<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
     xmlns:atom="http://www.w3.org/2005/Atom"
     xmlns:dc="http://purl.org/dc/elements/1.1/">
  <channel>
    <title>TLCTC Blog — Top Level Cyber Threat Clusters</title>
    <link>https://www.tlctc.net/#blog</link>
    <description>Essays, analyses, and case studies on the TLCTC framework — a cause-oriented cyber threat taxonomy of 10 mutually exclusive clusters anchored in a Bow-Tie risk model.</description>
    <language>en-us</language>
    <lastBuildDate>Mon, 15 Jun 2026 19:27:32 GMT</lastBuildDate>
    <atom:link href="https://www.tlctc.net/feed.xml" rel="self" type="application/rss+xml" />
    <generator>generate-feed.py (TLCTC)</generator>
    <item>
      <title>Knowledge an Agent Can Read — TLCTC × the Open Knowledge Format</title>
      <link>https://www.tlctc.net/okf-tlctc-integration.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/okf-tlctc-integration.html</guid>
      <pubDate>Mon, 15 Jun 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>AI Security</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[Why the TLCTC taxonomy now ships as an Open Knowledge Format (OKF) bundle — a tree of plain markdown files with YAML frontmatter, generated from the canonical JSON schemas, white paper, and Control Matrix so LLM agents and RAG pipelines can consume the framework directly. The bundle is a rendered view, never a hand-maintained fork: build-okf.js renders 412 single-purpose concept documents (clusters, axioms, rules, spheres, contexts, glossary, attack-paths, mappings, controls) and validate-okf.js enforces OKF conformance, with a deterministic rebuild via 'npm run validate'. The controls/ section renders the full TLCTC × NIST CSF matrix — sixty control-objective cells with ISO 27001:2022 Annex A starter controls — plus the control-effectiveness model (CDE_max, CDE_fitness, COE, ECR) and the Detection Coverage Score (DCS = MTTD / Δt) tied to attack velocity. Generated content is labelled as generated: ISO and CWE placements are flagged starter/experimental while the authored taxonomy — clusters, axioms, rules — stays frozen. The argument: a cause-oriented shared language only keeps its promise in the agent era if the machines we delegate to can read it cleanly, from one source of truth, honest about what is authored and what is assistance.]]></description>
    </item>
    <item>
      <title>From Model Access to State Power — Fable 5, Mythos 5, and Capability Sovereignty</title>
      <link>https://www.tlctc.net/fable-mythos-tlctc.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/fable-mythos-tlctc.html</guid>
      <pubDate>Sun, 14 Jun 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Strategic Threat Intelligence</category>
      <description><![CDATA[A TLCTC v2.1 reading of the sixty-day Fable 5 / Mythos 5 episode, where frontier-model access stopped being a commercial product decision and became an instrument of national-security policy. The thesis: a frontier model is not an eleventh threat cluster — it is a technology enabler in the Tech Enablers Overlay and Actor Capability Landscape that raises actor capability across the existing ten clusters (especially #1 Abuse of Functions, #2 Exploiting Server, #3 Exploiting Client, #7 Malware) and compresses attack-path Δt for attackers AND defenders. Argues that agentic AI changes #1 structurally — scope expansion, not just speed — because an agent is a legitimate-function-invocation engine whose reach scales with the operationalisation stack, not the model weights. Covers the defender's mirror (cause-side prevention), the Δt-against-Δt contest that decides whether AI improves or degrades security, a two-dimensional offensive/defensive capability landscape, and why U.S. export-control exclusion of foreign nationals is a capability-sovereignty dependency rather than a #10 Supply Chain Attack. Keeps the model, the government, and the export-control letter out of the threat clusters by Axiom IV.]]></description>
    </item>
    <item>
      <title>CISA BOD 26-04: A Step in the Right Direction — But Still Not an Attack-Path Model</title>
      <link>https://www.tlctc.net/tlctc-cisa-bod-26-04.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-cisa-bod-26-04.html</guid>
      <pubDate>Thu, 11 Jun 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards &amp; Critique</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[CISA's Binding Operational Directive 26-04 (released June 10, 2026) retires mandatory CVSS triage and moves federal vulnerability management toward risk-based remediation — prioritizing on public exposure, KEV exploitation, exploit automation, and degree of system control, with a three-day patch clock for vulnerabilities meeting all four. It even mandates a compromise assessment, conceding that a patch does not evict an actor already inside. From a TLCTC view this is real progress but an incomplete grammar: the directive still treats a vulnerability as a single remediation object, not as a node in an attack path. TLCTC supplies the missing cause-side layer — the Δt velocity classes that name why automation matters (VC-3/VC-4), attack-path constellations like #2 → #7 and #2 → #2 that distinguish a data-leak flaw from an RCE-enabler, the || boundary operator that marks where the control regime changes, and Bow-Tie separation that keeps DRE outcomes off the threat axis. Includes a TLCTC-compatible vulnerability record schema (initial_cluster, likely_constellations, velocity_class, compromise_assessment_required) and a Case A vs Case B prioritization contrast showing why two equally 'urgent' CVEs are structurally different attacks.]]></description>
    </item>
    <item>
      <title>CVE-2026-50751 — The Classic #2 → #1: Why "Authentication Bypass" Is an Outcome, Not a Cause</title>
      <link>https://www.tlctc.net/cve-2026-50751.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/cve-2026-50751.html</guid>
      <pubDate>Mon, 08 Jun 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Case Study</category>
      <description><![CDATA[A TLCTC decomposition of CVE-2026-50751, a logic-flow weakness in Check Point Remote Access VPN's IKEv1 certificate-validation path. The advisory labels it 'authentication bypass' — an outcome, not a cause. The actual generic vulnerability is a server-side protocol flaw (#2 Exploiting Server, TLCTC-02.10). Three post-bypass attack paths follow the classic #2 → SRE → #1 shape, with Qilin ransomware as the observed post-exploitation tail (medium confidence). Explains why #4 Identity Theft and #5 Man in the Middle are wrong clusters here, why the NVD 9.1 vs vendor 9.3 scoring gap exists, and why server-hardening controls — not credential controls — are the right response. Maps the SRE pivot as a detection window between exploit and consequence.]]></description>
    </item>
    <item>
      <title>MCP and Agents Through the TLCTC Lens — The Tool Is Not the Threat</title>
      <link>https://www.tlctc.net/mcp_agents_tlctc_blog.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/mcp_agents_tlctc_blog.html</guid>
      <pubDate>Sat, 06 Jun 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Threat Analysis</category>
      <description><![CDATA[A TLCTC v2.1 cause-side reading of MCP (Model Context Protocol), AI agents, and offensive tooling suites such as HexStrike and BOAZ-style payload layers. The thesis: MCP is not a new threat cluster and agents are not a new cluster — they are capability and velocity amplifiers for existing TLCTC attack paths. Classification happens at the atomic action, not the tool label: legitimate tool/API/CLI abuse is #1, server-side flaws #2, client-side #3, credential application #4, MitM #5, capacity exhaustion #6, FEC execution #7 (R-EXEC), human manipulation #9, and third-party trust acceptance #10 (anchored at the Trust Acceptance Event). Includes a tooling-category translation table (C2, initial access, credential modules, recon, lateral movement, privilege escalation, evasion, exfiltration), a HexStrike/BOAZ capability vector with a 10-cluster capability radar, attack-path archetypes, Δt velocity compression, Bow-Tie / DRE separation, and a control-implications matrix. Operator workflow vocabulary is not the same as TLCTC clusters.]]></description>
    </item>
    <item>
      <title>What CIS Cannot See — The Blind Spot in One Chart</title>
      <link>https://www.tlctc.net/what-cis-cannot-see.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/what-cis-cannot-see.html</guid>
      <pubDate>Sat, 06 Jun 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards &amp; Critique</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[A short visual companion to 'Why CIS Cannot Answer Your Cyber Threat Risk.' A framework that measures attack frequency by asset class can never detect over-investment by cause — and here is that blind spot in one chart. Map all 153 CIS Controls v8.1 Safeguards onto the ten TLCTC clusters and the preventive distribution is wildly lopsided: 19 controls land on #2 Exploiting Server, exactly 1 on #6 Flooding, 5 on #5 Man in the Middle. The asset axis (Devices 74%, Users 50%, ...) and the cause axis are orthogonal — you cannot derive one from the other — so CIS RAM's expectancy engine has no coordinate in which 'server exploitation outnumbers flooding nineteen to one' can even be written down. A blind spot is not an error; it is a region the instrument cannot resolve. The fix is free: adopt the ten clusters underneath, keep Impact × Expectancy, the reasonableness test, and the legal translator intact.]]></description>
    </item>
    <item>
      <title>153 Safeguards. 74 Objectives. — CIS Controls v8.1 → TLCTC Cell Mapping</title>
      <link>https://www.tlctc.net/cis-v81-mapping.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/cis-v81-mapping.html</guid>
      <pubDate>Sat, 06 Jun 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards &amp; Critique</category>
      <category>Tools &amp; Applications</category>
      <description><![CDATA[The evidence companion to 'Why CIS Cannot Answer Your Cyber Threat Risk' — the full cell-by-cell mapping of every CIS Controls v8.1 Safeguard onto the TLCTC 10×6×2 matrix. The earlier prediction of a ≥60-objective reduction is now a count: 153 Safeguards resolve to 74 cell-pure objectives, a net reduction of 79. Two independent drivers produce it: 48 Safeguards fail the granularity floor (pure enablers — inventory, process, governance rows that act on no cluster and cannot be measured to target-zero), and 34 umbrella Safeguards (e.g. 7.4 Application patch management spanning #2/#3/#10) de-aggregate then de-duplicate into shared cells. A per-(cluster, side) load table shows every cluster is already covered on both Bow-Tie sides — adoption is a re-anchoring, not a rebuild — while exposing the 19-to-1 preventive skew toward #2 Exploiting Server. Direction and magnitude are robust; the precise integer is pending ratification against the canonical TLCTC strategy set. DoCRA stays on top, untouched.]]></description>
    </item>
    <item>
      <title>Why CIS Cannot Answer Your Cyber Threat Risk</title>
      <link>https://www.tlctc.net/cis-cannot-answer.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/cis-cannot-answer.html</guid>
