<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
     xmlns:atom="http://www.w3.org/2005/Atom"
     xmlns:dc="http://purl.org/dc/elements/1.1/">
  <channel>
    <title>TLCTC Blog — Top Level Cyber Threat Clusters</title>
    <link>https://www.tlctc.net/#blog</link>
    <description>Essays, analyses, and case studies on the TLCTC framework — a cause-oriented cyber threat taxonomy of 10 mutually exclusive clusters anchored in a Bow-Tie risk model.</description>
    <language>en-us</language>
    <lastBuildDate>Wed, 13 May 2026 14:31:28 GMT</lastBuildDate>
    <atom:link href="https://www.tlctc.net/feed.xml" rel="self" type="application/rss+xml" />
    <generator>generate-feed.py (TLCTC)</generator>
    <item>
      <title>Propagated Controls — Managing Controls Over Event Chains</title>
      <link>https://www.tlctc.net/tlctc-propagated-controls.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-propagated-controls.html</guid>
      <pubDate>Wed, 13 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Regulations &amp; Compliance</category>
      <description><![CDATA[Companion note to TLCTC v2.0 that lifts the Propagated PR mechanism out of the glossary and generalizes it to four sources — regulatory, contractual, BCM, internal policy. A PR control for a downstream BRE executes as an RS step of an upstream event. Includes GDPR vs NIS2 and BCM/RTO worked examples, the canonical RS(Eₙ) formula, and a formal Rule of Propagation: a PR control for Eₙ₊ₓ is hosted in the earliest event whose classification suffices to trigger the obligation.]]></description>
    </item>
    <item>
      <title>SABSA × TLCTC: Architecture Method, Threat Ontology, and the Predefined Control Objective</title>
      <link>https://www.tlctc.net/sabsa-tlctc-blog.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/sabsa-tlctc-blog.html</guid>
      <pubDate>Tue, 12 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[SABSA and TLCTC are routinely compared as competing frameworks. They are not. SABSA is an architectural method without a threat taxonomy; TLCTC is a threat ontology without an architectural method. This essay shows how SABSA, TLCTC, NIST CSF, and external control catalogues compose into the four-way structure enterprise security architecture actually needs — and why control objectives are predefined (60 verb-noun cells: CSF × TLCTC), not authored. Introduces the governance-umbrella archetype that binds local and operational umbrella controls to enterprise intent.]]></description>
    </item>
    <item>
      <title>The Control Fixation in the Security Properties — A TLCTC critique of G7 SBOM-for-AI</title>
      <link>https://www.tlctc.net/sbom-for-ai-control-fixation.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/sbom-for-ai-control-fixation.html</guid>
      <pubDate>Tue, 12 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[The G7's Software Bill of Materials for AI (Évian, 2026) defines seven clusters — six describe what an AI system is made of, one (Security Properties) describes what it is defended with. TLCTC v2.1 critique: the SP cluster has no threat view, conflates SRE and DRE, and is scope-blind to Model/Dataset/System/Infrastructure. Prompt-injection case study (#1 vs #3 vs #10) and a three-axis threat × element × event-side matrix that fixes it.]]></description>
    </item>
    <item>
      <title>TLCTC+ for NCSCs and CERTs: A National Reporting Extension Proposal (v0.3)</title>
      <link>https://www.tlctc.net/tlctc-plus-ncsc-proposal.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-plus-ncsc-proposal.html</guid>
      <pubDate>Tue, 12 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[A working proposal (v0.3) extending TLCTC v2.1 with a national reporting profile (TLCTC+) for NCSCs and CERTs. Six tracks — Cause / SRE / DRE / BRE / Impact / Report — layered over a TLCTC path, with structured PATTERN, BRE, IMPACT, and REPORT catalogues. Anchored at #9 Social Engineering (with required v2.1 boundary operator), covering romance scams, CEO fraud, BEC, fake tech support, account-takeover-enabled fraud, supply-chain regulatory reporting, and ransomware service outages — without polluting the threat taxonomy. Three case classes: core_cyber_incident, hybrid_cyber_enabled_harm, pure_9_digital_crime.]]></description>
    </item>
    <item>
      <title>Ten Clusters, Not Eleven — TLCTC reads the GTIG AI Threat Tracker (May 2026)</title>
      <link>https://www.tlctc.net/gtig-ai-threat-tracker-2026.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/gtig-ai-threat-tracker-2026.html</guid>
