22 cybersecurity concepts every PM already knows โ mapped to the NI-Stack innovations that implement them at a depth no competitor matches.
Inspired by Okan Yฤฑldฤฑz's viral post on cybersecurity vocabulary for project managers.
โก This is the SSOT version โ updated to V95 (March 2026, 8M prompts benchmarked)
Not just who accesses โ cryptographic proof of WHAT was done
PR.AA โ Identity Management, Authentication, and Access Control
Per-prompt granularity (not per-session). Post-quantum signatures (ML-DSA). Cryptographic non-repudiation.
Attestation overhead: <0.3ms per prompt
Claims 1-15 (POAW Core)
Zero-knowledge identity verification โ no central authority needed
PR.AA โ Authentication mechanisms
Decentralized identity (no SPOF). Web-of-trust vouching. eIDAS 2.0 ready.
Auth latency: <50ms including vouching verification
Identity Architecture v3.4
Each of 114 agents has mathematically bounded authority
PR.AA โ Authorization policies
Per-layer capability bounding (not per-user). Compile-time enforcement. 114-agent depth (V95).
Authorization check: <0.1ms per layer
Claims 16-30 (AEGIS Cascade)
Each layer operates at the minimum entropy budget needed โ mathematically optimized
PR.AA โ Least privilege enforcement
Applied to AI defense LAYERS, not just users. Mathematical optimization via ฯ-series. Self-tuning (V36โV42).
Calibration precision: 12-Sigma quality standard
Claims 31-45 (Stellschrauben)
Every prompt is untrusted until cryptographically proven safe โ not network-level, PROMPT-level
PR.AA + PR.DS โ Zero Trust Architecture
Prompt-level granularity (industry: network-level). Per-interaction attestation. No implicit trust ever. 114-agent cascade (V95).
Full cascade latency: <4ms P95 for text prompts
Claims 1-15, 46-60 (POAW + ZTA Extension)
Response in <100ms โ not hours. Automated containment, not manual escalation.
RS.MA โ Incident Management + RS.AN โ Analysis
<100ms automated response (industry: hours). Self-adjusting thresholds. Entropy budget containment.
Mean time to containment: <100ms
Claims 61-75 (SIREN Core)
Compliance proof generated automatically โ not manually assembled for audits
GV.OC โ Organizational Context + GV.RM โ Risk Management
Automatic proof generation (not manual documentation). Reproducible decisions. Multi-framework alignment (NIST + ISO + EU AI Act + NIS2).
Audit export: <5 seconds for full compliance package
Claims 76-90 (Nachvollziehbarkeit)
Data never leaves your infrastructure. Post-quantum encrypted at rest and in transit.
PR.DS โ Data Security + PR.PS โ Platform Security
Post-quantum cryptography (ML-KEM/ML-DSA). 100% self-hosted. Zero cloud dependency. EU data residency.
PQC overhead: <2ms per handshake
PQC Integration Architecture
Prevents external APIs from reverse-engineering your defense intelligence
ID.SC โ Supply Chain Risk Management
Protects safety INTELLIGENCE from extraction (not just data). Anti-inference noise injection. Patented mechanism.
Extraction resistance: >99.7% against model inversion attacks
Claims 319-333 (Anti-Extraction Shield)
AI phishing (prompt injection) = traditional phishing for machines โ we detect both
DE.CM โ Continuous Monitoring + DE.AE โ Adverse Event Analysis
AI-native phishing detection (not email-only). Multi-layer cascade depth. 12D semantic analysis.
TPR: 99.4% | FPR: <3% | Latency: <4ms
Claims 16-30, 91-105 (AEGIS Shield Phase)
Detects malicious INTENT, not malicious signatures โ catches zero-day threats
DE.CM โ Adverse event detection
Intent-based detection (not signature-based). Zero-day capability. 12D spatial analysis.
Zero-day detection rate: >94% on novel adversarial prompts
Claims 106-120 (Semantic Analysis)
Can't ransom what's cryptographically proven to exist elsewhere
RC.RP โ Recovery Planning + RC.CO โ Recovery Communication
Cryptographic proof of pre-incident state. Quantum-Merkle tamper evidence. Verifiable recovery.
Recovery verification: <1 second for Merkle proof validation
Claims 121-135 (STENO + Recovery)
Defense patches ITSELF. No manual patch cycles.
PR.PS โ Platform Security (patch management)
Self-improving (no manual patches). Continuous calibration. Mathematically optimized (ฯ-series).
Calibration cycles: V36โV42 (6 major versions in 3 months)
Claims 136-150 (Stellschrauben Calibration)
Not quarterly risk reviews โ CONTINUOUS, per-second risk scoring
ID.RA โ Risk Assessment
Real-time (not periodic). 12-Sigma precision. Per-second telemetry. Live dashboard.