      <pubDate>Sat, 06 Jun 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards &amp; Critique</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[CIS RAM v2.2 is an excellent risk-evaluation and legal-translation layer — Impact × Expectancy, due-care reasonableness, the practitioner↔management↔regulator translator — but it has no cause axis. It names threats by their outcome (a compromise of C, I, or A), on the consequence side of the Bow-Tie pivot, so you cannot coherently select a Safeguard that acts left of the pivot. Worse than borrowing VERIS' blur, CIS discards the cause data it has: its Expectancy engine collapses the rich VCDB down to asset-class quintiles (which class got hit), so the mechanism — exploited #2 vs abused #1 vs stolen-credential #4 — is invisible by construction. That makes the Maturity Score (its KCI) float. TLCTC slots underneath as the cause axis: the 10×6×2 matrix (10 clusters × 6 strategies × 2 Bow-Tie sides) makes completeness falsifiable, every gap a named empty cell; umbrella controls like 'Patch Management' cannot reach target-zero on any single cell because effectiveness is averaged across #2 / #3 / #10→#1. The post ships with the full mapping: all 153 CIS Controls v8.1 Safeguards resolve to 74 cell-pure objectives (−79), and the matrix surfaces a 19-to-1 preventive imbalance between #2 Exploiting Server and #6 Flooding that CIS RAM is structurally blind to. Keep DoCRA's risk math, replace the VERIS/CDM threat input with the ten clusters.]]></description>
    </item>
    <item>
      <title>Sigma and the TLCTC — A Coverage Map for the Detections You Already Run</title>
      <link>https://www.tlctc.net/sigma-and-the-tlctc.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/sigma-and-the-tlctc.html</guid>
      <pubDate>Thu, 04 Jun 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Tools &amp; Applications</category>
      <description><![CDATA[The SigmaHQ → TLCTC mapping turns thousands of community detection rules into a cluster-level coverage audit. It is a two-hop, mechanically derived view — Sigma attack.t* tags → parent technique IDs → the project's ATT&CK→TLCTC mapping (698 techniques) → clusterSet + primaryCluster + derivationStatus — and is scrupulously honest that quality is bounded by that chain (the upstream ATT&CK→TLCTC mapping is itself AI-generated and experimental). Rules are labelled ok / ambiguous / unmapped rather than force-fit. Run against the pinned SigmaHQ snapshot (3,132 rules), the corpus leans hard toward #1 Abuse of Functions (520 OK rules) — a portrait of a detection ecosystem centred on post-exploitation behaviour (LOLBIN execution, admin-tool abuse) and comparatively thin on Man in the Middle or Flooding. The companion to the SARIF classifier, from the opposite direction: not where you're weak, but where you're watching.]]></description>
    </item>
    <item>
      <title>SARIF and the TLCTC — From a Pile of Findings to a Picture of Cause</title>
      <link>https://www.tlctc.net/sarif-and-the-tlctc.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/sarif-and-the-tlctc.html</guid>
      <pubDate>Thu, 04 Jun 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Tools &amp; Applications</category>
      <description><![CDATA[A small, dependency-free classifier that takes the lingua franca of static-analysis output — SARIF — and projects every finding onto the ten Top Level Cyber Threat Clusters. The bridge is CWE: it loads the canonical CWE→TLCTC mapping (987 weaknesses), with an offline KEV→TLCTC fallback (1,568 CVEs) for findings that carry only a CVE. It honours each CWE's verdict (Allowed / Discouraged / Prohibited), unions multiple CWEs and picks the lowest-numbered primary deterministically, and resolves #2 | #3 via R-ROLE file-path globs. Crucially, it stops short of inventing attack paths: per Axiom III, a static weakness is a latent cause, not an executed step, so no Δt, no DRE, no Layer 3 path is fabricated. Outputs JSON, a Markdown PR comment, and an enriched TLCTC-SARIF report — plus a CI gate (--fail-on-cluster). The cause-side companion to the Sigma coverage map.]]></description>
    </item>
    <item>
      <title>AI Security Awareness — The Human, the Machine, and the Agent</title>
      <link>https://www.tlctc.net/tlctc-awareness.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-awareness.html</guid>
      <pubDate>Tue, 02 Jun 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <category>AI Security</category>
      <description><![CDATA[An interactive, bilingual (EN/DE) awareness briefing that maps modern AI risk onto the TLCTC taxonomy across three escalating scenarios: the Human (copy-paste prompt injection and un-sanitized PDFs), the Machine (automated API clients that remove the human filter), and the Agent (agentic AI with the right to act). Each scenario is presented for three audiences — management, security analyst, and developer — with explicit attack paths (#9 → #1, #9 → #3 → #7, #1 → #4 → #1), Δt velocity classes (VC-1 to VC-4), Bow-Tie control positioning, and R-rule classification. Shows why awareness is a cause-side control against #9, why indirect prompt injection carries no #9 at all, and why agent autonomy collapses the defender's reaction window to zero.]]></description>
    </item>
    <item>
      <title>TLCTC+ for NCSCs and CERTs: A National Reporting Extension Proposal (v0.6)</title>
      <link>https://www.tlctc.net/tlctc-plus-ncsc-proposal.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-plus-ncsc-proposal.html</guid>
      <pubDate>Tue, 26 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[A draft proposal (v0.6) extending TLCTC v2.1 with a national reporting profile (TLCTC+) for NCSCs, CERTs, CSIRTs, regulators, banks, fraud teams, and adjacent peer groups. Six tracks — Cause / SRE / DRE / BRE / Impact / Report — layered over a TLCTC path, with structured PATTERN, BRE, IMPACT, and REPORT catalogues and a Pattern + BRE split that separates the manipulation narrative from the observable business event. Anchored at #9 Social Engineering, covering romance scams, CEO fraud, BEC, invoice/mandate fraud, fake tech support, account-takeover-enabled fraud, supply-chain regulatory reporting, and ransomware service outages — without polluting the threat taxonomy. Two record types: compromise_record (with cyber-side and consequence-side dominance flavors) and pure_9_record.]]></description>
    </item>
    <item>
      <title>Translation of a Hacker News Article into TLCTC</title>
      <link>https://www.tlctc.net/translation_hackernews_webworm_tlctc_radar_top.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/translation_hackernews_webworm_tlctc_radar_top.html</guid>
      <pubDate>Sun, 24 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Case Study</category>
      <description><![CDATA[A worked translation of The Hacker News report on Webworm, EchoCreep, and GraphWorm into TLCTC v2.1. The campaign reads at first glance as a single-label malware story (#7), but is better expressed as a #7-heavy attack path: executed foreign content (EchoCreep, GraphWorm) wrapped in a supporting #1 layer (Discord C2, Microsoft Graph / OneDrive as job queue, GitHub staging, SoftEther proxying). Walks through why this is not #10 absent a Trust Acceptance Event, why "Discord C2" is not automatically a new cluster, and what the path becomes if the entry point resolves to #2, #4, or #9. Includes a strategic radar placement card and per-cluster control implications.]]></description>
    </item>
    <item>
      <title>ClickFix — A TLCTC Deep Dive</title>
      <link>https://www.tlctc.net/clickfix-deep-dive-final.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/clickfix-deep-dive-final.html</guid>
      <pubDate>Thu, 21 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[ClickFix does not exploit an implementation flaw — that is the whole point. It exploits human psychology, legitimate operating-system functions, and intended code-execution capability. The cleanest possible #9 → #1 → #7 chain, decomposed into five forensic events with telemetry, ATT&CK T1204.004 anchoring, the parallel/sequential/domain-boundary operator distinctions, the #1-launch / #7-execute boundary at PowerShell, and a cluster-by-cluster control map. The empirical case for treating Cluster #1 and interpreter-mediated #7 as first-class control surfaces, not residual categories.]]></description>
    </item>
    <item>
      <title>Data Breach Is Not One Thing — And Neither Is Data Security</title>
      <link>https://www.tlctc.net/tlctc-data-breach.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-data-breach.html</guid>
      <pubDate>Wed, 20 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Regulations &amp; Compliance</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[Privacy law layered three semantically loaded terms on top of each other — data security, data breach, and personal data breach — and bolted a control list onto the foundation. The result: a recursive definition, controls at four different abstraction layers, and professionals conditioned into checklist behaviour. TLCTC dissolves the confusion by separating cause (#X → #Y) from outcome (DRE: C/I/Av/Ac) from consequence (BRE). Article 32 rewritten as a two-dimensional control catalogue indexed to threat clusters and Bow-Tie position.]]></description>
    </item>
    <item>
      <title>Loud Fix, Quiet Cause — CVE-2020-17103 and the Patch That Closed an Effect, Not a Cluster</title>
      <link>https://www.tlctc.net/cve-2020-17103.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/cve-2020-17103.html</guid>
      <pubDate>Mon, 18 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Case Study</category>
      <description><![CDATA[CVE-2020-17103 was patched in December 2020 and re-opened in 2026. The patch closed a specific exploitation primitive in cldflt.sys; the under-protected privilege boundary the TLCTC cluster names — #1 Abuse of Functions — was never the patch's target. The inverse of the silent-fix window: defenders have the wrong signal, not no signal. Five years of "patched" status; one privilege-boundary cluster, untouched; 2026 re-exploitation on fully-patched Windows 11 by Chaotic Eclipse. Companion piece to the silent-fix analysis: same KCI failure, opposite direction.]]></description>
    </item>
    <item>
      <title>The Commit Is the CVE — AI Agents, Silent Fixes, and the Patch-Gap Collapse</title>
      <link>https://www.tlctc.net/silent-fix-window.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/silent-fix-window.html</guid>
      <pubDate>Sun, 17 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[Silent fixes in open-source repositories — security-relevant commits landing in public source without a CVE or advisory — are now the dominant pre-disclosure attack surface. AI agents collapse the patch-gap window from days to hours and from a handful of high-value targets to the long tail. The TLCTC reading is restrained: no new threat cluster, a velocity collapse in the attacker-preparation phase of #2 / #3. The consequences for advisory-anchored vulnerability management are not. Eleven KEV-confirmed kernel exploitations since May 2024 enumerate the precondition; CVE-2026-31431 (Copy Fail) is the worked example.]]></description>
    </item>
    <item>
      <title>The Kernel as Client: Why CVE-2025-21333 Is #3, Not #2</title>
