Zero-Day Early Warning, Read From Geometry

Automated vulnerability discovery and AI-assisted exploit reproduction have shifted the balance in security operations: the speed at which novel attack chains emerge is now bounded by compute rather than human analyst capacity.

KAIROS Cyber operates alongside existing SIEM, EDR, and XDR pipelines to answer a structural question rather than a signature-matching question. While a classifier checks whether an event matches a known attack pattern, the KAIROS cybersecurity adapter calculates how much operational margin a defended network zone retains before its weakest control gives way. That reading provides a signature-free early-warning surface even when the exploit itself has never been seen before.

Evaluating a Zone Under Load

The cybersecurity adapter evaluates each defended network zone at 60-second intervals along two competing axes. Attack-surface pressure ($\Lambda$) tracks active stress across authentication, privilege, lateral movement, and egress vectors using a maximum-severity rule so a sharp spike along a single vector is never diluted by quiet neighbors. Defense posture ($\Gamma$) tracks the structural controls holding the zone together using a weakest-link rule so a single degraded barrier governs the remaining buffer.

Every 60-second evaluation produces a cryptographically sealed signal envelope anchored to the active calibration and policy digests, allowing independent operators to replay the same telemetry to an identical verdict.

Quantifying the Flat Internal Network

We executed a 60-day, 60-zone synthetic baseline at 60-second resolution (5,184,000 snapshots) anchored to primary security references: Verizon DBIR 2024 and 2025, NIST SP 800-53 and SP 800-207, CIS Controls v8 maturity surveys, OCSF 1.8.0, the LANL Unified Host and Network dataset, and the DARPA Operationally Transparent Cyber corpus.

At the default $0.20$ policy floor, the per-zone-hour policy-positive rates across the four enterprise zone archetypes were:

Zone Archetype	Quiet Baseline	Noisy-but-Benign Baseline
Identity plane	0.60%	0.67%
Data plane	1.46%	1.96%
Edge device	28.07%	26.74%
Internal segment	98.08%	96.49%

The standout figure is the 98.08% policy-positive rate on the median enterprise internal segment. Rather than a calibration flaw, this number puts a quantitative figure on what empirical security surveys have reported qualitatively for years:

• Verizon DBIR (2024/2025): Lateral-movement controls are inconsistently deployed, leaving most corporate internal networks effectively flat once a perimeter is breached.
• NIST SP 800-207: Internal microsegmentation remains the least completed requirement in enterprise Zero Trust adoption.
• CIS Controls v8 Surveys: Internal network monitoring consistently ranks among the lowest-maturity control families.

When empirical distributions from those surveys are evaluated against a strict $0.20$ structural floor, a typical unsegmented internal network fails the posture check on nearly every tick, even in the absence of an active attacker. Relaxing the policy floor to $0.10$ lowers the internal-segment rate to 2.65%, giving security teams an explicit threshold to match policy strictness to zone maturity.

Full Methodology Study

The complete study is published in Calibrating the Cybersecurity Adapter. It details the 144-cell provenance and confidence-tag grid, the policy-floor sensitivity sweep, the distinction between policy-positive rate and false-positive rate, and the deterministic reproduction anchors.

Partner Calibration

AnankeLabs is collaborating with security operations teams able to contribute a 30-to-90-day redacted OCSF 1.x export covering one or more zone archetypes. Raw identifiable telemetry never leaves the partner environment.

The full ingestion schema, labeling protocol, and redaction rules are documented in the Cybersecurity Partner Data Specification. To scope a partner calibration or replay evaluation, contact AnankeLabs.