      <pubDate>Mon, 11 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Case Study</category>
      <description><![CDATA[Reading Google Threat Intelligence Group's May 2026 AI Threat Tracker through TLCTC v2.1: every finding lands in one of the existing ten cause clusters. PROMPTSPY decomposes to #9 → #7 with #1 inside the FEC loop; SANDCLOCK via LiteLLM is the canonical 2026 #10 Trust Acceptance Event; AI voice cloning is a higher-fidelity #9. AI does not create a new threat — it collapses Δt across the bow-tie, migrating VC-2 transitions to VC-3 and VC-4. Includes a 14-finding mapping table, a velocity-collapse table, a PROMPTSPY full-chain deep-dive, and a cluster radar.]]></description>
    </item>
    <item>
      <title>TLCTC v2.1 Monster Prompts — One per Peer Group</title>
      <link>https://www.tlctc.net/tlctc-prompt-index.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-prompt-index.html</guid>
      <pubDate>Sat, 09 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <category>AI Automation</category>
      <description><![CDATA[Five audience-shaped TLCTC v2.1 monster prompts — CTI/Forensic, SOC/Detection, DevSecOps/Engineers, CISO/Risk, and Regulators/Standards. Same canonical taxonomy core; persona, inputs, and outputs reshaped for each peer group. Pick the prompt that matches your role and paste it into your LLM of choice.]]></description>
    </item>
    <item>
      <title>TLCTC v2.1 — Deep Classifier Prompt for Threat-Intel &amp; Forensic Analysts</title>
      <link>https://www.tlctc.net/tlctc-prompt-cti.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-prompt-cti.html</guid>
      <pubDate>Sat, 09 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <category>AI Automation</category>
      <description><![CDATA[The CTI/forensic specialist variant of the TLCTC monster prompt: full notation pedagogy, 22 worked examples, every R-* rule, the unresolved-step protocol, and the verification checklist — built for threat-intel analysts and incident responders who need taxonomic rigor.]]></description>
    </item>
    <item>
      <title>TLCTC v2.1 — SOC &amp; Detection Prompt | Translate ATT&amp;CK + Telemetry into Attack Paths</title>
      <link>https://www.tlctc.net/tlctc-prompt-soc.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-prompt-soc.html</guid>
      <pubDate>Sat, 09 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <category>AI Automation</category>
      <description><![CDATA[The SOC variant of the TLCTC monster prompt — translate live alerts, ATT&CK technique IDs, EDR/SIEM telemetry, and IOC sets into TLCTC v2.1 attack paths with Δt velocity, ATT&CK pivots, detection-coverage call-outs, and response priority by velocity class.]]></description>
    </item>
    <item>
      <title>TLCTC v2.1 — DevSecOps &amp; Engineering Prompt | Cluster Exposure for Code, Designs, and CWEs</title>
      <link>https://www.tlctc.net/tlctc-prompt-devsecops.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-prompt-devsecops.html</guid>
      <pubDate>Sat, 09 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <category>AI Automation</category>
      <description><![CDATA[The DevSecOps variant of the TLCTC monster prompt — paste in code, design docs, CWE entries, dependency lists, or threat-model components and get per-component cluster exposure, CWE-grounded fixes, and shift-left controls.]]></description>
    </item>
    <item>
      <title>TLCTC v2.1 — CISO &amp; Risk Prompt | Cluster-Attributed Risk + Control Gaps + Board Bullets</title>
      <link>https://www.tlctc.net/tlctc-prompt-ciso.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-prompt-ciso.html</guid>
      <pubDate>Sat, 09 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <category>AI Automation</category>
      <description><![CDATA[The CISO variant of the TLCTC monster prompt — paste in incident summaries, audit findings, or risk-register entries and get a cluster-attributed risk narrative, a control-gap table mapped to NIST CSF 2.0, FAIR loss-event framing, and board-ready talking points stripped of notation.]]></description>
    </item>
    <item>
      <title>TLCTC v2.1 — Regulators &amp; Standards Prompt | Harmonize Reporting Taxonomies + TLCTC+ BRE</title>
      <link>https://www.tlctc.net/tlctc-prompt-regulators.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-prompt-regulators.html</guid>
      <pubDate>Sat, 09 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <category>AI Automation</category>