      <link>https://www.tlctc.net/hyperv-vsp-tlctc-client.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/hyperv-vsp-tlctc-client.html</guid>
      <pubDate>Fri, 15 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[Part 2 of the Kernel's Role series. Same outcome as Calif M5, opposite TLCTC cluster. The Hyper-V NT Kernel Integration VSP heap overflow (CVE-2025-21333) is #3 Exploiting Client — not #2 — because R-ROLE reads direction, not privilege. The VSP runs in kernel mode at SYSTEM but consumes I/O ring responses from the NT Kernel; the failing operation is response-handling, not request-handling. A side-by-side synthesis with Part 1 shows that two cases sharing nine out of ten attributes still split on the one that matters: who sends and who consumes.]]></description>
    </item>
    <item>
      <title>The Calif M5 Exploit Is a Textbook #2 → #2 Chain</title>
      <link>https://www.tlctc.net/calif-tlctc-chain.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/calif-tlctc-chain.html</guid>
      <pubDate>Fri, 15 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Case Study</category>
      <description><![CDATA[Part 1 of the Kernel's Role series. Two server-side kernel exploits, one trust boundary, no role flips. The Calif/MIE bypass on Apple M5 stripped to its TLCTC structure: #2 → #2 with an intra-system privilege annotation. SG-6 forces two notation steps for two distinct kernel bugs at the same boundary; SG-4 keeps privilege escalation pinned to its cause; R-EXEC keeps #7 Malware off the path despite the colloquial 'code execution' framing. Catastrophic compromise assembled entirely inside one trust boundary.]]></description>
    </item>
    <item>
      <title>CVE-2026-44578 — The Allowlist Moves, the Cluster Doesn't</title>
      <link>https://www.tlctc.net/cve-2026-44578.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/cve-2026-44578.html</guid>
      <pubDate>Fri, 15 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Case Study</category>
      <description><![CDATA[Next.js' WebSocket-upgrade SSRF (CVE-2026-44578) lets a self-hosted server proxy crafted requests to cloud metadata and IAM endpoints. Three Next.js "SSRF eras" — image-optimizer, middleware/header bypass (CVE-2025-29927), and now WS-upgrade — split cleanly between #1 Abuse of Functions and #2 Exploiting Server depending on whether the abused capability executes. Same cluster as Capital One 2019. The bypass primitive keeps moving; the abused capability doesn't.]]></description>
    </item>
    <item>
      <title>CVE-2026-46300 ("Fragnesia") — TLCTC Analysis</title>
      <link>https://www.tlctc.net/cve-2026-46300.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/cve-2026-46300.html</guid>
      <pubDate>Fri, 15 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Case Study</category>
      <description><![CDATA[A second Linux kernel page-cache write primitive lands in under two weeks — this one in XFRM ESP-in-TCP via skb_try_coalesce() dropping SKBFL_SHARED_FRAG. Different subsystem from Copy Fail, identical TLCTC classification: #2.2 Exploiting Server. Same four attack-path shapes, same Bow-Tie placement, and a critical twist — Fragnesia was introduced by the Dirty Frag patch itself. The cause-oriented view collapses three kernel CVEs into one threat.]]></description>
    </item>
    <item>
      <title>Propagated Controls — Managing Controls Over Event Chains</title>
      <link>https://www.tlctc.net/tlctc-propagated-controls.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-propagated-controls.html</guid>
      <pubDate>Wed, 13 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Regulations &amp; Compliance</category>
      <description><![CDATA[Companion note to TLCTC v2.0 that lifts the Propagated PR mechanism out of the glossary and generalizes it to four sources — regulatory, contractual, BCM, internal policy. A PR control for a downstream BRE executes as an RS step of an upstream event. Includes GDPR vs NIS2 and BCM/RTO worked examples, the canonical RS(Eₙ) formula, and a formal Rule of Propagation: a PR control for Eₙ₊ₓ is hosted in the earliest event whose classification suffices to trigger the obligation.]]></description>
    </item>
    <item>
      <title>SABSA × TLCTC: Architecture Method, Threat Ontology, and the Predefined Control Objective</title>
      <link>https://www.tlctc.net/sabsa-tlctc-blog.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/sabsa-tlctc-blog.html</guid>
      <pubDate>Tue, 12 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[SABSA and TLCTC are routinely compared as competing frameworks. They are not. SABSA is an architectural method without a threat taxonomy; TLCTC is a threat ontology without an architectural method. This essay shows how SABSA, TLCTC, NIST CSF, and external control catalogues compose into the four-way structure enterprise security architecture actually needs — and why control objectives are predefined (60 verb-noun cells: CSF × TLCTC), not authored. Introduces the governance-umbrella archetype that binds local and operational umbrella controls to enterprise intent.]]></description>
    </item>
    <item>
      <title>The Control Fixation in the Security Properties — A TLCTC critique of G7 SBOM-for-AI</title>
      <link>https://www.tlctc.net/sbom-for-ai-control-fixation.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/sbom-for-ai-control-fixation.html</guid>
      <pubDate>Tue, 12 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[The G7's Software Bill of Materials for AI (Évian, 2026) defines seven clusters — six describe what an AI system is made of, one (Security Properties) describes what it is defended with. TLCTC v2.1 critique: the SP cluster has no threat view, conflates SRE and DRE, and is scope-blind to Model/Dataset/System/Infrastructure. Prompt-injection case study (#1 vs #3 vs #10) and a three-axis threat × element × event-side matrix that fixes it.]]></description>
    </item>
    <item>
      <title>Ten Clusters, Not Eleven — TLCTC reads the GTIG AI Threat Tracker (May 2026)</title>
      <link>https://www.tlctc.net/gtig-ai-threat-tracker-2026.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/gtig-ai-threat-tracker-2026.html</guid>
      <pubDate>Mon, 11 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Case Study</category>
      <description><![CDATA[Reading Google Threat Intelligence Group's May 2026 AI Threat Tracker through TLCTC v2.1: every finding lands in one of the existing ten cause clusters. PROMPTSPY decomposes to #9 → #7 with #1 inside the FEC loop; SANDCLOCK via LiteLLM is the canonical 2026 #10 Trust Acceptance Event; AI voice cloning is a higher-fidelity #9. AI does not create a new threat — it collapses Δt across the bow-tie, migrating VC-2 transitions to VC-3 and VC-4. Includes a 14-finding mapping table, a velocity-collapse table, a PROMPTSPY full-chain deep-dive, and a cluster radar.]]></description>
    </item>
    <item>
      <title>TLCTC v2.1 Monster Prompts — One per Peer Group</title>
      <link>https://www.tlctc.net/tlctc-prompt-index.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-prompt-index.html</guid>
      <pubDate>Sat, 09 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <category>AI Automation</category>
      <description><![CDATA[Five audience-shaped TLCTC v2.1 monster prompts — CTI/Forensic, SOC/Detection, DevSecOps/Engineers, CISO/Risk, and Regulators/Standards. Same canonical taxonomy core; persona, inputs, and outputs reshaped for each peer group. Pick the prompt that matches your role and paste it into your LLM of choice.]]></description>
    </item>
    <item>
      <title>TLCTC v2.1 — Deep Classifier Prompt for Threat-Intel &amp; Forensic Analysts</title>
      <link>https://www.tlctc.net/tlctc-prompt-cti.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-prompt-cti.html</guid>
      <pubDate>Sat, 09 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <category>AI Automation</category>
      <description><![CDATA[The CTI/forensic specialist variant of the TLCTC monster prompt: full notation pedagogy, 22 worked examples, every R-* rule, the unresolved-step protocol, and the verification checklist — built for threat-intel analysts and incident responders who need taxonomic rigor.]]></description>
    </item>
    <item>
      <title>TLCTC v2.1 — SOC &amp; Detection Prompt | Translate ATT&amp;CK + Telemetry into Attack Paths</title>
      <link>https://www.tlctc.net/tlctc-prompt-soc.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-prompt-soc.html</guid>
      <pubDate>Sat, 09 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <category>AI Automation</category>
      <description><![CDATA[The SOC variant of the TLCTC monster prompt — translate live alerts, ATT&CK technique IDs, EDR/SIEM telemetry, and IOC sets into TLCTC v2.1 attack paths with Δt velocity, ATT&CK pivots, detection-coverage call-outs, and response priority by velocity class.]]></description>
    </item>
    <item>
      <title>TLCTC v2.1 — DevSecOps &amp; Engineering Prompt | Cluster Exposure for Code, Designs, and CWEs</title>
      <link>https://www.tlctc.net/tlctc-prompt-devsecops.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-prompt-devsecops.html</guid>
      <pubDate>Sat, 09 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <category>AI Automation</category>
      <description><![CDATA[The DevSecOps variant of the TLCTC monster prompt — paste in code, design docs, CWE entries, dependency lists, or threat-model components and get per-component cluster exposure, CWE-grounded fixes, and shift-left controls.]]></description>
    </item>
    <item>
      <title>TLCTC v2.1 — CISO &amp; Risk Prompt | Cluster-Attributed Risk + Control Gaps + Board Bullets</title>
      <link>https://www.tlctc.net/tlctc-prompt-ciso.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-prompt-ciso.html</guid>
      <pubDate>Sat, 09 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <category>AI Automation</category>
      <description><![CDATA[The CISO variant of the TLCTC monster prompt — paste in incident summaries, audit findings, or risk-register entries and get a cluster-attributed risk narrative, a control-gap table mapped to NIST CSF 2.0, FAIR loss-event framing, and board-ready talking points stripped of notation.]]></description>
    </item>
    <item>
      <title>TLCTC v2.1 — Regulators &amp; Standards Prompt | Harmonize Reporting Taxonomies + TLCTC+ BRE</title>
      <link>https://www.tlctc.net/tlctc-prompt-regulators.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-prompt-regulators.html</guid>
      <pubDate>Sat, 09 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <category>AI Automation</category>
      <description><![CDATA[The Regulators variant of the TLCTC monster prompt — paste in NIS2 / DORA / SEC 8-K-style filings or CERT bulletins and get cluster classification of root cause, TLCTC+ Business Risk Event (BRE) consequence tags, a crosswalk to existing reporting taxonomies, and gap commentary on what the source filing failed to express.]]></description>
    </item>
    <item>
      <title>Chaos Ransomware: A Rapid7 Analysis Through the Lens of the TLCTC</title>
      <link>https://www.tlctc.net/chaos-ransomware-tlctc-analysis.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/chaos-ransomware-tlctc-analysis.html</guid>
      <pubDate>Fri, 08 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Case Study</category>
