CARM Decision Risk Engine
Executives require defensible containment plans during active network intrusions.
Operational Objective
Cyber Adversary Reflex Mapping (CARM) dictates containment pacing. Analysts propose kinetic network actions. The engine evaluates operational urgency against compliance mandates, adversary retaliation probability, and asset recovery costs.
The algorithm issues strict directives. Evidence confirms high-risk actions demand executive oversight. Low-risk, high-urgency actions receive immediate approval.
Outcome: The engine translates proposed network isolation or data destruction into an APPROVE, DENY, or HOLD verdict.
Engine Parameters
- Compliance Exposure (1-10): Evaluates NIS2 or GDPR regulatory violations triggered by the proposed action.
- Retaliation Probability (1-10): Calculates the likelihood the adversary executes a dead-man switch or destructive payload upon detection.
- Recovery Impact (1-10): Measures the financial and operational cost of restoring the isolated or wiped asset.
- Confidence (1-5): Analysts rank source reliability and data quality to establish intelligence validity.
1. Proposed Containment Action Log Actions
2. Action Decision Ledger
| Proposed Action | Urgency | Risk Score | Conf % | Verdict | Action |
|---|---|---|---|---|---|
| No actions logged. Enter data above. | |||||
3. Executive Execution Directives
The engine translates calculated risk into definitive operational commands. Analysts detect, analyze, expose, counter, and contain the threat based strictly on the issued verdict.
Risk vs. Urgency Matrix
Context Driver Distribution
Formal Decision Record
CARM Parameter Methodology
Analyst guide for configuring the Cyber Action Risk Management engine.
Operational Scope
Cyber Action Risk Management (CARM) dictates containment pacing. Analysts propose kinetic network actions. The engine evaluates operational urgency against compliance mandates, adversary retaliation probability, and asset recovery costs.
The algorithm calculates an aggregate risk score. Executives require defensible containment plans during active network intrusions. The Adaptive Cyber Intelligence Lifecycle translates raw numbers into a strict operational directive.
Proposed Containment Action
Analysts describe the exact kinetic measure under consideration. Common examples include wiping a compromised server, isolating a specific subnet, or severing external vendor connections. The text input establishes the baseline record for the formal decision log.
Context Drivers
Evaluators measure the organizational environment surrounding the proposed action. The engine balances immediate necessity against external legal frameworks.
Operational Urgency (1-10)
Analysts calculate the necessity for an immediate response.
- Scale 1-3: Dormant indicator. The threat remains contained or inactive.
- Scale 4-7: Active intrusion. Adversaries conduct lateral movement.
- Scale 8-10: Imminent data exfiltration or encryption. High urgency scores frequently force an APPROVE verdict.
NIS2 / Compliance Exposure (1-10)
Intelligence operators evaluate regulatory risk triggered by executing the action.
- Scale 1-3: Negligible legal impact. The action involves internal test environments.
- Scale 4-7: Moderate exposure. The action disrupts non-essential customer services.
- Scale 8-10: Severe violation. The action severs critical infrastructure or triggers mandatory government reporting. High compliance scores generate a HOLD directive.
Threat Variables
Operators quantify the destructive consequences of the proposed containment measure. The engine weighs adversary reactions against internal rebuilding costs.
Dead-Man Switch / Retaliation (1-10)
Analysts calculate the probability the adversary executes a destructive payload upon detecting the containment effort.
- Scale 1-3: Automated script. Retaliation is almost certainly not programmed.
- Scale 4-7: Interactive human operator. An even chance exists for a retaliatory response.
- Scale 8-10: Advanced Persistent Threat. Evidence confirms it is almost certain the adversary triggers a dead-man switch. Extreme retaliation scores combined with low intelligence confidence force a DENY verdict.
Recovery Cost Impact (1-10)
Evaluators measure the financial and operational toll required to restore the targeted asset after wiping or isolation.
- Scale 1-3: Trivial rebuild. Automated scripts restore the virtual machine in minutes.
- Scale 4-7: Significant disruption. Manual restoration requires multiple engineering shifts.
- Scale 8-10: Unrecoverable asset. The action destroys irreplaceable legacy architecture.
Sourcing Confidence
The engine calculates the mathematical reliability of the underlying evidence. Analysts grade the raw collection data to establish an overall confidence percentage.
Data Quality (1-5)
1 represents fragmented, unverified telemetry. 5 confirms pristine, triangulated forensic evidence. Accurate analysis demands verified facts.
Source Reliability (1-5)
1 denotes a historically deceptive source. 5 confirms an established collection asset. Reliable sources increase overall confidence percentages.
Algorithmic Synthesis & Directives
The CARM engine processes raw integers into an aggregate risk score (1-10). The algorithm weighs adversary retaliation and compliance exposure heavily against operational urgency. The final logic dictates the appropriate Cognitive Army response.
APPROVE Low Risk / High Urgency
The mathematical necessity to act overrides minor compliance or recovery concerns. Intelligence operators detect, analyze, expose, counter, and contain the threat immediately.
HOLD Moderate Risk / High Compliance Exposure
The proposed action triggers severe legal reporting requirements or massive recovery costs. The engine pauses execution. Executives review the formal decision record to balance operational necessity against corporate liability.
DENY Extreme Risk / Low Confidence
Evidence indicates probable adversary retaliation. Poor source reliability fractures the justification for action. The engine strictly prohibits the proposed containment measure to prevent unforced catastrophic failure.