      <description><![CDATA[The Regulators variant of the TLCTC monster prompt — paste in NIS2 / DORA / SEC 8-K-style filings or CERT bulletins and get cluster classification of root cause, TLCTC+ Business Risk Event (BRE) consequence tags, a crosswalk to existing reporting taxonomies, and gap commentary on what the source filing failed to express.]]></description>
    </item>
    <item>
      <title>Chaos Ransomware: A Rapid7 Analysis Through the Lens of the TLCTC</title>
      <link>https://www.tlctc.net/chaos-ransomware-tlctc-analysis.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/chaos-ransomware-tlctc-analysis.html</guid>
      <pubDate>Fri, 08 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Case Study</category>
      <description><![CDATA[Rapid7's forensic write-up of an intrusion branded "Chaos ransomware" — but no encryption ever happened. TLCTC v2.1 decomposition into seven classified steps (#9 → #4 → #1 → #4 → #1 → #7 → #7), with Teams as transit (not attack surface), the MFA self-enrollment hijack as its own #1, and an operator-gated VC-2 pause inside ms_upd.exe that the "ransomware" framing would have hidden. Closes on [DRE: C] only — no [DRE: Ac].]]></description>
    </item>
    <item>
      <title>Apache HTTP Server 2.4.67 — TLCTC Decomposition of 11 CVEs</title>
      <link>https://www.tlctc.net/apache-2.4.67-tlctc-analysis.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/apache-2.4.67-tlctc-analysis.html</guid>
      <pubDate>Wed, 06 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Case Study</category>
      <description><![CDATA[Cause-side classification of the 11 CVEs closed in Apache HTTP Server 2.4.67 (4 May 2026). The batch splits into five #2 (server-side request handling), five #3 in mod_proxy_ajp via R-ROLE (response-parsing of attacker-controlled backend output), and one #6 (mod_md unbounded allocation). Why CVSS, RCE labels, and CISA-ADP enrichment hide the right control surface — and why three IAV-Yes CVEs concentrate the patch-window risk.]]></description>
    </item>
    <item>
      <title>CVE-2026-31431 ("Copy Fail") — TLCTC Analysis</title>
      <link>https://www.tlctc.net/cve-2026-31431.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/cve-2026-31431.html</guid>
      <pubDate>Mon, 04 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Case Study</category>
      <description><![CDATA[A Linux kernel privilege-escalation primitive in the AF_ALG / algif_aead path. The CVE itself is #2.2 Exploiting Server; four realistic in-the-wild chains (server compromise, container escape, phishing, supply chain) all end at the same kernel step. Why ATT&CK T1068 conflates cause and effect.]]></description>
    </item>
    <item>
      <title>Cause-Oriented SOAR: TLCTC for Cortex XSOAR and XSIAM</title>
      <link>https://www.tlctc.net/cortex-xsoar-tlctc-integration.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/cortex-xsoar-tlctc-integration.html</guid>
      <pubDate>Mon, 04 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <category>Standards Integration</category>
      <description><![CDATA[One master playbook per TLCTC cluster, none per outcome. Cortex XSOAR 6.2.x and XSOAR 8.x / XSIAM builds shipping a Velocity-Class router, RS Container sub-playbook with GDPR Art. 33 / NIS2 Art. 23 triggers, an ATT&CK→TLCTC classifier, and a Layer 3 attack-path emitter.]]></description>
    </item>
    <item>
      <title>The Missing Axis — D3FEND and TLCTC, Two Layers of One Stack</title>
      <link>https://www.tlctc.net/missing-axis-d3fend-tlctc.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/missing-axis-d3fend-tlctc.html</guid>
      <pubDate>Sat, 02 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Standards Integration</category>
      <description><![CDATA[MITRE's D3FEND knowledge graph is the most rigorously structured catalog of defensive countermeasures the industry has produced — yet inherits the threat-axis gap from ATT&CK that TLCTC was built to fix. A layered-stack analysis showing where D3FEND fits, where it doesn't, and why the pairing with TLCTC is more than additive.]]></description>
    </item>
    <item>
      <title>The Control Fixation Reflex</title>
      <link>https://www.tlctc.net/control-fixation-reflex.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/control-fixation-reflex.html</guid>
      <pubDate>Fri, 01 May 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards &amp; Critique</category>
      <category>Philosophy</category>
      <description><![CDATA[Why the cybersecurity industry can't stop counting controls — and what it has stopped asking. Names the autonomic reflex that operates at the control layer as if it were the foundational layer, and traces how it propagates through standards, vendors, auditors, GRC tools, maturity models, and the boardroom.]]></description>
