to the original authentication data. Comparison results also demonstrate efficiency and reliability compared to existing systems, as well as their ability to withstand brute-force attacks, with the entropy of the probability distribution being the best. Full article

As organizations lean more heavily on their IT systems, managing cyber risk is gaining increasing importance. Organizations are often challenged to determine which cybersecurity risk framework they should adopt. Choosing the right framework can have a significant impact on the quality of governance, operational resilience, and assurance in risk reporting. However, most prevalent cybersecurity risk frameworks vary significantly in their intent, design, and analytical approach. This makes it difficult for organizations to understand how each framework may meet their business needs. This study presents an AI-enhanced multi-criteria decision support approach for evaluating cybersecurity risk frameworks. The model incorporates machine learning-driven risk scoring as a conceptual input layer, enhancing the objectivity and analytical rigor of the comparison without executing new predictive algorithms. The methodology includes a hybrid approach of literature review, document analysis, and multi-criteria decision analysis (MCDA) to compare and rank NIST CSF, ISO 27001, FAIR, OCTAVE, and CRAMM based on eight criteria that are designed to represent modern requirements for risk frameworks, including governance, scalability, quantitative focus, and interoperability. These criteria also reflect differences in security metrics supported by each framework to provide an organized means to compare qualitative versus quantitative measurement methodologies. The results indicate that NIST CSF performs the best overall in agility, business alignment, and interoperability. ISO 27001 outperforms all others in established governance and compliance. FAIR outperforms all others in quantitative risk analysis and provides superior analytical depth that other frameworks do not offer. OCTAVE and CRAMM function well in legacy systems but lack scalability and are not well-suited for modern distributed systems. Robustness analysis shows that the ranking of NIST CSF, ISO 27001, and FAIR is consistent under different weighting combinations and industry types. The result of this research demonstrates that a combined or hybrid approach to cybersecurity risk framework selection, such as using NIST CSF with FAIR, can give organizations a more well-rounded foundation for applying machine learning-enabled risk analytics with cyber controls. This research also offers a reusable decision support tool that organizations can leverage when aligning their risk priorities to the features of cybersecurity risk frameworks. Full article

Homomorphic Encryption plays a key role in secure multi-source data aggregation because it enables computations to be performed directly over encrypted data, allowing distributed parties to contribute sensitive information while preserving confidentiality. However, its use in this context introduces three main challenges: existing approaches often focus on specific operations rather than supporting diverse analytics across multiple encrypted data sources; key generation and management frequently rely on trusted third parties or require private keys to be shared; and TEE-based solutions may avoid trusted third parties but often require computations to be partially executed inside the trusted environment, thereby limiting deployment flexibility. To address these limitations, this work makes three main contributions: (i) the proposal of a complete framework for secure multi-source data aggregation that leverages homomorphic encryption and enables any data consumer to securely run multi-source data aggregations over data previously registered by untrusted data providers; (ii) the integration of secure enclaves for the secure generation, distribution, and management of homomorphic keys, addressing challenges related to coordinated key synchronization in multi-party aggregation environments and removing the need for a trusted third party; and (iii) the introduction of a hybrid key management protocol that combines secure enclave-based key generation with efficient key distribution and secure aggregation outside the enclave, in the data consumer, minimizing trust assumptions and computational overhead. The implementation and evaluation on small-scale aggregated datasets show that the proposed approach effectively addresses the identified challenges by providing, to the best of the authors’ knowledge, the first practical and privacy-preserving solution that supports different algorithms without relying on any trusted third party, while improving over existing solutions through the integration of secure enclaves and a hybrid key management protocol. Full article

Spam detection on SMS messaging has not received as much attention from researchers recently as the spam detection studies on emails or social media platforms. However, spam SMS messaging can be more intrusive, annoying, and harmful. Thus, detecting and filtering spam SMS messages is becoming a priority that saves human productivity. This work aims to introduce a dynamic, accurate, and efficient machine learning-based spam detection technique for SMS messaging. It aims at protecting users and businesses from spam SMS attacks. It aims to detect and identify suspicious messages that contain promotional, misleading, irrelevant, or harmful content. It primarily aims to test and evaluate the impact of feature extraction methods on the performance of machine-learning-based spam detection. Several text feature extraction techniques have been used and tested, including classical, statistical, contextual, and advanced embedding techniques. An extensive set of experiments has been presented on benchmark datasets in this field. From the comparative study, we can infer that all investigated feature extraction techniques have achieved high accuracy (90%+) on the in-domain dataset. However, their performance decreased when they were tested on the out-of-domain dataset (70%+). The advanced embedding techniques achieved the best performance across both datasets compared to the other tested feature extraction models. Full article

