Skip to content

Free for nonprofits, NGOs, think tanks, and institutes. Grant funded by James Scott, administered by the Embassy Row Project.

ArtOfTheHack home

Critical Infrastructure

Read First. Model Second. Act Only Within Authorized Boundaries.

In essential systems the cost of an unnecessary containment action can exceed the cost of the intrusion. ArtOfTheHack models cyber-physical consequence before any response is proposed, and it never assumes authority over a physical process.

Sectors

Environments Where Disruption Is a Safety Event

  • Energy
  • Utilities
  • Transportation
  • Communications
  • Financial infrastructure
  • Water
  • Industrial systems
  • Healthcare infrastructure
  • Public systems

Operating principles

Safety Constrains the Decision Space

Response options that cannot satisfy the safety case are never presented for approval.

Operational safety

Safety cases constrain every response option before it is presented.

Human authority

Named operators retain authority over any action touching a physical process.

Cyber-physical consequence

Consequence modeling includes process, safety, and continuity effects.

Segmentation

Reasoning respects zone and conduit boundaries rather than flattening the network.

Reversibility

Actions without a validated reversal path are advisory only.

Native fallback

Loss of ArtOfTheHack availability never impedes native operator control.

Controlled response

Read first. Model second. Act only within authorized boundaries.

Auditability

Every recommendation and approval is reconstructable for regulators.

Governance rail

  • Human in the loop
  • Approval thresholds
  • Separation of duties
  • Policy constraints
  • Reversibility checks
  • Blast-radius limits
  • Audit logging
  • Compliance mapping
  • Kill switch
  • Native fallback

Intelligence does not equal authority. KRYOS-XS Hypercube may analyze. Policy determines authority. Approved systems execute.

Consequence modeling

Compare the Response Before the Process Is Affected

Options are scored for risk reduction, operational disruption, reversibility, confidence, and estimated blast radius.

Illustrative platform visualization. Values are examples, not grantee organization telemetry.

ArtOfTheHack does not exercise autonomous control over physical infrastructure. Operators retain native control at all times, and a loss of platform availability does not impede that control.