      <description><![CDATA[Rapid7's forensic write-up of an intrusion branded "Chaos ransomware" — but no encryption ever happened. TLCTC v2.1 decomposition into seven classified steps (#9 → #4 → #1 → #4 → #1 → #7 → #7), with Teams as transit (not attack surface), the MFA self-enrollment hijack as its own #1, and an operator-gated VC-2 pause inside ms_upd.exe that the "ransomware" framing would have hidden. Closes on [DRE: C] only — no [DRE: Ac].]]></description>
    </item>
    <item>
      <title>Apache HTTP Server 2.4.67 — TLCTC Decomposition of 11 CVEs</title>
      <link>https://www.tlctc.net/apache-2.4.67-tlctc-analysis.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/apache-2.4.67-tlctc-analysis.html</guid>
      <pubDate>Wed, 06 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Case Study</category>
      <description><![CDATA[Cause-side classification of the 11 CVEs closed in Apache HTTP Server 2.4.67 (4 May 2026). The batch splits into five #2 (server-side request handling), five #3 in mod_proxy_ajp via R-ROLE (response-parsing of attacker-controlled backend output), and one #6 (mod_md unbounded allocation). Why CVSS, RCE labels, and CISA-ADP enrichment hide the right control surface — and why three IAV-Yes CVEs concentrate the patch-window risk.]]></description>
    </item>
    <item>
      <title>CVE-2026-31431 ("Copy Fail") — TLCTC Analysis</title>
      <link>https://www.tlctc.net/cve-2026-31431.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/cve-2026-31431.html</guid>
      <pubDate>Mon, 04 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Case Study</category>
      <description><![CDATA[A Linux kernel privilege-escalation primitive in the AF_ALG / algif_aead path. The CVE itself is #2.2 Exploiting Server; four realistic in-the-wild chains (server compromise, container escape, phishing, supply chain) all end at the same kernel step. Why ATT&CK T1068 conflates cause and effect.]]></description>
    </item>
    <item>
      <title>Cause-Oriented SOAR: TLCTC for Cortex XSOAR and XSIAM</title>
      <link>https://www.tlctc.net/cortex-xsoar-tlctc-integration.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/cortex-xsoar-tlctc-integration.html</guid>
      <pubDate>Mon, 04 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <category>Standards Integration</category>
      <description><![CDATA[One master playbook per TLCTC cluster, none per outcome. Cortex XSOAR 6.2.x and XSOAR 8.x / XSIAM builds shipping a Velocity-Class router, RS Container sub-playbook with GDPR Art. 33 / NIS2 Art. 23 triggers, an ATT&CK→TLCTC classifier, and a Layer 3 attack-path emitter.]]></description>
    </item>
    <item>
      <title>The Missing Axis — D3FEND and TLCTC, Two Layers of One Stack</title>
      <link>https://www.tlctc.net/missing-axis-d3fend-tlctc.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/missing-axis-d3fend-tlctc.html</guid>
      <pubDate>Sat, 02 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Standards Integration</category>
      <description><![CDATA[MITRE's D3FEND knowledge graph is the most rigorously structured catalog of defensive countermeasures the industry has produced — yet inherits the threat-axis gap from ATT&CK that TLCTC was built to fix. A layered-stack analysis showing where D3FEND fits, where it doesn't, and why the pairing with TLCTC is more than additive.]]></description>
    </item>
    <item>
      <title>The Control Fixation Reflex</title>
      <link>https://www.tlctc.net/control-fixation-reflex.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/control-fixation-reflex.html</guid>
      <pubDate>Fri, 01 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards &amp; Critique</category>
      <category>Philosophy</category>
      <description><![CDATA[Why the cybersecurity industry can't stop counting controls — and what it has stopped asking. Names the autonomic reflex that operates at the control layer as if it were the foundational layer, and traces how it propagates through standards, vendors, auditors, GRC tools, maturity models, and the boardroom.]]></description>
    </item>
    <item>
      <title>Comparative Analysis of 16 Cyber Risk and Threat Standards</title>
      <link>https://www.tlctc.net/comparison-gemini-deep-research-max-preview-api-2026-april.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/comparison-gemini-deep-research-max-preview-api-2026-april.html</guid>
      <pubDate>Thu, 30 Apr 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards &amp; Critique</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[A tri-state evaluation (Native, Implicit/Partial, Absent) of TLCTC, MITRE ATT&CK, NIST CSF 2.0, NIST SP 800-Series, ISO/IEC 27001/27005, FAIR, VERIS, ORX, BCBS, BSI IT-Grundschutz, COBIT 2019, CIS Controls v8, STRIDE, Diamond Model, Cyber Kill Chain, and ENISA Threat Landscape across 7 dimensions: attack-path notation, velocity (Δt), domain boundary, machine-readability, control objectives, KRI/KCI integration, and 10×6×2 matrix capability. Strategic and operational layers are split into dedicated rows. Reveals a persistent industry bifurcation: governance frameworks lack attack-path modeling, operational frameworks lack strategic alignment. Only TLCTC bridges both natively. Includes per-framework narrative assessments, cross-framework findings, and a methodology note.]]></description>
    </item>
    <item>
      <title>CVE-2026-21510: When the Warning Doesn't Warn</title>
      <link>https://www.tlctc.net/cve-2026-21510.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/cve-2026-21510.html</guid>
      <pubDate>Wed, 29 Apr 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Standards &amp; Critique</category>
      <description><![CDATA[A Windows Shell bypass slips past SmartScreen and Mark-of-the-Web. Through TLCTC, the chain is #9 → #3 → #7, but the CVE itself is #3 Exploiting Client. Why CWE-693 (Protection Mechanism Failure) misleads strategically.]]></description>
    </item>
    <item>
      <title>CVE-2026-35414: A 15-Year-Old Comma in OpenSSH</title>
      <link>https://www.tlctc.net/cve-2026-35414.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/cve-2026-35414.html</guid>
      <pubDate>Tue, 28 Apr 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Standards Integration</category>
      <description><![CDATA[An OpenSSH certificate principal containing a comma can grant unauthorized root access. Through TLCTC, the scenario decomposes as #4 → #2, but the CVE itself is #2 Exploiting Server. A worked example of cause-oriented CVE classification.]]></description>
    </item>
    <item>
      <title>Incident Reporting with VERIS and TLCTC</title>
      <link>https://www.tlctc.net/tlctc-veris.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-veris.html</guid>
      <pubDate>Mon, 27 Apr 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Threat Analysis</category>
      <description><![CDATA[See a practical example of how the VERIS vocabulary for describing incidents can be mapped to TLCTC.]]></description>
    </item>
    <item>
      <title>10 × 10 × 10 — A Fun Fact about TLCTC</title>
      <link>https://www.tlctc.net/tlctc-10x10x10-fun-fact.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-10x10x10-fun-fact.html</guid>
      <pubDate>Sun, 19 Apr 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Research &amp; Insights</category>
      <description><![CDATA[Three independent pillars of TLCTC — Definitions (Semantic), Axioms (Ontological), Principles (Logical) — each ended up numbering exactly ten. Not designed. Just ended up that way.]]></description>
    </item>
    <item>
      <title>The #1-Cascade — Active Directory, Domain Admin, and Ransomware under the TLCTC Lens</title>
      <link>https://www.tlctc.net/ad-ransomware-tlctc-cascade.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/ad-ransomware-tlctc-cascade.html</guid>
      <pubDate>Sat, 18 Apr 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[A forensic-level TLCTC v2.1 decomposition of how attackers reach Domain Admin and deploy ransomware. Shows why the entire post-DA phase is structurally #1, with attack path notation, event IDs, and DRE annotations grounded in 2025 IR data.]]></description>
    </item>
    <item>
      <title>SSDLC for Developers: The "S" Problem and How TLCTC Fixes It</title>
      <link>https://www.tlctc.net/tlctc-ssdlc.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-ssdlc.html</guid>
      <pubDate>Sat, 18 Apr 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Standards Integration</category>
      <description><![CDATA[Design reviews are theatre? Make them bite. A developer-first entry point to Secure SDLC with the TLCTC threat clusters, attack-path design reviews, and a CWE triage shortcut.]]></description>
    </item>
    <item>
      <title>The End of Semantic Diffusion: DREAD vs STRIDE vs TLCTC</title>
      <link>https://www.tlctc.net/tlctc-semantic-diffusion-dread-stride.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-semantic-diffusion-dread-stride.html</guid>
      <pubDate>Sun, 12 Apr 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Threat Analysis</category>
      <description><![CDATA[Compare Microsoft's DREAD and STRIDE with the cause-oriented TLCTC framework to understand why cybersecurity must stop blending causes with outcomes for genuine semantic precision.]]></description>
    </item>
    <item>
      <title>DORA TLPT</title>
      <link>https://www.tlctc.net/tlctc-regulation-dora-tlpt.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-regulation-dora-tlpt.html</guid>
      <pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Regulations &amp; Compliance</category>
      <description><![CDATA[detailed analysis of the DORA TLPT and a comparison with the Top Level Cyber Threat Clusters (TLCTC) framework...]]></description>
    </item>
    <item>
      <title>Comparative Analysis: TLCTC vs. DIAMOND</title>
      <link>https://www.tlctc.net/tlctc-diamond-model.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-diamond-model.html</guid>
      <pubDate>Sat, 04 Apr 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[The Diamond Model of Intrusion Analysis is a powerful relational framework for threat intelligence — but its vertices lack internal causal structure. TLCTC fills that gap.]]></description>
    </item>
    <item>
      <title>The npm Supply Chain Attack Is Not a Package Story. It Is a Trust-Acceptance Story.</title>
      <link>https://www.tlctc.net/tlctc-npm-supply-chain.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-npm-supply-chain.html</guid>
      <pubDate>Thu, 19 Mar 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Framework &amp; Concepts</category>
      <category>Supply Chain</category>
      <description><![CDATA[Why npm supply chain attacks are fundamentally trust-acceptance failures. Learn to map malicious packages, typosquatting, and dependency confusion to TLCTC clusters.]]></description>
    </item>
    <item>
      <title>TLCTC v2.1: Full Extension Spec - Boundary &amp; Transit Operators</title>
      <link>https://www.tlctc.net/https://github.com/Barnes70/TLCTC/blob/main/v2.1-Proposals/TLCTC_v2.1_Full_Extension_Spec.pdf</link>
      <guid isPermaLink="true">https://www.tlctc.net/https://github.com/Barnes70/TLCTC/blob/main/v2.1-Proposals/TLCTC_v2.1_Full_Extension_Spec.pdf</guid>