Cyberattacks have become a routine feature of contemporary security environments, yet policy responses often treat cyber threats as undifferentiated, encouraging generic remedies while obscuring the distinct capabilities needed to address different forms of attack. This article develops an empirical exploratory typology of cyber threats affecting Thailand. Drawing on incident-level data, it uses multiple correspondence analysis and hierarchical clustering to classify attacks by actor type, motive, target industry, event type, event subtype, and attributed actor country. The findings reveal three distinct threat profiles: financial cybercrime, characterised by criminal actors and financial motives; hacktivist disruption, defined by protest motives, disruptive operations, and attacks on public administration; and nation-state political espionage, associated with state-linked actors, China-attributed activity, and exploitation of end hosts. The article argues that distinguishing among these threat profiles provides a more useful basis for threat prioritisation, capability development, and resource allocation than treating cyber insecurity as a single risk category. Full article

(1) Background: The digital traces of unmanned aerial vehicles (UAVs) are becoming increasingly important in criminal incidents, the violation of airspace and in military operations, thus making the reconstruction of the digital traces a critical task. But, current tools like DatCon, Autopsy and GRYPHON cannot recover telemetry when the flight logs are logically damaged, fragmented or partially deleted and don’t offer any quantitative measurement of the confidence of the recovered information. (2) Methods: A unified hardware-software complex, including a forensic workstation, a hardware write-blocker and SD/microSD/eMMC adapters; a set of software modules for extracting artifacts from files, structural parsing of DAT/BIN/CSV log, neural network reconstruction of missing telemetry using a two-layer LSTM architecture; a multi-source correlation module that combines flight logs, telemetry, media metadata and controller artifacts; a module, Confidence Score (CS), that computes a reliability measure in $[0,1]$; and a visualization module to generate a reconstructed trajectory on an electronic map. (3) Results: The complex has been tested on 105 flights on 10 different UAVs, 492 flight logs were gathered, 10,435 were the media item files and 624 GB was the amount of storage during acquisition. The carving stage recovers 98.7% of artifacts across the eight signature classes, the LSTM module recovers all five telemetry parameters with $R^2>0.99$ and a single-step horizontal position error of 6.8 m, which is reduced to 4.7 m after multi-source correlation (below the 5 m operational target consistent with consumer-GNSS precision); the dependence on gap length is described by the empirical growth law ${\epsilon }_{\mathrm{horiz}}\approx 4.84·G^{1.44}$ m; 46.8% of recovered records fall within the high-confidence band of $\mathrm{CS}\ge 0.8$; and the complex outperforms DatCon, Autopsy + DJI Analyzer and GRYPHON by 22–35 percentage points in end-to-end record recovery and by a factor of ∼2.6 in mean horizontal error (4.7 m vs. 12.4–18.7 m). (4) Conclusions: The combined write-blocked hardware acquisition, neural reconstruction of telemetry, and quantitative confidence index provides a forensically structured pipeline that fills an existing gap in UAV digital forensics; we note that technical reconstruction accuracy does not by itself confer legal admissibility, which remains a function of jurisdiction-specific evidentiary standards discussed in the Conclusions. Full article

This paper presents TALOS, a unified reusable 6G CryptoProcessor architecture for high-assurance symmetric security services under a 256-bit private-key baseline. The design addresses a core hardware challenge in future mobile systems: supporting heterogeneous strong symmetric primitives without duplicating complete cipher cores. TALOS combines a Hierarchical Common Data Path (HCDP) with a three-tier cryptographic encapsulation model spanning AES-256, Snow 5G/SNOW-V-class, and ZUC-256. Tier-1 captures native nonlinear substitutions, Tier-2 compiles bounded arithmetic nonlinearities into exact micro-S-boxes, and Tier-3 consolidates shared permutation, XOR, affine, diffusion, and state-transport fabrics. This decomposition preserves cipher correctness while exposing realistic sharing opportunities across substitution, arithmetic, and linear transport layers. The architecture also supports confidentiality processing and integration with integrity- and authentication-oriented service logic through a common control/resource framework. Compared with monolithic universal-box or loosely aggregated multi-core approaches, TALOS provides a disciplined, RTL-oriented taxonomy for crypto-agile symmetric-core hardware. The proposed framework advances 6G cryptographic hardware design by combining operator-exact reuse, architectural scalability, and implementation-oriented efficiency within a single CryptoProcessor paradigm. Full article

