kube-monkey

kube-monkey kube-monkey is an implementation of Netflix's Chaos Monkey for Kubernetes clusters. It randomly deletes pods in the cluster, encouraging and validating the development of failure-resilient services. Apps opt in with a label, terminations happen during the hours and days you pick, and...

toxiproxy

Toxiproxy Toxiproxy is a framework for simulating network conditions. It's made specifically to work in testing, CI and development environments, supporting deterministic tampering with connections, but with support for randomized chaos and customization. Toxiproxy is the tool you need to prove...

owtf

Offensive Web Testing Framework OWTF OWASP OWTF helps penetration testers stay efficient and aligned with security standards such as the OWASP Web Security Testing Guide, the OWASP Top 10, PTES, and NIST so that they have more time to: See the big picture and think outside the box. Efficiently...

kube-score

kube-score kube-score is a tool that performs static code analysis of your Kubernetes object definitions. The output is a list of recommendations of what you can improve to make your application more secure and resilient. You can test kube-score out in the browser with the online demo source...

chaosmonkey

Chaos Monkey randomly terminates virtual machine instances and containers that run inside of your production environment. Exposing engineers to failures more frequently incentivizes them to build resilient services. See the documentation for info on how to use Chaos Monkey. Chaos Monkey is an...

Preparing an AI-Augmented SIEM for the EU Cyber Resilience Act: A Practitioner Case Study

The EU Cyber Resilience Act CRA, Regulation EU 2024/2847, makes product cybersecurity a lifecycle obligation for products with digital elements on the EU market: risk assessment, vulnerability handling, conformity documentation, and Article 14 incident- and vulnerability-reporting readiness must ...

reachproof

ReachProof Evidence-backed EU Cyber Resilience Act Article 14...

RobResilience: Implementing and Evaluating a Resilience Framework for Cyber-Physical Embodied Systems

In embodied cyber-physical systems, active cyberattacks pose an immediate threat not just to data, but to physical integrity and human safety. While existing security approaches excel at detection, they lack the runtime mechanisms to determine whether a disruption is tolerable or if performance...

cra-watch

cra-watch Does anything you ship have a known-exploited vul...

BlueSTAR: Tiered Agentic Architecture for Autonomous Cyber Defense

Cyber attacks are increasingly automated, narrowing the time available for human analysts to detect, reason about, and respond to intrusions. Large language models LLMs offer a promising foundation for autonomous cyber defense because they can correlate heterogeneous evidence and reason about...

Towards a Resilience-Theoretic Foundation for Adversarial Robustness in Industrial Control System Anomaly Detection

Anomaly-based intrusion detection systems in industrial control systems ICS and operational technology OT environments are increasingly required to meet formal resilience criteria: absorbed adversarial disturbances, graceful degradation under sustained attack, and certified system-level guarantee...

WAPP: Safe Learning of Positive Security WAF Policies from Live Traffic

Web Application Firewalls WAFs mainly rely on signatures to detect known attacks, which can leave gaps against modified or previously unseen payloads. Positive security provides a complementary approach by learning legitimate traffic and blocking inputs that fall outside the learned profile...

SiNMULI: Novel Signed Network Approach for Malicious URL Identification

In today's era of rapid advancements in artificial intelligence, computer security and online safeguarding measures have undergone significant improvements. However, malicious websites continue to facilitate the spread of phishing schemes, fraudulent activities and unsolicited communications...

ATOBench: Tracing How Autonomous Penetration-Testing Agents Verify Vulnerabilities When Target Evidence Lies

Autonomous penetration-testing agents rely on target responses. These responses guide both subsequent actions and the final report. A deceptive response can therefore redirect both the attack trajectory and the agent's verification process. However, final reports reveal little about how an agent...

EUVD-2026-56724

CVET-EOP...

QUIC-TRIP: A Triple-Redundant Journey toward Secure Substation Communications

Modern power systems rely on real-time substation communication protocols, such as the Routable Generic Object-Oriented Substation Event R-GOOSE, for critical control and protection functions. However, these protocols often lack built-in security features and prioritize availability over...

AI Deployment and Cyber Governance Failures in Public-Sector Organizations: A Typological Analysis

The intersection of artificial intelligence adoption, cybersecurity governance, and public sector institutional constraints has not been examined as a unified analytical problem in the existing literature. Studies address AI cybersecurity risks generically, public sector governance independently,...

A Structuration Approach to Theorizing Cybersecurity Practice: The STARC Model

The problem: Cybersecurity practice runs simultaneously across analysts, teams, organizations, sectors, and regulators, co-evolves with adversaries, and increasingly blends human and algorithmic decision-making. The theories applied to it operate at single organizational levels and cannot explain...

Towards Secure and Trustworthy DAOs for Cross-Chain Governance

Cross-chain DAOs face unique security challenges that go beyond traditional single-chain vulnerabilities. This paper identifies and categorizes four critical attack vectors in cross-chain DAO governance: bribery attacks, token control exploits, human-computer interaction deceptions, and protocol...

Siemens Desigo CC

SUMMARY OpenSSL has published a stack based buffer overflow vulnerability that allows a remote attacker to cause a denial of service DoS or potentially allow for remote code execution. Siemens has released new versions for several affected products and recommends to update to the latest...