SecODD adapts vehicle design domains to cyber defense agents
Original title: SecODD: Adapting the Operational Design Domain from Driving Autonomy to Autonomous Cyber Defense
Automated defensive actions would be allowed only when bounded, interruptible, recoverable, and reconstructable from evidence.
The paper proposes SecODD, an execution-time governance framework for autonomous cyber defense agents that SOCs may use for detection, triage, and containment. It adapts the operational design domain idea from autonomous-vehicle regulation, defining authorized action scope, when humans must still be able to intervene, and auditable due-care conditions through a Mitigation Safe Harbor. Four requirements—tamper-evident logging, human-in-the-loop orchestration, rollback playbooks, and safe-state controls—are illustrated with a per-scenario audit matrix for two failure modes.
Unconfirmed: The text proposes and illustrates the framework; it does not report a deployed evaluation.
- Erroneous high-impact playbooks can disrupt services and blur accountability.
- The audit matrix turns two failure modes into pass or fail outcomes.
- The paper presents a framework, not a reported production deployment.
From the original article
1 min read at arxiv.orgSecurity operations centers are beginning to delegate detection, triage, and containment to Autonomous Cyber Defense (ACD) agents at execution time. Erroneous high-impact playbooks can disrupt critical services and create accountability gaps among deployers, SOC supervisors, vendors, managed service providers, and infrastructure providers.
By Jina Kang · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.