Calibrating the Cybersecurity Adapter

Automated vulnerability discovery and AI-assisted exploit generation have changed the economics of offensive security. The pace at which novel attack chains can be assembled is now bounded by compute rather than human analyst time, while defensive operations still depend heavily on matching known indicators after an intrusion is underway.

KAIROS Cyber operates alongside existing SIEM, EDR, and XDR pipelines to answer a structural question rather than a signature-matching question. While a classifier asks whether an event matches a known attack pattern, the KAIROS cybersecurity adapter measures how much operational margin a defended network zone retains before its weakest control gives way. Because that reading depends on zone geometry rather than threat signatures, it surfaces structural zero-day early warning even when the exploit itself has never been catalogued.

To establish a transparent, reproducible baseline prior to partner deployments, AnankeLabs calibrated the cybersecurity adapter against published security benchmarks and executed a 60-day synthetic reference run across 60 network zones at 60-second resolution (5,184,000 zone snapshots).

How the Adapter Evaluates a Network Zone

The cybersecurity adapter models each defended network zone as a structure under load at every 60-second tick:

• Attack-surface pressure ($\Lambda$) aggregates indicators of active stress across the zone, including anomalous authentication pressure, lateral traversal attempts, privilege escalation activity, egress anomalies, and exploit complexity. It is governed by its highest-severity indicator so a sharp spike along a single vector immediately registers on the zone score.
• Defense posture ($\Gamma$) aggregates the structural controls holding the zone together, including network microsegmentation, control depth, patch and configuration hygiene, telemetry completeness, identity enforcement, and responder headroom. Because a zone is only as resilient as its most degraded barrier, defense posture is governed by its weakest control.

At each tick, the adapter ingests normalized zone telemetry (aligned with OCSF 1.x) and emits a cryptographically sealed signal envelope containing the stability margin, the gate verdict, and the primary structural drivers. Unlike autonomous agent governance, where actions propagate along a multi-step trajectory, network zone monitoring is evaluated through an observation-shaped runtime that scores each 60-second window directly against the deployment policy without carrying trajectory artifacts across unrelated hosts.

The Reference Run

Parameter	Value
Random seed	42
Defended zones	60
Simulation window	60 days
Tick resolution	60 seconds
Total snapshots	5,184,000
Execution time	30.2 minutes (release build, 8× replay parallelism)

Cell distributions across the 144-cell calibration matrix were anchored to primary industry and government references: the Verizon Data Breach Investigations Report (DBIR 2024 and 2025), NIST SP 800-53 Rev. 5, NIST SP 800-207 (Zero Trust Architecture), CIS Controls v8 maturity surveys, the Open Cybersecurity Schema Framework (OCSF 1.8.0), the Los Alamos National Laboratory (LANL) Unified Host and Network dataset, and the DARPA Operationally Transparent Cyber corpus.

Following the dataset-provenance methodology of Engelen et al. (2021), every calibration cell is tagged by evidentiary confidence:

• Strong (10%): Two or more independent public sources converge on the distribution.
• Moderate (32%): Anchored to a single authoritative empirical source.
• Weak (12%): Derived from analogous operational measurements.
• Synthesised (46%): Constructed from documented structural reasoning where no public dataset reports normalized $[0, 1]$ distributions (primarily in near-miss pentest profiles and exploit-sophistication scaling).

Publishing the exact synthesised share is central to the study. Most cybersecurity benchmarks blend empirical and fabricated features without disclosure; surfacing the 144-cell provenance map makes every assumption auditable and defines the exact target for partner data integration.

Baseline Results and the Internal-Segment Finding

At the default policy floor of $0.20$, the table below shows the per-zone-hour policy-positive rate across four standard enterprise zone archetypes under quiet and noisy-but-benign operating conditions ($n = 7,200$ zone-hours per cell):

Zone Archetype	Quiet Baseline	Noisy-but-Benign Baseline
Identity plane	0.60%	0.67%
Data plane	1.46%	1.96%
Edge device	28.07%	26.74%
Internal segment	98.08%	96.49%

The identity plane (0.60%) and data plane (1.46%) behave as tight, well-instrumented zones where strong authentication and access controls maintain a healthy structural margin. The immediate standout is the 98.08% policy-positive rate on the median enterprise internal segment.