State-of-the-art generative models exhibit powerful image-generation capabilities, raising ethical and legal challenges for service providers. Consequently, Content Removal Techniques (CRTs) have emerged to control outputs without requiring full retraining. However, the problem of unlearning in Generative Adversarial Networks (GANs) remains largely unexplored. We propose Text-to-Unlearn, a novel framework that selectively unlearns concepts from pre-trained GANs using only text prompts, enabling feature and identity unlearning, as well as fine-grained tasks such as expression and multi-attribute removal in models trained on human faces. Our approach leverages natural language descriptions to guide unlearning without additional datasets or supervised finetuning, offering a scalable solution. To evaluate the effectiveness of our method, we introduce an automated unlearning assessment method using state-of-the-art image–text alignment metrics and propose a new metric: degree of unlearning. Additionally, we assess robustness by introducing adversarial attacks to subvert unlearning. Our results demonstrate that Text-to-Unlearn achieves robust unlearning, resisting adversarial attempts to recover erased concepts while preserving model utility. To our knowledge, this is the first cross-modal unlearning framework for GANs, advancing the management of generative model behavior. Full article

This case study examines an encryption failure incident involving the exposure of sensitive personal data within a governmental information system environment. The analysis is based on the well-documented data breach that occurred within the U.S. Department of Veterans Affairs, in which a government employee stored a large dataset containing veterans’ personal information on a portable laptop device that lacked adequate encryption protection. Following the theft of the device from the employee’s residence, the personal records of approximately 26.5 million individuals were placed at risk of unauthorized exposure. Rather than interpreting the incident as an isolated technical failure, this study analyzes it through the Swiss cheese model, proposed by James Reason, and formalizes them as Portable Device Data Exposure Chain (PDDEC), showing that the breach resulted from the alignment of weaknesses across multiple layers of defense. The model is compared with two post-2010 endpoint-loss incidents to provide a limited historical back-test and is positioned against data-lifecycle, defense-in-depth, and Zero Trust approaches. The analysis shows that full-disk encryption is now a baseline control rather than a sufficient or novel solution. Hardware-backed key protection, verified boot, endpoint compliance, data-loss prevention, continuous monitoring, and controls for data in use are also required because encryption can be weakened by poor recovery-key governance, authenticated malware, sleep-state memory exposure, cold-boot attacks, and direct-memory-access attacks. The study contributes a reproducible control-point model for analyzing how sensitive data becomes exposed when it is moved beyond centrally managed environments, while explicitly limiting its generalizability to analytically comparable endpoint-loss scenarios. Full article

Small businesses face many of the same cyber threats as larger organisations but often lack equivalent budgets, specialist personnel, and formal security operations capability. This paper proposes Agile Resilience in Security for Enterprises (ARISE), a lightweight cyber-resilience framework and maturity model designed for resource-constrained small businesses. ARISE adapts prevention, detection, response, and recovery into an agile lifecycle so that organisations can improve cybersecurity maturity progressively rather than through a single large compliance project. The study combines framework benchmarking, a practical interpretive case used to position ARISE within reflexive thematic analysis (RTA) and maturity-model benchmarking, and quantitative machine-learning experiments using the UNSW-NB15 intrusion-detection dataset. The experimental component evaluates selected Weka classifiers, including J48, JRip, Random Tree, Decision Table, and Naive Bayes, to examine whether low-cost tools can support network intrusion detection in small-business contexts. Results show very high aggregate performance for tree- and rule-based classifiers, while class-level outcomes highlight that overall accuracy can conceal weak detection of minority attack categories. The paper therefore positions ARISE as a practical, iterative, and standards-informed framework that complements, rather than replaces, enterprise-grade security operations. Its value lies in giving small businesses an accessible starting point for identifying risk, selecting controls, improving cyber awareness, detecting suspicious activity, responding consistently, and learning from incidents. Full article

