Cyber Knowledge
Engineering notes you can inspect and challenge.
These field notes show how Kythos AI approaches defensive research, secure AI, authorized testing, endpoint configuration, application control, and remediation. They explain the boundary, evidence, decision path, change, and verification standard.
2026 vulnerability volume
A live rate needs a definition, a date window, and a source.
NVD publication snapshot
11.15 CVE publications per hour
70,379 NVD publications from January 1 through September 20, 2026: 267.60 per day, 0.186 per minute, or one every 5 minutes 23 seconds.
Interpretation
Publication is not discovery.
A private finding, reserved CVE ID, published CVE Record, NVD enrichment, CISA KEV entry, and detected zero-day exploitation are different events.
Live intelligence
CISA KEV and NVD monitor
Browse the complete current CISA KEV snapshot and every NVD CVE in the site’s fixed rolling 48-hour publication window.
New field guides
Research, endpoint defense, and controlled configuration.
Measurement
CVE volume in 2026
A reproducible NVD year-to-date snapshot, official CVE Program quarterly figures, per-hour and per-minute rates, and the limits of the word “discovered.”
Vulnerability response
Zero-day, CVE, and KEV are not synonyms
Understand what can be counted, why global zero-day totals are unknowable, and how to prioritize exposure and evidence.
Authorized research
Bug bounty hunting starts with scope
Translate policy into an executable boundary, minimize proof, protect data, stop safely, and report reproducibly.
Detection engineering
YARA, EDR, and a defensible lab
Build stable YARA rules, evaluate endpoint detection on evidence and operations, and isolate research without losing provenance.
Development note
Application allowlisting engineering
Kythos AI’s current development direction for inventory, signer context, policy simulation, exceptions, staged enforcement, telemetry, and recovery.
Configuration management
Windows CMMC baseline support
An audit-first PowerShell package for selected ASR, GPO/registry-style policy, Defender, Firewall, and audit settings—with rollback and explicit compliance limits.
Long-form defensive library
Six technical guides for building stronger defense.
Each article treats cybersecurity as an engineering system: establish authority and evidence, connect the conditions, test the proposed control, preserve rollback, and verify the result.
Vulnerability engineering
Evidence-linked vulnerability discovery and triage
Move from scanner output to a defensible exposure decision using provenance, reachability, privilege, business context, compensating controls, and validation.
Application security
Secure code review and threat modeling as one system
Join architecture, trust boundaries, source, dependencies, identities, deployment state, and abuse cases before accepting a finding or fix.
Security operations
Detection engineering and incident response
Design telemetry, detection logic, investigation paths, containment, recovery, and verification around decisions defenders must make under pressure.
Threat analysis
Controlled malware analysis
Build an isolated, evidence-preserving workflow for behavior, artifacts, indicators, uncertainty, containment guidance, and defensible handoff.
Remediation
Zero-day mitigation and patch validation
Establish exposure, reproduce safely, compare controls, review patch shadows, stage deployment, monitor, and prove closure.
Advanced methods
The defensive failures steady-state scans miss
Temporal exposure, negative-capability tests, evidence contradiction, control composition, recovery-path equivalence, and connector authority.
Field note 01 · Zero-day response
From urgent disclosure to a controlled patch path.
Bound exposure
Identify affected versions, reachable instances, privileges, data, dependencies, and existing controls. Unknown inventory stays labeled unknown.
Validate in isolation
Reproduce only the minimum behavior needed inside a lab. Preserve versions, inputs, logs, and crash or trace evidence.
Choose the smallest safe control
Prefer a vendor fix. Where none exists, evaluate configuration mitigations, feature isolation, detections, or a candidate source patch with rollback.
Prove closure
Repeat the test, run regression cases, stage deployment, monitor, and document residual risk and expiration of temporary controls.
Field note 02 · Air-gapped AI
Air-gapped is an operating model, not a checkbox.
Supply chain
Pin model and runtime artifacts, verify hashes and signatures where available, inventory licenses, and define a controlled import path.
Data and memory
Map sources, classification, access, embeddings, caches, conversation state, logs, backup, retention, and deletion inside the boundary.
Tools and identity
Give each connector a named identity, allowlisted actions, bounded credentials, audit events, timeouts, and human approval for consequential changes.
Evaluation and updates
Maintain fixed behavior and security tests, measure drift, and treat every model, tool, prompt, or package update as a controlled change.
Independent research boundary
A defensive, human-reviewed scope.
AI-assisted research may include vulnerability discovery and triage, code security review and threat modeling, detection engineering and incident response, controlled malware analysis, and remediation and patch validation.
Kythos AI research is restricted to systems Kythos AI owns or is explicitly authorized to assess. Public references to CVE, CISA KEV, NVD, NIST, MITRE ATT&CK, Microsoft, YARA, bug-bounty platforms, or vendors identify third-party resources only. They do not imply sponsorship, endorsement, certification, affiliation, partnership, reseller status, pass-through access, or provider approval.
Apply the method