      <pubDate>Sun, 15 Mar 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Notation &amp; Standards</category>
      <description><![CDATA[v2.1 adds transit and intra-system boundary operators to the notation—tracking how attacks relay through intermediate carriers and escalate within hosts. Same ten clusters, sharper observability.]]></description>
    </item>
    <item>
      <title>The Semantic Problem with "Zero Trust"</title>
      <link>https://www.tlctc.net/tlctc-zero-trust-semantic-problem.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-zero-trust-semantic-problem.html</guid>
      <pubDate>Sun, 15 Mar 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Strategic Threat Intelligence</category>
      <description><![CDATA[Deconstructing Zero Trust as a meta-principle. Why the industry's blurriness regarding Zero Trust is structurally inevitable and how to pin it to concrete TLCTC clusters.]]></description>
    </item>
    <item>
      <title>IEC 62443 Meets TLCTC v2.1: Filling the Threat Taxonomy Gap in Industrial Cybersecurity</title>
      <link>https://www.tlctc.net/tlctc-iec62443-v2.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-iec62443-v2.html</guid>
      <pubDate>Sun, 01 Mar 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[How TLCTC v2.0's cause-oriented taxonomy, velocity classes, and attack path notation fill the threat identification gap in IEC 62443 industrial cybersecurity risk assessments.]]></description>
    </item>
    <item>
      <title>The Crux of Banks Regarding Operational Risk Management</title>
      <link>https://www.tlctc.net/tlctc-banks-operational-risk-basel.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-banks-operational-risk-basel.html</guid>
      <pubDate>Thu, 26 Feb 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Risk Management</category>
      <category>Regulations &amp; Compliance</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[Why Basel's Event Categories Structurally Undermine the Risk Standards They Claim to Implement. A deep dive into the contradiction between ISO 31000, COSO ERM, and Basel OPE25 Table 2.]]></description>
    </item>
    <item>
      <title>The Consequence Amplifier: Agentic AI on the Right Side of the Bow-Tie</title>
      <link>https://www.tlctc.net/tlctc-agentic-ai-consequences.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-agentic-ai-consequences.html</guid>
      <pubDate>Wed, 25 Feb 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Framework &amp; Concepts</category>
      <category>AI Security</category>
      <description><![CDATA[How Autonomous Tool Access Transforms Damage Patterns. A deep dive into the right side of the Bow-Tie, exploring Velocity, Scope, and Autonomy Amplification.]]></description>
    </item>
    <item>
      <title>Agentic AI Under the Microscope</title>
      <link>https://www.tlctc.net/tlctc-agentic-ai-microscope.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-agentic-ai-microscope.html</guid>
      <pubDate>Wed, 25 Feb 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[Why 'AI Security' is not a threat category. A cause-based decomposition of agentic AI threats using the TLCTC framework, separating generic software vulnerabilities from AI-specific attack vectors.]]></description>
    </item>
    <item>
      <title>The "Why Ten?" Question: Explaining the 10 Clusters</title>
      <link>https://www.tlctc.net/tlctc-why10-explainer.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-why10-explainer.html</guid>
      <pubDate>Fri, 20 Feb 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[A deep dive into the logic and thought experiment behind the creation of exactly ten, non-overlapping clusters.]]></description>
    </item>
    <item>
      <title>Why the TLCTC Does Not Need the "Hazard"</title>
      <link>https://www.tlctc.net/tlctc-hazard-omission.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-hazard-omission.html</guid>
      <pubDate>Sat, 14 Feb 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Risk Management</category>
      <description><![CDATA[A structural argument for terminological precision. Why importing the 'Hazard' concept from safety engineering into cybersecurity creates semantic diffusion and how TLCTC solves it.]]></description>
    </item>
    <item>
      <title>Generic Vulnerabilities: Software &amp; Hardware Failure</title>
      <link>https://www.tlctc.net/tlctc-generic-vulnerabilities.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-generic-vulnerabilities.html</guid>
      <pubDate>Thu, 12 Feb 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Risk Management</category>
      <description><![CDATA[A deep dive into non-adversarial IT risk events using the TLCTC Bow-Tie methodology. Analyzing the logical vs material imperfections that cause infrastructure failures.]]></description>
    </item>
    <item>
      <title>TLCTC Attack Path — 20 Annotated Examples</title>
      <link>https://www.tlctc.net/tlctc-attack-path-examples.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-attack-path-examples.html</guid>
      <pubDate>Sun, 08 Feb 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Threat Analysis</category>
      <description><![CDATA[Master the TLCTC mapping logic with 20 real-world scenarios. From supply chain implants to zero-click exploits, learn to denote causal paths and Data Risk Events correctly.]]></description>
    </item>
    <item>
      <title>Why DORA Will Fail Regarding Cyber Risks</title>
      <link>https://www.tlctc.net/tlctc-dora-cyber-risk-failure.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-dora-cyber-risk-failure.html</guid>
      <pubDate>Sat, 07 Feb 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Regulations &amp; Compliance</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[A structural critique of the EU's Digital Operational Resilience Act. Why mandating 'risk-based' management without a threat taxonomy creates a quiet failure of compliance over security.]]></description>
    </item>
    <item>
      <title>22 Definition Entries for 'Threat' — On One NIST Page</title>
      <link>https://www.tlctc.net/tlctc-nist-threat-chaos.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-nist-threat-chaos.html</guid>
      <pubDate>Tue, 27 Jan 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards &amp; Critique</category>
      <category>Language &amp; Standards</category>
      <description><![CDATA[NIST's glossary lists 22 conflicting definitions for a single core term. Explore how this semantic chaos propagates und wieso Präzision für das Risikomanagement auf Vorstandsebene erforderlich ist.]]></description>
    </item>
    <item>
      <title>GDPR vs NIS2: Different Trigger Points for Compliance Events</title>
      <link>https://www.tlctc.net/tlctc-gdpr-nis2-triggers.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-gdpr-nis2-triggers.html</guid>
      <pubDate>Sat, 24 Jan 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Regulations &amp; Compliance</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[The same incident can trigger different compliance obligations. GDPR is triggered by PII exposure (Data Risk Event), while NIS2 is triggered by the Incident itself (Cyber Risk Event).]]></description>
    </item>
    <item>
      <title>TLCTC for Everyone: The "Blind Spot" Method</title>
      <link>https://www.tlctc.net/tlctc-everyone-blind-spot.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-everyone-blind-spot.html</guid>
      <pubDate>Thu, 15 Jan 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Risk Management</category>
      <description><![CDATA[Stop worrying about complexity. Learn the 10x5 matrix logic through the 'Blind Spot' exercise—a simplified starting point for individuals and SMEs to audit their own security.]]></description>
    </item>
    <item>
      <title>Quantum Computing and AI: New Magic, Same Threats</title>
      <link>https://www.tlctc.net/tlctc-quantum-ai-velocity.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-quantum-ai-velocity.html</guid>
      <pubDate>Thu, 08 Jan 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Threat Analysis</category>
      <description><![CDATA[A strategic analysis of how Quantum and AI act as threat amplifiers. While the 10 clusters remain stable, the shift to high-velocity (VC-3) attacks mandates a transition to automated and architectural controls.]]></description>
    </item>
    <item>
      <title>GovCERT-CH Blocked Filetypes: TLCTC Analysis</title>
      <link>https://www.tlctc.net/tlctc-govcert-blocked-filetypes.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-govcert-blocked-filetypes.html</guid>
      <pubDate>Tue, 06 Jan 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Standards Integration</category>
      <description><![CDATA[A strategic restructuring of the GovCERT-CH blocked filetypes list. Why conflating Tier 1 (Native FEC) with Tier 3 (Parser Bugs) creates false confidence.]]></description>
    </item>
    <item>
      <title>The File Type Fallacy: Why Extension Blocklists Miss the Point</title>
      <link>https://www.tlctc.net/tlctc-file-type-fallacy.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-file-type-fallacy.html</guid>
      <pubDate>Tue, 06 Jan 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Threat Analysis</category>
      <description><![CDATA[Applying TLCTC's cause-based classification to understand the three-tier distinction: native executables, application-mediated execution, and data files requiring parser exploits.]]></description>
    </item>
    <item>
      <title>The End of Semantic Diffusion</title>
      <link>https://www.tlctc.net/tlctc-semantic-diffusion.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-semantic-diffusion.html</guid>
      <pubDate>Tue, 30 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Philosophy</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[Why cybersecurity is stuck in a pre-paradigmatic phase. Thomas Kuhn, Semantic Diffusion, and the scientific necessity of a shared threat language.]]></description>
    </item>
    <item>
      <title>ENISA Threat Landscape 2025 - TLCTC Analysis</title>
      <link>https://www.tlctc.net/tlctc-enisa-2025-threat-report.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-enisa-2025-threat-report.html</guid>
      <pubDate>Thu, 25 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Research &amp; Insights</category>
      <category>Threat Analysis</category>
      <description><![CDATA[A strategic decomposition of 4,900+ incidents from the ENISA Threat Landscape 2025 report. Mapping the landscape to TLCTC clusters to reveal the polarization between human manipulation and server exploitation.]]></description>
    </item>
    <item>
      <title>The Logical Contradiction in Control-First Regulation</title>
      <link>https://www.tlctc.net/tlctc-control-first-regulation.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-control-first-regulation.html</guid>
      <pubDate>Thu, 25 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Regulations &amp; Compliance</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[Why cybersecurity regulations mandate controls without identifying threats, contradicting the standards they cite. A structural critique of the regulatory gap. Reminder: Dont conflate compliance risk with cyber risk!]]></description>