Existing Large Language Model cybersecurity evaluations rely on text-based plausibility scoring systems that fail to validate operational exploit viability. In this paper, we present the Operational Risk Framework (ORF), advancing beyond our prior MalcodeEval work through three (3) innovations: (1) ECDSA-P384 cryptographic execution validation providing non-repudiable proof-of-exploit, (2) MITRE ATT&CK-aligned tiered scoring with CVSS v4.0-derived severity weights, (3) and six-phase progressive validation tracking 217 Indicators of Compromise within isolated VM environments. The utility of this framework is demonstrated through detailed case studies that have revealed granular disparities in capabilities and multi-stage attack progression, often obscured by standard pass/fail binary metrics. This work contributes systematic LLM-to-CVSS mapping and open cryptographic protocols toward NIST AI RMF 2.0 development. Full article

The growing reliance on cyber deception as a defensive mechanism has revealed persistent limitations in existing deception infrastructures, particularly in their ability to scale, adapt, and provide continuous observability under realistic adversarial workloads. Conventional honeypot deployments are predominantly monolithic and statically configured, which constrains their responsiveness to dynamic attack conditions and limits their applicability in contemporary distributed environments. This work presents a microservice-oriented cyber deception platform that reconceptualizes deception infrastructure as a composition of loosely coupled, independently deployable services. The platform integrates containerized honeypots, a lightweight API-driven orchestration layer, and a centralized telemetry pipeline to enable rapid instantiation, dynamic reconfiguration, and high-resolution monitoring of attacker interactions. Unlike prior approaches that treat deployment, orchestration, and monitoring as separate concerns, the proposed design explicitly unifies these components within a single, measurable system architecture. To support principled reasoning about system behaviour, the paper introduces first-order analytical models that characterize deployment latency, resource utilisation, telemetry throughput, and operational cost as functions of attacker concurrency. These models are not intended as exact predictors, but as tractable abstractions that enable interpretation of system performance and guide capacity planning. Model parameters are empirically derived and validated through controlled experimentation. Evaluation is conducted within a reproducible cyber-range environment using scripted adversarial workloads that emulate reconnaissance, authentication attempts, and sustained interactive sessions. The results indicate that containerised deployment reduces instantiation latency to approximately 1.2 s under warm-start conditions, compared to tens of seconds for virtual machine-based baselines. Resource utilisation exhibits approximately linear scaling under moderate concurrency, while the telemetry pipeline sustains ingestion rates exceeding 18,000 events per minute without observable loss. Stress testing further reveals that telemetry processing, rather than orchestration, constitutes the primary scalability bottleneck. These findings suggest that microservice-based architectures can provide a viable and extensible infrastructure substrate for cyber deception, supporting both operational deployment and integration with higher-level adaptive and learning-based defence mechanisms. The contribution of this work lies not in introducing new deception strategies, but in enabling their practical realisation through a scalable and observable system design. Full article

Phishing remains a widespread and evolving cyber threat that targets human and technical vulnerabilities across email, web, mobile, and social media. Meanwhile, digital forensics has developed into a standards-driven discipline dedicated to identifying, preserving, analysing, and presenting digital evidence. Despite overlapping goals, phishing detection research and digital forensics typically operate separately. Detection efforts emphasise classification accuracy and rapid mitigation, while forensic practices prioritise evidential integrity and incident reconstruction. The analysis suggests that incorporating forensic-quality artefacts, such as Simple Mail Transfer Protocol (SMTP) headers, Domain Name System (DNS) and Transport Layer Security (TLS) traces, memory dumps, behavioural logs, metadata, and provenance records, may support attribution analysis, interpretability, and more evidentially robust incident reporting. It covers email, network, endpoint, behavioural, and legal areas to identify common shortcomings in forensic readiness, provenance preservation, and reproducibility. Based on these insights, we propose a conceptual framework that redefines digital forensics as a proactive, ongoing capability integrated into operational phishing defences. The review highlights gaps in research, such as the limited availability and validation of AI-generated phishing datasets, privacy-aware evidence management and deanonymization risks in evidence correlation, and automated workflows for handling evidence. It also suggests future directions for integrating forensic reasoning into advanced phishing mitigation systems. Full article