At first glance, a 98% flag rate on benign internal traffic looks like a calibration anomaly. Closer inspection against the underlying empirical sources shows that the model is quantifying a structural reality that security practitioners have described qualitatively for years:

• Verizon DBIR (2024/2025): Lateral-movement controls remain inconsistently deployed, leaving most corporate internal networks effectively flat once a perimeter is breached.
• NIST SP 800-207: Internal microsegmentation is consistently the least completed requirement in enterprise Zero Trust migrations.
• CIS Controls v8 Surveys: Internal network monitoring and segmentation sit among the lowest-maturity control families across surveyed organizations.

When empirical Beta distributions reflecting those survey numbers are evaluated against a strict $0.20$ structural floor, a median enterprise internal segment fails the posture check on nearly every tick, even when no attacker is present. Rather than hiding that result by tuning the numbers to look flattering, the calibration preserves it: the engine is reporting that a flat internal network has almost zero structural buffer against lateral movement.

Policy Floor Sensitivity Sweep

Because enterprise zones vary widely in control maturity, the policy floor is exposed as a tunable operator threshold. Sweeping the floor illustrates how the baseline responds as the posture requirement is relaxed:

Policy Floor	Pooled Headline Rate	Internal-Segment Rate
0.20 (default)	31.76%	97.28%
0.10	0.69%	2.65%
0.08	0.69%	2.65%
0.05	0.69%	2.65%

At a $0.10$ floor, the internal-segment rate drops from 97.28% to 2.65%, isolating only the windows where multiple controls degrade simultaneously. The residual 2.65% floor across lower thresholds reflects promote-only human-review escalations triggered when an individual critical control collapses near zero, independent of the aggregate band threshold.

Why “Policy-Positive Rate” Replaces “False-Positive Rate”

Standard intrusion-detection benchmarks equate “benign window” (no active attacker) with “healthy window” (no alert should fire). In structural posture monitoring, those two conditions are distinct.

A network zone can experience zero malicious traffic while sitting one misconfiguration away from uncontained lateral movement. We therefore report policy-positive rate (the fraction of windows where structural margin falls below the operator’s chosen policy floor) rather than false-positive rate. Separating policy compliance from threat presence allows security teams to calibrate zone floors to match actual architectural maturity before turning on automated containment.

Scope Boundaries and Partner Calibration

The v1 synthetic baseline carries explicit scope boundaries that our design-partner program is built to close:

• Synthetic baseline telemetry. While anchored to DBIR, NIST, CIS, and LANL distributions, the 5.2-million-snapshot corpus is synthetically generated, with 46% of cells relying on modelled distributions. Replacing those cells with redacted production OCSF exports is the core milestone for v1.1.
• Uncoupled default sampling. Cross-metric correlations are disabled by default in v1 so baseline rates reflect documented marginal distributions rather than unverified correlation estimates.
• Cloud data-plane scope. Data-plane telemetry anchors in v1 are modelled on AWS CloudTrail patterns; Azure and GCP control-plane anchors are scheduled for partner calibration.

AnankeLabs is collaborating with security operations teams able to contribute a 30-to-90-day redacted OCSF 1.x export (or equivalent 60-second windowed zone telemetry) across one or more zone archetypes. Raw identifiable telemetry never leaves the partner environment. Full schema details, redaction rules, and labeling protocols are documented in the Cybersecurity Partner Data Specification.

Reproducibility

Every artifact in the study is hash-anchored to the calibration specification, the pinned OCSF 1.8.0 schema commit, and the per-zone snapshot digests. Two independent executions from seed 42 produce byte-identical reports, OCSF samples, and manifest digests across all 5,184,000 snapshots.

To discuss partner calibration, independent replication, or a scoped evaluation against recorded SOC telemetry, contact AnankeLabs. For architectural context, see the Cybersecurity domain overview, the Autonomous Agent Boundary Study (BND-001), and the companion AI Safety Adapter Calibration Study.