    </item>
    <item>
      <title>M-Trends 2025: TLCTC Analysis</title>
      <link>https://www.tlctc.net/tlctc-mtrends-2025.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-mtrends-2025.html</guid>
      <pubDate>Thu, 25 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Research &amp; Insights</category>
      <category>Threat Analysis</category>
      <description><![CDATA[A cause-based analysis of Mandiant's M-Trends 2025 Report. Reframing outcome-based data (Ransomware, Dwell Time) into root-cause clusters to reveal the true 2025 threat landscape.]]></description>
    </item>
    <item>
      <title>The Same Attack, Four Different Stories</title>
      <link>https://www.tlctc.net/tlctc-threat-report-chaos.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-threat-report-chaos.html</guid>
      <pubDate>Thu, 25 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Research &amp; Insights</category>
      <category>Threat Analysis</category>
      <description><![CDATA[Verizon, CrowdStrike, Mandiant, and ENISA all see the same threats but speak different languages. Why the industry needs a common denominator.]]></description>
    </item>
    <item>
      <title>ENISA Gap Analysis: Integrating TLCTC for Semantic Precision</title>
      <link>https://www.tlctc.net/tlctc-enisa-gap-analysis.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-enisa-gap-analysis.html</guid>
      <pubDate>Wed, 24 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Regulations &amp; Compliance</category>
      <description><![CDATA[A deep dive into ENISA's current cybersecurity framework gaps and how TLCTC's cause-oriented taxonomy provides the missing semantic layer for EU compliance (NIS2/DORA).]]></description>
    </item>
    <item>
      <title>Enhancing CVE Details</title>
      <link>https://www.tlctc.net/tlctc-cve-nvd.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-cve-nvd.html</guid>
      <pubDate>Wed, 24 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Tools &amp; Applications</category>
      <description><![CDATA[Enhancing CVE Details with the TLCTC Framework: A Strategic Approach incl. json.]]></description>
    </item>
    <item>
      <title>Cobalt Strike Capabilities Mapped to TLCTC Framework</title>
      <link>https://www.tlctc.net/tlctc-cobaltstrike-mapping.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-cobaltstrike-mapping.html</guid>
      <pubDate>Tue, 23 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <category>Threat Analysis</category>
      <description><![CDATA[Comprehensive Implementation Guide: Mapping Cobalt Strike features to TLCTC V2.0 clusters, with corrections for credential dumping (R-CRED) and LOLBAS execution sequences.]]></description>
    </item>
    <item>
      <title>Beyond Encryption: Understanding the Full Scope of Communication Path Threats</title>
      <link>https://www.tlctc.net/tlctc-mitm-encryption-scion.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-mitm-encryption-scion.html</guid>
      <pubDate>Tue, 23 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Threat Analysis</category>
      <description><![CDATA[Why encryption addresses only half the #5 threat. A deep dive into Path Control (SCION), Post-Quantum TLS, and East-West traffic defense.]]></description>
    </item>
    <item>
      <title>TLCTC Analysis: CrowdStrike 2025 Threat Hunting Report</title>
      <link>https://www.tlctc.net/tlctc-crowdstrike-2025-threat-report.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-crowdstrike-2025-threat-report.html</guid>
      <pubDate>Mon, 22 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Research &amp; Insights</category>
      <category>Threat Analysis</category>
      <description><![CDATA[A strategic TLCTC breakdown of the 2025 report. Visualizing the shift to 81% malware-free attacks (#1, #4) and mapping adversaries like Scattered Spider to the 10 Clusters.]]></description>
    </item>
    <item>
      <title>TLCTC Intelligence Brief: The 2025 CrowdStrike Global Threat Report</title>
      <link>https://www.tlctc.net/tlctc-crowdstrike-2025-report.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-crowdstrike-2025-report.html</guid>
      <pubDate>Mon, 22 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Research &amp; Insights</category>
      <category>Threat Analysis</category>
      <description><![CDATA[The 2025 CrowdStrike report confirms a strategic shift to Identity (#4) and Abuse of Functions (#1). 79% of attacks are now malware-free, with a 48-minute breakout time.]]></description>
    </item>
    <item>
      <title>Control Matrices for Starters (SME &amp; Priv)</title>
      <link>https://www.tlctc.net/tlctc-sme-private-controls.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-sme-private-controls.html</guid>
      <pubDate>Thu, 18 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[TLCTC is not only for Big Orgs. No. See the unified 10x12 and 10x6 control matrices for SMEs and Private users, mapped to NIST CSF 2.0 functions. Take it as a Starter Kit]]></description>
    </item>
    <item>
      <title>Time for a Reboot: Why MITRE CWE Needs Taxonomic Discipline</title>
      <link>https://www.tlctc.net/tlctc-cwe-reboot.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-cwe-reboot.html</guid>
      <pubDate>Fri, 12 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[MITRE's latest update adds 12 organizational containers, not weaknesses. An analysis of why 20 years of 'integration' created a registry without a taxonomy.]]></description>
    </item>
    <item>
      <title>Why ORX Must Rethink the "Cyber Event": A Methodological Critique</title>
      <link>https://www.tlctc.net/tlctc-orx-rethink-cyber-event.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-orx-rethink-cyber-event.html</guid>
      <pubDate>Thu, 11 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Risk Management</category>
      <description><![CDATA[Why the ORX Reference Taxonomy's static 'Cyber Event' category fails at defense. How TLCTC's causal, velocity-aware approach resolves overlap and operational blind spots.]]></description>
    </item>
    <item>
      <title>The Power of Causality: Why the Bow-Tie Model Transforms Cyber Risk Management</title>
      <link>https://www.tlctc.net/tlctc-bow-tie-causality.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-bow-tie-causality.html</guid>
      <pubDate>Fri, 05 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Threat Analysis</category>
      <description><![CDATA[Transforming cyber risk from guesswork to science by mapping the causal flow from Threat Clusters to Business Impact using the TLCTC Bow-Tie logic.]]></description>
    </item>
    <item>
      <title>Threat-Driven Development: Integrating TLCTC into the SSDLC</title>
      <link>https://www.tlctc.net/tlctc-ssdlc-integration.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-ssdlc-integration.html</guid>
      <pubDate>Thu, 04 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[Why most 'secure by design' initiatives fail—and how cause-oriented threat modeling using TLCTC transforms development from Design to Decommissioning.]]></description>
    </item>
    <item>
      <title>TLCTC Harbor Integration App</title>
      <link>https://www.tlctc.net/tlctc-harbor-integration.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-harbor-integration.html</guid>
      <pubDate>Wed, 03 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <category>Standards Integration</category>
      <description><![CDATA[A client-side app integrating Harbor Registry scans with TLCTC. Map CVEs to the 10 Clusters and visualize strategic risk.]]></description>
    </item>
    <item>
      <title>MITRE ATT&amp;CK for ML (AML) × TLCTC</title>
      <link>https://www.tlctc.net/tlctc-mitre-aml-mapping.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-mitre-aml-mapping.html</guid>
      <pubDate>Mon, 01 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <category>Standards Integration</category>
      <category>AI Security</category>
      <description><![CDATA[An interactive tool mapping MITRE ATT&CK for Machine Learning (AML) techniques to the 10 TLCTC clusters. Strategic threat analysis and risk management for AI systems.]]></description>
    </item>
    <item>
      <title>Kill the Hype: Capability-Based Planning via the 10x(6x2) Matrix</title>
      <link>https://www.tlctc.net/tlctc-capability-based-planning.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-capability-based-planning.html</guid>
      <pubDate>Sun, 30 Nov 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Strategic Threat Intelligence</category>
      <description><![CDATA[Transform capability planning from consulting theater into engineered defense. Introducing the 10 Clusters × 6 Functions × 2 Scopes matrix strategy.]]></description>
    </item>
    <item>
      <title>Beyond STRIDE: Upgrading Microsoft Threat Modeling to TLCTC</title>
      <link>https://www.tlctc.net/tlctc-microsoft-threat-modeling-stride.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-microsoft-threat-modeling-stride.html</guid>
      <pubDate>Sun, 30 Nov 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Tools &amp; Applications</category>
      <description><![CDATA[Why the Microsoft Threat Modeling Tool needs to evolve from STRIDE's list-based approach to TLCTC's causal attack paths. A blueprint for modernizing DevSecOps.]]></description>
    </item>
    <item>
      <title>The Audit Trap</title>
      <link>https://www.tlctc.net/tlctc-audit-trap.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-audit-trap.html</guid>
      <pubDate>Sun, 30 Nov 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Strategy &amp; Governance</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[Why Compliance Doesn't Equal Security—and How Threat-Control Mapping Fixes It. Learn how strict threat-control mappings with TLCTC break the circular nightmare.]]></description>
    </item>
    <item>
      <title>Strategic Threat Profiling: The Actor Profile Designer</title>
      <link>https://www.tlctc.net/tools/actor-profile-designer.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tools/actor-profile-designer.html</guid>
      <pubDate>Sat, 29 Nov 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <category>Threat Analysis</category>
      <description><![CDATA[A strategic guide to designing, scoring, and visualizing threat actor capabilities. Includes the full download of 40+ Google APT groups mapped to TLCTC.]]></description>
    </item>
    <item>
      <title>TLCTC App Suite Gallery</title>
      <link>https://www.tlctc.net/tlctc-app-gallery.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-app-gallery.html</guid>
      <pubDate>Sat, 29 Nov 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[The central hub for all TLCTC applications: Architect V3.0, Threat Radar, Attack Path Designer, and JSON utilities.]]></description>
    </item>
    <item>
      <title>TLCTC Architect V.0 - User Guide &amp; Technical Documentation</title>
      <link>https://www.tlctc.net/tlctc-Architect-V3-UserGuide.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-Architect-V3-UserGuide.html</guid>