12-Sigma: 0.000000002 DPMO
Claims 151-165 (GTM Metrology)
114-agent deep packet inspection for AI traffic
PR.DS โ Data Security
114-agent depth (traditional: 3-7 layers). AI-native analysis. <4ms latency. Per-slot isolation.
42 layers | <4ms P95 | 3-phase architecture
Claims 16-30 (AEGIS Core Architecture)
Bank-grade PQC already deployed โ protects against future quantum computers
PR.DS โ Data confidentiality and integrity
Post-quantum cryptography (NIST FIPS 203/204). Already deployed (most banks: planning stage). Hybrid classical+PQC.
Handshake: <2ms | Top 26% EU bank security posture
PQC Architecture Documentation
Continuous adversarial assessment, not annual pentests
ID.RA โ Vulnerability scanning
Continuous (not annual). Open API for external researchers. Self-mutating adversarial corpus.
Chaos Mode V5: 5 mutation strategies | 10K+ adversarial test cases
Red Team API v1 Documentation
Industry's first OPEN AI safety penetration testing API
ID.RA โ Penetration testing and red teaming
Open API (competitors: closed). External researcher access. Anti-extraction protected.
Only open AI safety testing API in the industry
Red Team API + Anti-Extraction Shield
Real-time threat pattern recognition across 12 dimensions
DE.AE โ Adverse Event Analysis
12-dimensional semantic analysis. Cross-layer signal correlation. Obfuscation-resistant detection.
12D analysis detects obfuscated attacks that 2D NLP misses
Claims 166-180 (Heim 12D)
Security documentation IS the architecture โ not a separate document
GV.PO โ Policy documentation
Automatic generation (not manual). Unforgeable (cryptographic). Always current. Architecture-embedded.
Documentation freshness: real-time (zero staleness)
Nachvollziehbarkeit Architecture
Share 8M adversarial results publicly without exposing a single attack payload โ Rosetta Stone verification proves the methodology
GV.SC โ Supply Chain Risk Management + PR.DS โ Data Security
Privacy-preserving benchmark sharing (industry: proprietary or unverifiable). Tiered access = revenue from safety data. Rosetta Stone = radical transparency.
8.06M fingerprints | 3 tiers | 32/32 tests | SHA-256 irreversible
Claims 2012-2023 (NI V6 Prompt Fingerprinting + Tiered Export)
76-epoch bio-inspired optimization โ ants find paths humans can't calculate
PR.PS โ Platform Security (automated defense optimization)
Bio-inspired self-optimization (no vendor offers this). 76-epoch convergence. No manual threshold tuning needed.
V95: TPR=95.45% | FPR=3.71% | 8.06M prompts | 76 ACO epochs
Claims 136-150 (Stellschrauben) + ACO Extension
The NI-Stack doesn't just MAP to NIST โ it ENCOMPASSES it. Every function covered, plus capabilities that go beyond the framework.
POAW governance, Nachvollziehbarkeit engine, Compliance automation
ฯ-harmonic cascade tuning, Self-improving governance (V36โV42), Multi-framework compliance (NIST+ISO+EU AI Act+NIS2)
AEGIS D1-D8 threat identification, Red Team API, Chaos Mode V5
12D Heim spatial pattern analysis, Self-mutating adversarial corpus, Open external testing API
AEGIS SHIELD phase (42 layers), Anti-Extraction Shield, PQC encryption
Self-improving defense (ฯ-tuning), Prompt-level Zero Trust, Post-quantum cryptography (deployed)
SIREN feedback loop, Real-time TPR/FPR metering, 12D Heim analysis
Anticipatory defense (Torwart predictive), Sub-100ms detection, Obfuscation-resistant 12D analysis
SIREN auto-containment, Entropy budget throttling, Graduated severity
<100ms automated response, Self-adjusting thresholds, Entropy budget containment (no cascade failure)
POAW audit trail, Chaos Mode post-incident learning, Quantum-Merkle sealing
Cryptographic proof of pre-incident state, Self-improving from adversarial encounters, Tamper-proof recovery evidence
The NI-Stack maps to AI safety and cybersecurity legislation across 10 jurisdictions worldwide โ covering every major regulatory framework from the EU AI Act to China's Cybersecurity Law to Singapore's Agentic AI Governance. Click any region to explore.
6/6 functions mapped โ GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, RECOVER
Dec 2025 โ NO vendor has published a product mapping yet. NI-Stack is FIRST.
AI Risk Management Framework mapped via Nachvollziehbarkeit engine
All 10 vulnerability categories covered with specific AEGIS layers
Red Team testing mandate satisfied via open Red Team API
NIST CSF 2.0 Superset | NISTIR 8596 First Mapper | OWASP 10/10 | Executive Order compliant
Per-prompt Zero Trust (not per-session). 114-agent cascade depth. Self-improving defense (ฯ-tuning). Open Red Team API.
