Information and Cyber Security
New papers in information and cyber security, the code and data they release, and the open problems their authors admit. Rebuilt every day from OpenAlex and arXiv.
New papers
Cybersecurity in the Digital Era: Implications for Financial Reporting and Audit
This article examines cybersecurity as an emerging risk in financial reporting and financial audit, within a context shaped by the accelerated digitalisation of accounting systems and the increasing frequency of cyber incidents.
A STRIDE-Based Threat Taxonomy for Digital Showcase Platforms in Vocational Higher Education
Digital showcase platforms have become central to how vocational higher education institutions publish student portfolios and project artifacts.
Traceable Privacy and Cybersecurity Compliance Control Baseline for Indonesian Academic Information Systems
This study develops a traceable privacy and cybersecurity compliance control baseline for Indonesian academic information systems.
Cyber security: Challenges, Threats and Modern Solutions
Abstract Cyber security is the practice of protecting computers, networks, software, systems, and data from unauthorized access, attacks, damage, or disruption.
Privacy Governance for the Healthcare Internet of Things
The Healthcare Internet of Things (H‑IoT) has expanded the volume, velocity and sensitivity of patient data in clinical settings.
Who Wins the Window? Agentic Vulnerability-Response Benchmarks Measure Model Competence, Not Vulnerability Difficulty
A measurement-validity study of agentic CVE benchmarks.
ISO/IEC 27001:2022 – From Compliance Framework to Cyber-Resilient Operating Model
This practitioner white paper examines how ISO/IEC 27001:2022 can be applied beyond compliance-driven implementation to establish a measurable, risk-based and continuously improving cybersecurity operating model.
Vehicle ECU On-Board Diagnostic system Threat Analysis and Risk Assessment
This article presents a security assessment of the on-board diagnostic (OBD) system integrated into a vehicle's electronic control unit (ECU), specifically targeting the Unified Diagnostic Services (UDS) protocol.
From corporate digital responsibility to responsible cybersecurity: unpacking the role of substantive digital transformation
Purpose As digital-related threats affect organizations and stakeholders, understanding how firms develop responsible cybersecurity has become essential.
Unpacking top management team judgment in ethical cybersecurity disclosure: navigating transparency and confidentiality in corporate reporting across an emerging economy
Purpose This study aims to examine how Saudi executives make cybersecurity disclosure decisions in a rapidly changing digital environment.
GuardiaMCP: A Free, Offline, Test-Verified Defensive Layer for the Model Context Protocol
The Model Context Protocol (MCP) lets AI assistants such as Claude, Cursor and VS Code call external "servers" that can read local files, use the user's credentials and inject instructions into the model's context.
Prompt-Injection Defences on a Small Local Agent: What Works, What It Costs, and How Optimistic Development Numbers Are
An AI agent that reads email, files and web pages for a user can be hijacked by instructions an attacker plants in that data: indirect prompt injection.
Digital Literacy and Infrastructure Risks
This chapter focuses on the vulnerabilities of digital infrastructure: the networked systems, databases, platforms, authentication processes, communication channels, and information environments that sustain contemporary public life.
API Security: A Review of Vulnerabilities, Detec-tion Methods, and Emerging Defences
This paper presents a review of four recent peer-reviewed sources on API security (a systematic review of security-API misuse detection, a systematic review of web API vulnerabilities and developer challenges, an overview of API protection across the software development life cycle, and a…
The Defendability Bounds: Architectural Conditions of Governability under Generative Adversaries
The series' deposited papers locate the frontier of detection: the content channel collapses operationally under budgeted mimicry [Rouxel 2026a, Hypothesis 3.12, Theorem 3.13], the temporal escape closes [Rouxel 2026b, Corollary 4.2, Corollary 4.4], durable resistance rests on three…
Deconstructing the Binance Exploit: An On-Chain, Infrastructure, and Predictive Analysis of the October 2026 Breach
On October 29–30, 2026, Binance experienced an unprecedented security breach resulting in gross asset movements estimated at USD 6.360 billion, with USD 5.912 billion independently confirmed as stolen on-chain.
Bibliometric Analysis of Cybersecurity Complexity in Cloud Computing
The growth and integration of cloud computing with other advanced technologies (such as Artificial Intelligence (AI) and other security technologies and architectures) have introduced different cybersecurity challenges and opportunities that require academic investigation.
Governance and Operational Security of Business WhatsApp Group Portfolios: Administrator Lifecycle, Employee Offboarding, Brand Impersonation and Recordkeeping
Organisations that use WhatsApp groups at scale rarely run one group.
Enterprise Agent Identity Governance Framework (EAIGF): A Policy-Mediated Identity and Access Governance Model for Autonomous Digital Workforce Systems
This paper proposes the Enterprise Agent Identity Governance Framework (EAIGF), which treats autonomous agents as first-class enterprise identities subject to lifecycle management, quantitative trust classification, privileged access governance, and end-to-end accountability.