    </item>
    <item>
      <title>CVE-2026-21510: When the Warning Doesn't Warn</title>
      <link>https://www.tlctc.net/cve-2026-21510.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/cve-2026-21510.html</guid>
      <pubDate>Wed, 29 Apr 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Standards &amp; Critique</category>
      <description><![CDATA[A Windows Shell bypass slips past SmartScreen and Mark-of-the-Web. Through TLCTC, the chain is #9 → #3 → #7, but the CVE itself is #3 Exploiting Client. Why CWE-693 (Protection Mechanism Failure) misleads strategically.]]></description>
    </item>
    <item>
      <title>CVE-2026-35414: A 15-Year-Old Comma in OpenSSH</title>
      <link>https://www.tlctc.net/cve-2026-35414.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/cve-2026-35414.html</guid>
      <pubDate>Tue, 28 Apr 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Standards Integration</category>
      <description><![CDATA[An OpenSSH certificate principal containing a comma can grant unauthorized root access. Through TLCTC, the scenario decomposes as #4 → #2, but the CVE itself is #2 Exploiting Server. A worked example of cause-oriented CVE classification.]]></description>
    </item>
    <item>
      <title>Incident Reporting with VERIS and TLCTC</title>
      <link>https://www.tlctc.net/tlctc-veris.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-veris.html</guid>
      <pubDate>Mon, 27 Apr 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Threat Analysis</category>
      <description><![CDATA[See a practical example of how the VERIS vocabulary for describing incidents can be mapped to TLCTC.]]></description>
    </item>
    <item>
      <title>10 × 10 × 10 — A Fun Fact about TLCTC</title>
      <link>https://www.tlctc.net/tlctc-10x10x10-fun-fact.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-10x10x10-fun-fact.html</guid>
      <pubDate>Sun, 19 Apr 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Research &amp; Insights</category>
      <description><![CDATA[Three independent pillars of TLCTC — Definitions (Semantic), Axioms (Ontological), Principles (Logical) — each ended up numbering exactly ten. Not designed. Just ended up that way.]]></description>
    </item>
    <item>
      <title>The #1-Cascade — Active Directory, Domain Admin, and Ransomware under the TLCTC Lens</title>
      <link>https://www.tlctc.net/ad-ransomware-tlctc-cascade.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/ad-ransomware-tlctc-cascade.html</guid>
      <pubDate>Sat, 18 Apr 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[A forensic-level TLCTC v2.1 decomposition of how attackers reach Domain Admin and deploy ransomware. Shows why the entire post-DA phase is structurally #1, with attack path notation, event IDs, and DRE annotations grounded in 2025 IR data.]]></description>
    </item>
    <item>
      <title>SSDLC for Developers: The "S" Problem and How TLCTC Fixes It</title>
      <link>https://www.tlctc.net/tlctc-ssdlc.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-ssdlc.html</guid>
      <pubDate>Sat, 18 Apr 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Standards Integration</category>
      <description><![CDATA[Design reviews are theatre? Make them bite. A developer-first entry point to Secure SDLC with the TLCTC threat clusters, attack-path design reviews, and a CWE triage shortcut.]]></description>
    </item>
    <item>
      <title>The End of Semantic Diffusion: DREAD vs STRIDE vs TLCTC</title>
      <link>https://www.tlctc.net/tlctc-semantic-diffusion-dread-stride.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-semantic-diffusion-dread-stride.html</guid>
      <pubDate>Sun, 12 Apr 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Threat Analysis</category>
      <description><![CDATA[Compare Microsoft's DREAD and STRIDE with the cause-oriented TLCTC framework to understand why cybersecurity must stop blending causes with outcomes for genuine semantic precision.]]></description>
    </item>
    <item>
      <title>DORA TLPT</title>
      <link>https://www.tlctc.net/tlctc-regulation-dora-tlpt.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-regulation-dora-tlpt.html</guid>
      <pubDate>Fri, 10 Apr 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Regulations &amp; Compliance</category>
      <description><![CDATA[detailed analysis of the DORA TLPT and a comparison with the Top Level Cyber Threat Clusters (TLCTC) framework...]]></description>
    </item>
    <item>