Art. 9 Risk Management (POAW), Art. 15 Accuracy/Robustness (12-Sigma), Art. 55 Red Teaming (Red Team API)
Sovereign architecture = data never leaves infrastructure. Data minimization by design.
72-hour breach notification supported by real-time SIREN telemetry.
Software security-by-design. POAW provides lifecycle audit trail.
SSI architecture aligns with EU Digital Identity Wallet. DID:key + KERI support.
AI Management System requirements covered by Nachvollziehbarkeit engine.
EU AI Act (Art. 9, 15, 55) | GDPR by design | NIS2 72h reporting | ISO 42001 | eIDAS 2.0
Sovereign self-hosted (EU data residency). Post-quantum cryptography deployed. Automatic compliance proof generation.
AI ethics, risk monitoring, safety oversight. Amended Jan 2026.
Content labeling via POAW cryptographic provenance.
Algorithm transparency via Nachvollziehbarkeit & cascade decision logging.
Synthetic content identification via STENO provenance tracking.
Sovereign architecture supports data localization requirements.
CSL (2026) AI safety | GenAI content provenance | Algorithm transparency | PIPL data sovereignty
Cryptographic content provenance (not just labeling). Self-hosted = inherent data localization.
NI-Stack exceeds voluntary guidelines with verifiable safety.
Evaluation criteria met by AEGIS cascade + GTM metrology.
International Code of Conduct โ transparency, safety, adversarial testing all covered.
SIREN provides real-time threat monitoring. AEGIS = proactive defense.
Vision through 2030. NI-Stack aligns with safety-first innovation.
AI Basic Act | J-AISI evaluation | Hiroshima Process Code of Conduct | ACDA proactive defense
Exceeds voluntary guidelines with cryptographic proof. Nachvollziehbarkeit ~ Kaizen continuous improvement.
First comprehensive AI law in APAC. High-impact AI obligations met by AEGIS + POAW.
Generative AI labeling via POAW content attestation & STENO provenance.
Nachvollziehbarkeit provides reproducible decision audit for ethics review.
Sovereign self-hosted = deployment in any jurisdiction.
AI Framework Act high-impact compliance | GenAI labeling | Ethics committee auditability
Verifiable safety (not just reported). Self-hosted = Korean data sovereignty. 12-Sigma exceeds any requirement.
Groundbreaking framework for autonomous AI. POAW = per-agent attestation.
Transparency, fairness, security principles architecturally embedded.
Transparency, human-centricity, reliability covered by Nachvollziehbarkeit.
NI-Stack already implements 2030 aspirational goals.
AEGIS cascade provides defense-in-depth for critical infrastructure AI.
Sovereign architecture inherently meets data protection requirements.
IMDA Agentic AI (first mover!) | ASEAN AI Guide | SG Cyber Amendment Act | PDPA
Specifically designed for agentic AI governance. Per-agent POAW attestation unique globally.
7 foundational sutras โ transparency, accountability, fairness architecturally embedded.
Compliant via sovereign architecture & data minimization.
Synthetic content labeling via POAW provenance tracking.
Responsible AI adoption. NI-Stack provides verifiable safety infrastructure.
IndiaAI 7 Sutras | DPDPA data protection | SGI deepfake labeling | IT Act compliance
Cryptographic proof of AI decisions (not just policy). Open Red Team API for Indian researchers.
Innovation-first approach. NI-Stack provides safety without stifling innovation.
6 essential practices architecturally embedded, not just followed.
Red Team API provides infrastructure for AISI evaluation.
Sovereign architecture meets existing privacy law requirements.
PQC encryption exceeds baseline security requirements.
National AI Plan | AI6 Guidance (6/6 practices) | AISI evaluation-ready | Cyber Security Act
Exceeds voluntary guidance with mandatory-grade verifiable safety. PQC ahead of AU banking sector.
Risk-based classification. AEGIS cascade provides high-risk compliance evidence.
Sovereign self-hosted = inherent LGPD compliance. Data minimization by design.
Running through Dec 2026. NI-Stack qualifies as responsible AI innovation.
NI-Stack bridges EU AI Act & Brazil AI Act compliance simultaneously.
AEGIS cascade meets minimum cybersecurity standards for procurement.
Brazil AI Act (risk-based) | LGPD data protection | ANPD Sandbox eligible | EU-Mercosur bridge
Bridges EU and Mercosur compliance simultaneously. Sovereign deployment = Latin American data sovereignty.
Sector-specific, principles-based. NI-Stack provides cross-sector safety.
Frontier AI safety commitments met via Red Team API and 12-Sigma metrology.
NI-Stack designed for external model evaluation.
Sovereign architecture meets UK data protection. PQC exceeds current standards.
Pro-Innovation Framework | Bletchley Declaration | UK AISI evaluation-ready | UK GDPR
Cross-sector applicability. Open research API supports UK innovation agenda.