Pair-Level Candidate Generation for Threat Early Warning over Temporal Security Knowledge Graphs
Threat early warning must flag suspicious actor interactions from open-source intelligence ahead of time.
Released code and data
Improving vulnerability-scores: Leakage-Free Splits and Consistent CVSS 4.0 Scoring
The new dataset is split by vulnerability group: rows sharing a description, an identifier or an alias always end up in the same split.
An Empirical Evaluation of Attack and Defense Dynamics in Enterprise Agentic LLM Pipelines
The code is available at https://github.com/patrickikhidero/agentic-llm-security and archived at https://doi.org/10.5281/zenodo.23717855.
Deleted, Corrected, Still Retrieved: Incomplete Forgetting of Superseded Facts Across Derived Copies in Enterprise Retrieval Stores
The old value also held the top rank in 91.6 percent of queries in the first corpus and 83.4 percent in the second.
Alignment of Autonomous Cyber Defense Agents via Adaptive Policy Shaping
Our code is publicly available at https://github.com/ITM-Kitware/alignment-cage-challenge-2.
Design and evaluation of adaptive AI-based user experience models for mitigating phishing and social engineering attacks in the U.S. banking sector: A data paper with a synthetic benchmark dataset
The data and all Python code are released for teaching, power analysis and method testing Keywords: Phishing, Social Engineering, Adaptive User Experience, Explainable Artificial Intelligence, Banking Security, Synthetic Data, Logistic Regression.
Verification as a Public Good: Groups, Protection Delegation and Action-Bound Rules against Social Engineering
Sources, bibliography and figures: https://github.com/JoeRu/trust-is-engineered (CC BY 4.0)
Decompression and Archive Extraction Vulnerabilities: A Taxonomy of 21 Attack Mechanisms Across 1,067 Public Cases (2001–2026)
The inventory, taxonomy, CWE crosswalk, benchmark protocol and a proposed, untested review checklist are released to classify new records, evaluate advisory-text classifiers and repeat the study.
Engineering Calibrated Trust between Humans, Agents and Machines: Evidence Accounts, Decay and Re-verification
Sources, bibliography and figures: https://github.com/JoeRu/trust-is-engineered (CC BY 4.0)
Trust is Engineered: An Evidence Model of Trust, Distrust and the Calibration Gap
Sources, bibliography and figures: https://github.com/JoeRu/trust-is-engineered (CC BY 4.0)
Narratives Mislead: An Empirical Study of How LLMs Misjudge CVSS Severity in Bug Bounty Reports
From 4,281 publicly disclosed reports mined from Huntr and HackerOne, we build a benchmark of 240 Huntr reports with vendor-validated CVSS vectors and evaluate eight LLMs under four prompting strategies and fine-tuning, measuring errors by severity class and score and analysing sub-vectors on individual reports.
Open problems authors admit
Cyber security: Challenges, Threats and Modern Solutions
The paper also discusses challenges and effects and future directions for building safer digital systems.
GuardiaMCP: A Free, Offline, Test-Verified Defensive Layer for the Model Context Protocol
We describe the threat model, the design, the detection approach, and an honest account of what the tool does not cover.
API Security: A Review of Vulnerabilities, Detec-tion Methods, and Emerging Defences
The paper then details a proposed framework architecture, data and tooling requirements, an evaluation plan with specific metrics, expected outcomes, and a discussion of limitations and future work.
Predictive Analysis of Cybersecurity Risks Through Employee Behavior Modeling
Future work should validate the framework using a documented dataset, measurable behavioral indicators, and an appropriate evaluation method.
RS-2026-087 KILLKEY: Hardware Presence as Kill-Switch Authentication
We document the REGICIDE survival analysis, architecture, wire protocol, defensive module positioning, and the KILLKEY-LEASE future work direction.
AIHPRA: Evidence-Led Multi-Agent Assessment for Web Application Security
The paper describes the system architecture, testing methodology, findings, limitations, and future research directions.
Cybersecurity in Accounting Environments
The analysis offers implications for practitioners and directions for future research.
Integrated Cybersecurity Risk Assessment and Threat Modelling Framework (ISACRATF) for Smart Agriculture in South Africa and Sub-Saharan Africa
Expert and field evaluation of the framework is reserved for future research.
Cyber Threat Intelligence and Incident Reporting
The chapter details CTI4BC’s architecture, implementation, and compliance assessment, concluding with future directions including full automation, expanded interoperability, and advanced anonymization for unstructured data.
Multi-Modal AI System for Real Time Insider Threat Recognition
Although the system shows better performance compared to traditional methods, challenges related to computational complexity and real-time deployment remain areas for future work.