      <pubDate>Mon, 24 Nov 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[The official guide to modeling attack paths, visualizing velocity (Δt), and using the JSON schema in TLCTC Architect V3.0.]]></description>
    </item>
    <item>
      <title>TLCTC Infographics: Learn with Images</title>
      <link>https://www.tlctc.net/tlctc-infographics.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-infographics.html</guid>
      <pubDate>Sun, 23 Nov 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[A high-resolution gallery of the Nano 2 infographic series, featuring the Cyber Bow-Tie, the IT Monolith thought experiment, and the Attacker's Perspective and many more. Images can empower Words!]]></description>
    </item>
    <item>
      <title>Mapping the Chaos: Introducing the TLCTC Emerging Tech &amp; Actors Radar</title>
      <link>https://www.tlctc.net/tlctc-emerging-tech-radar.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-emerging-tech-radar.html</guid>
      <pubDate>Sat, 22 Nov 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Strategic Threat Intelligence</category>
      <category>Framework &amp; Concepts</category>
      <category>Tools</category>
      <description><![CDATA[Introducing a standardized visualization and JSON format that maps emerging technologies and threat actors directly to the 10 TLCTC clusters.]]></description>
    </item>
    <item>
      <title>TLCTC Glossary V2.0: The Complete Definitions</title>
      <link>https://www.tlctc.net/tlctc-glossar.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-glossar.html</guid>
      <pubDate>Sat, 22 Nov 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Reference</category>
      <description><![CDATA[The definitive guide to TLCTC V2.0. Comprehensive definitions for the 10 Clusters, plus new concepts: Attack Velocity (Δt), DCS, and the new JSON Architecture.]]></description>
    </item>
    <item>
      <title>The Topology of Cyber Attacks</title>
      <link>https://www.tlctc.net/tlctc-topology-of-cyber-attacks.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-topology-of-cyber-attacks.html</guid>
      <pubDate>Thu, 20 Nov 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Threat Analysis</category>
      <description><![CDATA[Why #8, #9, and #10 are fundamentally different. A deep dive into Bridge Clusters, Domain Boundaries, and the architecture of modern cyber defense in TLCTC V2.0.]]></description>
    </item>
    <item>
      <title>Cyber Risk: EU Regulation vs. TLCTC</title>
      <link>https://www.tlctc.net/tlctc-eu-regulation.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-eu-regulation.html</guid>
      <pubDate>Thu, 20 Nov 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Regulations &amp; Compliance</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[A detailed comparison of EU Regulations (NIS2, DORA, CRA) and the TLCTC Framework regarding definitions, taxonomy, and operational synergy.]]></description>
    </item>
    <item>
      <title>The Fourth Dimension: Attack Velocity (Δt)</title>
      <link>https://www.tlctc.net/tlctc-attack-velocity.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-attack-velocity.html</guid>
      <pubDate>Thu, 20 Nov 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Threat Analysis</category>
      <description><![CDATA[Why Attack Velocity (Δt) defines your true defense reality. Introducing TLCTC V2.0 temporal notation and the Detection Coverage Score (DCS).]]></description>
    </item>
    <item>
      <title>Grok AI 4.1: Validation of the TLCTC Framework</title>
      <link>https://www.tlctc.net/tlctc-grok-ai-validation.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-grok-ai-validation.html</guid>
      <pubDate>Thu, 20 Nov 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>AI Analysis</category>
      <description><![CDATA[An independent, critical analysis by Grok AI confirming that TLCTC fills the 'missing link' gap between strategic risk management and operational security, validating its uniqueness against MITRE and NIST.]]></description>
    </item>
    <item>
      <title>TLCTC JSON Architecture</title>
      <link>https://www.tlctc.net/TLCTC-JSON-Architecture.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/TLCTC-JSON-Architecture.html</guid>
      <pubDate>Wed, 19 Nov 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Tools &amp; Applications</category>
      <description><![CDATA[A technical guide to the TLCTC JSON architecture, separating universal framework definitions from specific attack instances for scalable, worldwide threat intelligence sharing.]]></description>
    </item>
    <item>
      <title>TLCTC Enhanced Prompt for AI Analysis</title>
      <link>https://www.tlctc.net/tlctc-ai-analysis-prompt.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-ai-analysis-prompt.html</guid>
      <pubDate>Mon, 17 Nov 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[A ready-to-paste prompt that instructs an AI to analyze any Security Report, Cyber Incident Report, or similar document through the lens of the Top Level Cyber Threat Clusters (TLCTC) framework.]]></description>
    </item>
    <item>
      <title>NIST and Cyber Threat Definition and its Consequences</title>
      <link>https://www.tlctc.net/tlctc-NIST-Threat-Definition.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-NIST-Threat-Definition.html</guid>
      <pubDate>Mon, 17 Nov 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[NIST's frameworks are process-oriented, creating a structural gap in risk management. We analyze why this gap exists and how a cause-oriented taxonomy like TLCTC is essential to bridge it.]]></description>
    </item>
    <item>
      <title>2025 DBIR Analysis Through the TLCTC Lens</title>
      <link>https://www.tlctc.net/tlctc-dbir-2025.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-dbir-2025.html</guid>
      <pubDate>Fri, 24 Oct 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Research &amp; Insights</category>
      <category>Threat Analysis</category>
      <description><![CDATA[Mapping the Verizon Data Breach Investigations Report to the Top Level Cyber Threat Clusters Framework v2.0. Key findings on Ransomware, Credential Misuse, and Edge Device Exploitation.]]></description>
    </item>
    <item>
      <title>Integrating NIST NICE Tasks with the TLCTC Framework</title>
      <link>https://www.tlctc.net/tlctc-NIST-NICE.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-NIST-NICE.html</guid>
      <pubDate>Fri, 24 Oct 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[A practical framework for integrating NIST NICE tasks with the 10 Top Level Cyber Threat Clusters (TLCTC) to bridge the gap between workforce development and real-world threats.]]></description>
    </item>
    <item>
      <title>The Kill Chain Fallacy: Why Process is Not Taxonomy</title>
      <link>https://www.tlctc.net/tlctc-KillChainFallacy.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-KillChainFallacy.html</guid>
      <pubDate>Wed, 15 Oct 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Threat Analysis</category>
      <description><![CDATA[An analysis of why the Cyber Kill Chain fails at threat categorization and attack path notation, and how the TLCTC framework provides the missing causal link for Risk Management.]]></description>
    </item>
    <item>
      <title>From Threat to Business Impact: Operationalizing the TLCTC Two-Layer Framework</title>
      <link>https://www.tlctc.net/blog-tlctc-two-layer-framework.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/blog-tlctc-two-layer-framework.html</guid>
      <pubDate>Fri, 03 Oct 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Standards Integration</category>
      <description><![CDATA[The TLCTC framework bridges the critical gap between boardroom risk discussions and SOC operations through a two-layer approach centered on the cyber risk event (system compromise/loss of control).]]></description>
    </item>
    <item>
      <title>CKC x ATT&amp;CK x TLCTC: A Practical Synthesis</title>
      <link>https://www.tlctc.net/blog-ckc-attack-tlctc-synthesis.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/blog-ckc-attack-tlctc-synthesis.html</guid>
      <pubDate>Wed, 01 Oct 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Threat Analysis</category>
      <description><![CDATA[A guide for modern defenders on synthesizing CKC for timelines, ATT&CK for techniques, and TLCTC for a cause-oriented taxonomy and governance integration.]]></description>
    </item>
    <item>
      <title>Mapping CWE-514 (Covert Channel) to TLCTC: A Cause-Oriented Analysis</title>
      <link>https://www.tlctc.net/blog-cwe-514-covert-channel-mapping.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/blog-cwe-514-covert-channel-mapping.html</guid>
      <pubDate>Wed, 01 Oct 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Threat Analysis</category>
      <description><![CDATA[A deep dive into mapping CWE-514 to TLCTC #8, explaining the cause-oriented logic, multi-stage attack paths like #1 → #8, and why specific CWEs are better for control selection.]]></description>
    </item>
    <item>
      <title>EU Cybersecurity Act (CSA): TLCTC Pain Points &amp; Fixes</title>
      <link>https://www.tlctc.net/blog-eu-cybersecurity-act-csa.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/blog-eu-cybersecurity-act-csa.html</guid>
      <pubDate>Sun, 28 Sep 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Regulations &amp; Compliance</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[We assess the EU Cybersecurity Act (CSA) through the TLCTC framework, highlighting where certification may under‑deliver and how to fix it.]]></description>
    </item>
    <item>
      <title>Cyber Resilience Act (CRA): TLCTC Pain Points &amp; Fixes</title>
      <link>https://www.tlctc.net/blog-tlctc-cra-pain-points.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/blog-tlctc-cra-pain-points.html</guid>
      <pubDate>Sun, 28 Sep 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Regulations &amp; Compliance</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[We assess the EU Cyber Resilience Act exclusively through the TLCTC framework and highlight where CRA implementation may under‑deliver unless stakeholders adopt a cause‑oriented threat language.]]></description>
    </item>
    <item>
      <title>EU Cyber Regulation Will Fail Without a Common Threat Taxonomy (Enter TLCTC)</title>
      <link>https://www.tlctc.net/blog-eu-regulation-tlctc-taxonomy.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/blog-eu-regulation-tlctc-taxonomy.html</guid>
      <pubDate>Sun, 28 Sep 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Regulations &amp; Compliance</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[The EU's flagship cyber regulations (NIS2, Cybersecurity Act, CRA) will under-deliver on actual cyber risk reduction because they lack a shared, cause-based understanding and categorization of cyber threats. TLCTC provides the unifying taxonomy.]]></description>
    </item>
    <item>
      <title>Why "Cyber" in the Name Doesn't Win Cyber Wars</title>
      <link>https://www.tlctc.net/blog-iso27001-iso27005.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/blog-iso27001-iso27005.html</guid>