      <title>Comparative Analysis: TLCTC vs. DIAMOND</title>
      <link>https://www.tlctc.net/tlctc-diamond-model.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-diamond-model.html</guid>
      <pubDate>Sat, 04 Apr 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[The Diamond Model of Intrusion Analysis is a powerful relational framework for threat intelligence — but its vertices lack internal causal structure. TLCTC fills that gap.]]></description>
    </item>
    <item>
      <title>The npm Supply Chain Attack Is Not a Package Story. It Is a Trust-Acceptance Story.</title>
      <link>https://www.tlctc.net/tlctc-npm-supply-chain.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-npm-supply-chain.html</guid>
      <pubDate>Thu, 19 Mar 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Framework &amp; Concepts</category>
      <category>Supply Chain</category>
      <description><![CDATA[Why npm supply chain attacks are fundamentally trust-acceptance failures. Learn to map malicious packages, typosquatting, and dependency confusion to TLCTC clusters.]]></description>
    </item>
    <item>
      <title>TLCTC v2.1: Full Extension Spec - Boundary &amp; Transit Operators</title>
      <link>https://www.tlctc.net/https://github.com/Barnes70/TLCTC/blob/main/v2.1-Proposals/TLCTC_v2.1_Full_Extension_Spec.pdf</link>
      <guid isPermaLink="true">https://www.tlctc.net/https://github.com/Barnes70/TLCTC/blob/main/v2.1-Proposals/TLCTC_v2.1_Full_Extension_Spec.pdf</guid>
      <pubDate>Sun, 15 Mar 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Notation &amp; Standards</category>
      <description><![CDATA[v2.1 adds transit and intra-system boundary operators to the notation—tracking how attacks relay through intermediate carriers and escalate within hosts. Same ten clusters, sharper observability.]]></description>
    </item>
    <item>
      <title>The Semantic Problem with "Zero Trust"</title>
      <link>https://www.tlctc.net/tlctc-zero-trust-semantic-problem.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-zero-trust-semantic-problem.html</guid>
      <pubDate>Sun, 15 Mar 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Strategic Threat Intelligence</category>
      <description><![CDATA[Deconstructing Zero Trust as a meta-principle. Why the industry's blurriness regarding Zero Trust is structurally inevitable and how to pin it to concrete TLCTC clusters.]]></description>
    </item>
    <item>
      <title>IEC 62443 Meets TLCTC v2.1: Filling the Threat Taxonomy Gap in Industrial Cybersecurity</title>
      <link>https://www.tlctc.net/tlctc-iec62443-v2.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-iec62443-v2.html</guid>
      <pubDate>Sun, 01 Mar 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[How TLCTC v2.0's cause-oriented taxonomy, velocity classes, and attack path notation fill the threat identification gap in IEC 62443 industrial cybersecurity risk assessments.]]></description>
    </item>
    <item>
      <title>The Crux of Banks Regarding Operational Risk Management</title>
      <link>https://www.tlctc.net/tlctc-banks-operational-risk-basel.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-banks-operational-risk-basel.html</guid>
      <pubDate>Thu, 26 Feb 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Risk Management</category>
      <category>Regulations &amp; Compliance</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[Why Basel's Event Categories Structurally Undermine the Risk Standards They Claim to Implement. A deep dive into the contradiction between ISO 31000, COSO ERM, and Basel OPE25 Table 2.]]></description>
    </item>
    <item>
      <title>The Consequence Amplifier: Agentic AI on the Right Side of the Bow-Tie</title>
      <link>https://www.tlctc.net/tlctc-agentic-ai-consequences.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-agentic-ai-consequences.html</guid>
      <pubDate>Wed, 25 Feb 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Framework &amp; Concepts</category>
      <category>AI Security</category>
      <description><![CDATA[How Autonomous Tool Access Transforms Damage Patterns. A deep dive into the right side of the Bow-Tie, exploring Velocity, Scope, and Autonomy Amplification.]]></description>
    </item>
    <item>
      <title>Agentic AI Under the Microscope</title>
      <link>https://www.tlctc.net/tlctc-agentic-ai-microscope.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-agentic-ai-microscope.html</guid>
