- Overview
- Attack Efficiency Analysis
- Invisible Exposure Matrix
- Observation-to-Disclosure Model
- Synthetic Scenario Lab
- Evidence & Provenance
- Research Methodology
Research Methodology
An unobserved event is not necessarily an absent event. An unverified exposure is not necessarily an active compromise.
Research question
Under what conditions does decreasing observed attack activity fail to indicate decreasing security exposure?
Model definitions
Actual activity, observed signals, confirmed compromise, and public disclosure are separate analytical populations. Attack efficiency is a descriptive confirmed-success proportion inside one bounded population.
Measurement units
Requests, attack attempts, campaigns, alerts, targeted assets, confirmed compromises, and public incidents are not interchangeable.
Denominator limitations
Unknown, zero, or mismatched denominators return NOT ESTIMABLE. Public incident counts are never divided by network request counts.
Observation bias
Sensors capture a subset of activity. Changes in what is watched can look like changes in what happened.
Sensor coverage
Missing coverage remains UNKNOWN. AEIE v0.1 does not estimate unobserved attack populations.
Verification bias
Unverified success is not confirmed compromise. Insufficient evidence is HOLD.
Disclosure bias
Faster or more complete reporting can raise public counts without raising underlying incidents.
Temporal comparability
Proportions are comparable only when window, unit, deduplication, and coverage are documented.
Synthetic scenario assumptions
Scenario Lab uses floor(n × p) expected counts and an explicit independence assumption. Outputs are labelled SYNTHETIC.
Confidence interpretation
A measurable proportion is descriptive. It is not a calibrated probability and does not authorize causal claims.
Causal inference limitations
AEIE does not assign causes to rate changes. LAC's efficiency reading remains a hypothesis.
Known exclusions
Unsupported AI attribution for the Japanese disclosure series is excluded from confirmed findings. Overseas campaign reports are a different population.
Operational safety boundaries
Operational authorization is NOT PROVIDED. Scanning, credential testing, intrusion simulation, firewall changes, account disabling, escalation, and external notification remain DENY.