      <pubDate>Sun, 28 Sep 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[ISO standards are essential for governance, but they lack a cyber-specific threat taxonomy. Learn how TLCTC fills this critical gap to create a truly path-aware defense program.]]></description>
    </item>
    <item>
      <title>The Tactics Evolve. The 10 Threats Are Constant.</title>
      <link>https://www.tlctc.net/tlctc-blog-cyber-hype.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-blog-cyber-hype.html</guid>
      <pubDate>Sun, 28 Sep 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[A critique of the 'constantly evolving' threat landscape narrative. TLCTC reveals the strategic stability of 10 core threats, enabling a shift from reactive firefighting to proactive, cause-oriented defense.]]></description>
    </item>
    <item>
      <title>Attack Path Notation: Domain Boundaries and Supply-Chain Transitions</title>
      <link>https://www.tlctc.net/blog-attack-path-supply-chain.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/blog-attack-path-supply-chain.html</guid>
      <pubDate>Sun, 14 Sep 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Threat Analysis</category>
      <description><![CDATA[Learn about TLCTC's sequential attack-path notation system for mapping domain boundaries and supply-chain transitions using #10 markers to denote trust domain crossings.]]></description>
    </item>
    <item>
      <title>Gemini 2.5 Pro: Chat about the biggest problem in cyber riskmanagement and cyber threats discussions.</title>
      <link>https://www.tlctc.net/blog-tlctc-ai-conversation-from-scratch.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/blog-tlctc-ai-conversation-from-scratch.html</guid>
      <pubDate>Wed, 03 Sep 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[An in-depth AI analysis of the TLCTC framework through conversation format. Exploring whether Bernhard Kreinz's novel cybersecurity approach truly solves the industry's biggest problem or reinvents existing solutions. Features detailed discussion on the Rosetta Stone metaphor and framework actionability.]]></description>
    </item>
    <item>
      <title>Comparing OCTAVE and TLCTC</title>
      <link>https://www.tlctc.net/blog-tlctc-octave.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/blog-tlctc-octave.html</guid>
      <pubDate>Sat, 28 Jun 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[While OCTAVE pioneered organizational-focused security evaluation, TLCTC advances the field with structured, cause-based threat classification that integrates seamlessly with modern security frameworks.]]></description>
    </item>
    <item>
      <title>The Missing Link: Bridging Strategy and Operations</title>
      <link>https://www.tlctc.net/tlctc-fillthegap.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-fillthegap.html</guid>
      <pubDate>Sun, 15 Jun 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Standards Integration</category>
      <description><![CDATA[How TLCTC bridges the critical gap between high-level risk management and hands-on operational security.]]></description>
    </item>
    <item>
      <title>Visualizing Threats with TLCTC Cyber Radars</title>
      <link>https://www.tlctc.net/blog-tlctc-radar-applications.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/blog-tlctc-radar-applications.html</guid>
      <pubDate>Sat, 14 Jun 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <description><![CDATA[An innovative approach to communicate and prioritize diverse cyber threats for different stakeholders.]]></description>
    </item>
    <item>
      <title>The Big Picture: Connecting NIST, MITRE and more</title>
      <link>https://www.tlctc.net/tlctc-big-picture.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-big-picture.html</guid>
      <pubDate>Fri, 13 Jun 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[Understand TLCTC's role as a unifying layer for strategic frameworks like NIST and operational ones like MITRE.]]></description>
    </item>
    <item>
      <title>Integrating TLCTC with NIST CSF 2.0</title>
      <link>https://www.tlctc.net/nist-csf-tlctc.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/nist-csf-tlctc.html</guid>
      <pubDate>Thu, 12 Jun 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <description><![CDATA[A practical guide on mapping TLCTC to the NIST Cybersecurity Framework to enhance your security posture.]]></description>
    </item>
    <item>
      <title>AI Security: NIST AI RMF, MITRE ATLAS &amp; TLCTC</title>
      <link>https://www.tlctc.net/tlctc-nist-ai-rmf-mitre-cti.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-nist-ai-rmf-mitre-cti.html</guid>
      <pubDate>Wed, 11 Jun 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Threat Analysis</category>
      <description><![CDATA[A look at securing AI systems by integrating the NIST AI Risk Management Framework and MITRE ATLAS using TLCTC.]]></description>
    </item>
    <item>
      <title>MFA Bypass Attacks Through the TLCTC Lens</title>
      <link>https://www.tlctc.net/blog-MFAbypass.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/blog-MFAbypass.html</guid>
      <pubDate>Tue, 10 Jun 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Standards Integration</category>
      <description><![CDATA[Examining MFA bypass techniques and attack paths, and how to classify them using TLCTC.]]></description>
    </item>
    <item>
      <title>Distinguishing Between Coding and Programming in TLCTC</title>
      <link>https://www.tlctc.net/tlctc-sdlc-prog-coder.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-sdlc-prog-coder.html</guid>
      <pubDate>Sun, 08 Jun 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Standards Integration</category>
      <description><![CDATA[The Distinction: Programmer vs. Coder.]]></description>
    </item>
    <item>
      <title>ATT&amp;CK - Detection Meets Risk Management</title>
      <link>https://www.tlctc.net/tlctc-mitre-enterprise.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-mitre-enterprise.html</guid>
      <pubDate>Sat, 07 Jun 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Threat Analysis</category>
      <description><![CDATA[MITRE ATT&CK and TLCTC: Detection Meets Risk Management.]]></description>
    </item>
    <item>
      <title>Vulnerability Insights: SonarQube, CWE, and TLCTC</title>
      <link>https://www.tlctc.net/tlctc-sonar-cwe.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-sonar-cwe.html</guid>
      <pubDate>Fri, 06 Jun 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Tools &amp; Applications</category>
      <description><![CDATA[Mapping static analysis findings from SonarQube through CWE to the strategic view of TLCTC.]]></description>
    </item>
    <item>
      <title>Aligning with NIST SP 800-218 (SSDF) using TLCTC</title>
      <link>https://www.tlctc.net/tlctc-NIST.SP.800-218.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-NIST.SP.800-218.html</guid>
      <pubDate>Thu, 05 Jun 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <description><![CDATA[How to use TLCTC to structure and demonstrate compliance with the Secure Software Development Framework.]]></description>
    </item>
    <item>
      <title>Enhancing STIX with TLCTC V2.0</title>
      <link>https://www.tlctc.net/stix-tlctc.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/stix-tlctc.html</guid>
      <pubDate>Tue, 03 Jun 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Tools &amp; Applications</category>
      <description><![CDATA[Integrating MITRE ATT&CK and STIX with TLCTC V2.0 — Attack Velocity (Δt), Domain Boundary Operators, and the four-file JSON architecture for threat intelligence sharing.]]></description>
    </item>
    <item>
      <title>The Threat Modeling Manifesto &amp; TLCTC</title>
      <link>https://www.tlctc.net/tlctc-threat-modeling-manifesto.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-threat-modeling-manifesto.html</guid>
      <pubDate>Fri, 30 May 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[Analyzing the values and principles of the Threat Modeling Manifesto in the context of the TLCTC framework.]]></description>
    </item>
    <item>
      <title>Comparative Analysis: TLCTC vs. STRIDE</title>
      <link>https://www.tlctc.net/tlctc-stride.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-stride.html</guid>
      <pubDate>Wed, 28 May 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Standards Integration</category>
      <description><![CDATA[An analysis of the similarities, differences, and complementary nature of TLCTC and the STRIDE framework.]]></description>
    </item>
    <item>
      <title>Comparative Analysis: TLCTC vs. PASTA</title>
      <link>https://www.tlctc.net/tlctc-pasta.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-pasta.html</guid>
      <pubDate>Tue, 27 May 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Standards Integration</category>
      <description><![CDATA[Enhance the PASTA methodology by using TLCTC for a structured and comprehensive threat analysis stage.]]></description>
    </item>
    <item>
      <title>Comparative Analysis: TLCTC vs. FAIR</title>
      <link>https://www.tlctc.net/tlctc-fair.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-fair.html</guid>
      <pubDate>Mon, 26 May 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[Explore how TLCTC can provide the foundational cyber threat event categories for a FAIR quantitative risk analysis.]]></description>
    </item>
    <item>
      <title>Automotive Security: ISO/SAE 21434 &amp; TLCTC</title>
      <link>https://www.tlctc.net/tlctc-blog-IsoSae21434.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-blog-IsoSae21434.html</guid>
      <pubDate>Sun, 25 May 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Threat Analysis</category>
      <description><![CDATA[Applying TLCTC as a high-level threat categorization layer for the TARA method in the automotive security standard.]]></description>
    </item>
    <item>
      <title>Privacy Threat Modeling: LINDDUN &amp; TLCTC</title>
      <link>https://www.tlctc.net/tlctc-LINDDUN.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-LINDDUN.html</guid>
      <pubDate>Sat, 24 May 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Regulations &amp; Compliance</category>
      <description><![CDATA[How the LINDDUN privacy threat modeling framework can be complemented by the cyber threat perspective of TLCTC.]]></description>
    </item>
    <item>
      <title>Meeting NIS2 Directive Requirements with TLCTC</title>
      <link>https://www.tlctc.net/tlctc-NIS2.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-NIS2.html</guid>
      <pubDate>Thu, 22 May 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Regulations &amp; Compliance</category>
      <description><![CDATA[How the TLCTC framework helps organizations structure their approach to NIS2 compliance and incident reporting.]]></description>
    </item>
    <item>
      <title>Cyber in the Name</title>
      <link>https://www.tlctc.net/tlctc-regulatorsANDstandards.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-regulatorsANDstandards.html</guid>
      <pubDate>Wed, 16 Apr 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Regulations &amp; Compliance</category>
      <description><![CDATA[TLCTC Framework vs. Existing Standards & Regulations - See it yourself]]></description>
    </item>
  </channel>
</rss>