Sensor networks increasingly combine exposed sensing nodes, optical communication, photonic hardware, near-sensor inference, and distributed infrastructure monitoring. This changes the security problem from protecting packets alone to establishing device provenance, measurement integrity, link confidentiality and availability, trustworthy inference, physical situational awareness, lifecycle control, and governance. This structured review with documented scoping searches examines security by light: mechanisms in which optical or photonic phenomena directly realize, constrain, compute, or observe a security-relevant function. The review synthesizes screened evidence across photonic roots of trust, visible-light communication and LiFi security, photonic intelligence, reservoir and chaotic photonics, and distributed photonic sensing infrastructure. Searches across arXiv, IEEE Xplore, ACM Digital Library, and Scopus yielded 228 deduplicated candidate records, of which 187 were retained as core evidence and eight as contextual evidence. To avoid overstating heterogeneous photonic work, retained records were separated into direct security evidence, security-adjacent capability evidence, background/framework evidence, and excluded records. The central result is architectural: light-enabled mechanisms are most defensible when they provide explicit, confidence-rated evidence to conventional security engineering. In this paper, confidence-rated evidence means evidence whose security interpretation is tied to a stated asset, adversary or failure mode, evidence role, validation setting, robustness limits, deployment fit, and reproducibility condition. This avoids treating optical novelty, spatial confinement, analog complexity, or high-dimensional dynamics as assurance by themselves. The paper develops an auditable taxonomy, evidence appraisal rubric, mechanism-family synthesis, integration architecture, maturity analysis, and research agenda for incorporating light-enabled mechanisms into secure sensor-networked systems. Full article

Privacy usability in IoT smart home companion applications remains an underexplored domain despite mounting regulatory requirements and accelerating user adoption. Heuristic evaluation offers a scalable pathway to privacy usability assessment, yet validated frameworks for applying such methods are scarce. This study presents the first empirical application of the ABCDE Privacy Framework, a ten-heuristic instrument grounded in Nielsen’s usability principles and Privacy by Design, to an IoT companion application developed with a major European home appliance manufacturer. A structured workshop was conducted with a multidisciplinary team of seven participants (five industry professionals and two researchers) following a two-round protocol: a qualitative heuristic discussion phase (Round 1) and an individual scoring phase (Round 2). Data were analysed through MAXQDA (VERBI Software, Berlin, Germany). Average heuristic scores ranged from 3.6 (H9: error recovery) to 4.8 (H6: recognition; H10: documentation), with an overall mean of 4.32. Six second-order themes were identified, including Transparency Asymmetry, Centralised but Decontextualised Privacy, and Shared Household Complexity. This first pilot application suggests that the ABCDE Privacy Framework is feasible, time-efficient, and analytically productive in this industrial context, generating design-relevant insights and enabling cross-role team alignment within a two-hour session. These preliminary findings indicate its potential as a tool for Privacy-by-Design practice in IoT product development and provide a basis for future replication and validation. Full article

Cybersecurity conformity assessment is increasingly shaped by the Radio Equipment Directive (RED) delegated act, the EN 18031 harmonized standards, the Cyber Resilience Act, and industrial standards such as International Electrotechnical Commission (IEC) 62443. ISO/IEC 17025:2017 provides a general laboratory competence framework, but its application to qualitative cybersecurity testing, rapidly changing toolchains, and automation-assisted evidence workflows remains under-specified. This paper proposes a digitalized quality-management framework that translates ISO/IEC 17025 clauses into cybersecurity-native controls for scope definition, method governance, toolchain control, evidence traceability, decision rules, technical review, and corrective-action feedback. An accreditation-style single-laboratory case study integrates a European Telecommunications Standards Institute (ETSI) TS 103 701 assessment workbook, an IEC 62443 corrective-action dataset, ISO/IEC 17025 internal audit findings, and laboratory governance records. In the ETSI workbook, the Conformity Statement Ambiguity Index (CSAI) decreases from 0.976 in the draft state to 0.050 after review, with 37 previously inconclusive provisions moving to PASS. This result is interpreted as improved determinability within the assessed workflow, not as cross-laboratory validation. The study contributes a clause-to-workflow operationalization of ISO/IEC 17025, an analytic design for heterogeneous assurance artefacts, and an EN 18031 evidence-mapping approach for Radio Equipment Directive readiness. Full article

The rapid advancement of modern deep neural networks (DNNs) has played a crucial role in aiding humans across many real-world applications; yet, their hardware accelerators have been proven to be vulnerable to malicious attacks. One particularly severe and serious attack involves inserting a hardware Trojan (HT) into DNN accelerator hardware in order to enable attackers to stealthily manipulate model predictions during the supply chain. In this paper, we present a possible stealthy HT architecture that is difficult to detect and has a significant impact on the performance of DNN models. To successfully achieve this goal, we introduce the Sensitivity-Based Weight Selection (SBWS) algorithm, a novel technique that adapts machine learning (ML) sensitivity analysis to identify and modify a small number of weights that have the highest impact on DNN performance, compared to previous work. We evaluate the proposed attack on five DNN model tests (two distinct DNN models and four different datasets) using two designed payload types (weight zeroing and sign-flipping) and record the results based on various security metrics. The experimental results show average accuracy reductions of 26.7% for the zeroing attack and 48.1% for the sign-flipping attack, yielding an overall average of 37.4%, calculated over five independent runs per dataset with standard deviation <2%. The sign-flipping technique consistently outperforms zeroing because it preserves the magnitudes of the attacked weights while inverting their signs, thereby disrupting the learned decision boundaries more severely and amplifying error propagation in subsequent layers. These results significantly exceed those of previous random-weight perturbation attacks (typically 12–20% drops) and other targeted HT approaches while incurring lower computational and hardware resource overheads. This work provides a more effective and scalable method for assessing the vulnerability of DNN accelerators under real supply chain threat models. Full article

Quantum computing presents a critical threat to the cryptographic basis of metaverse platforms, with Shor’s algorithm capable of breaking traditional public-key cryptography and Grover’s algorithm significantly weakening symmetric encryption. The present self-sovereign identity (SSI) ecosystems are built on classical cryptographic systems that are susceptible to quantum attacks; hence, there is an immediate need for quantum-secure identity management in persistent virtual environments. This article proposes a solution called Quantum-Resistant MetaSSI (QR-MetaSSI), which is a comprehensive model that integrates NIST-standardized post-quantum cryptography (PQC) with W3C-compliant SSI principles. We design lattice-based decentralized identifiers (PQ-DIDs), hash-based verifiable credentials (PQ-VCs), and a hybrid authentication protocol that meets the needs of the metaverse, such as latency, interoperability, and persistent identities. The framework is subjected to mathematical modeling and simulation studies. Our study indicates that QR-MetaSSI keeps the authentication delay below 150 ms, which is inside the VR comfort range with 128-bit quantum security. Besides that, a comparative evaluation reveals that the proposed solution drastically reduces the risk of a quantum attack compared with classical ECC-based SSI systems at a level of computational overhead that is completely reasonable. QR-MetaSSI is a major step forward in the security of the metaverse, providing not only theoretical bases but also practical implementation instructions for the migration to quantum-resistant identity management. This framework not only addresses the most important breaches in security but also keeps the performance standards that are necessary for the creation of virtual environments that are highly immersive. Full article

Homomorphic Encryption (HE) has emerged as a promising approach for data processing without exposing sensitive information. Despite significant advances, the practical strategies for the integration of HE into widely used database management systems (DBMSs) remain limited due to performance constraints and architectural challenges. This paper explores HE integration strategies within DBMS, focusing on SQL Server, PostgreSQL, and MariaDB. A methodology is proposed to assess the feasibility and performance of multiple HE schemes, including BFV, CKKS, BGV, TFHE, Paillier, and RSA (without padding). The evaluation considers different integration strategies, namely Python-based execution and native C++ extensions, across Windows and Debian environments. Experimental results obtained from four configurations demonstrate that the choice of HE scheme and integration strategy significantly impacts performance. Lattice-based schemes (BFV, CKKS, BGV) provide a balanced trade-off between functionality and efficiency, while TFHE incurs high computational costs due to its bit-level design. Native C++ integrations consistently outperform Python-based approaches, although the latter offer greater flexibility and ease of development. The findings highlight the feasibility of integrating HE into DBMS while emphasizing the importance of selecting appropriate schemes and integration mechanisms to meet application-specific requirements. The proposed evaluation framework provides preliminary insights into the relative behavior of different HE schemes and integration strategies under controlled experimental conditions, supporting future work on privacy-preserving DBMS design. Full article