      <pubDate>Wed, 25 Feb 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[Why 'AI Security' is not a threat category. A cause-based decomposition of agentic AI threats using the TLCTC framework, separating generic software vulnerabilities from AI-specific attack vectors.]]></description>
    </item>
    <item>
      <title>The "Why Ten?" Question: Explaining the 10 Clusters</title>
      <link>https://www.tlctc.net/tlctc-why10-explainer.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-why10-explainer.html</guid>
      <pubDate>Fri, 20 Feb 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[A deep dive into the logic and thought experiment behind the creation of exactly ten, non-overlapping clusters.]]></description>
    </item>
    <item>
      <title>Why the TLCTC Does Not Need the "Hazard"</title>
      <link>https://www.tlctc.net/tlctc-hazard-omission.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-hazard-omission.html</guid>
      <pubDate>Sat, 14 Feb 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Risk Management</category>
      <description><![CDATA[A structural argument for terminological precision. Why importing the 'Hazard' concept from safety engineering into cybersecurity creates semantic diffusion and how TLCTC solves it.]]></description>
    </item>
    <item>
      <title>Generic Vulnerabilities: Software &amp; Hardware Failure</title>
      <link>https://www.tlctc.net/tlctc-generic-vulnerabilities.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-generic-vulnerabilities.html</guid>
      <pubDate>Thu, 12 Feb 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Risk Management</category>
      <description><![CDATA[A deep dive into non-adversarial IT risk events using the TLCTC Bow-Tie methodology. Analyzing the logical vs material imperfections that cause infrastructure failures.]]></description>
    </item>
    <item>
      <title>TLCTC Attack Path — 20 Annotated Examples</title>
      <link>https://www.tlctc.net/tlctc-attack-path-examples.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-attack-path-examples.html</guid>
      <pubDate>Sun, 08 Feb 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Threat Analysis</category>
      <description><![CDATA[Master the TLCTC mapping logic with 20 real-world scenarios. From supply chain implants to zero-click exploits, learn to denote causal paths and Data Risk Events correctly.]]></description>
    </item>
    <item>
      <title>Why DORA Will Fail Regarding Cyber Risks</title>
      <link>https://www.tlctc.net/tlctc-dora-cyber-risk-failure.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-dora-cyber-risk-failure.html</guid>
      <pubDate>Sat, 07 Feb 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Regulations &amp; Compliance</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[A structural critique of the EU's Digital Operational Resilience Act. Why mandating 'risk-based' management without a threat taxonomy creates a quiet failure of compliance over security.]]></description>
    </item>
    <item>
      <title>22 Definition Entries for 'Threat' — On One NIST Page</title>
      <link>https://www.tlctc.net/tlctc-nist-threat-chaos.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-nist-threat-chaos.html</guid>
      <pubDate>Tue, 27 Jan 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards &amp; Critique</category>
      <category>Language &amp; Standards</category>
      <description><![CDATA[NIST's glossary lists 22 conflicting definitions for a single core term. Explore how this semantic chaos propagates und wieso Präzision für das Risikomanagement auf Vorstandsebene erforderlich ist.]]></description>
    </item>
    <item>
      <title>GDPR vs NIS2: Different Trigger Points for Compliance Events</title>
      <link>https://www.tlctc.net/tlctc-gdpr-nis2-triggers.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-gdpr-nis2-triggers.html</guid>
      <pubDate>Sat, 24 Jan 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Regulations &amp; Compliance</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[The same incident can trigger different compliance obligations. GDPR is triggered by PII exposure (Data Risk Event), while NIS2 is triggered by the Incident itself (Cyber Risk Event).]]></description>
    </item>
    <item>
      <title>TLCTC for Everyone: The "Blind Spot" Method</title>
      <link>https://www.tlctc.net/tlctc-everyone-blind-spot.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-everyone-blind-spot.html</guid>
      <pubDate>Thu, 15 Jan 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Risk Management</category>
      <description><![CDATA[Stop worrying about complexity. Learn the 10x5 matrix logic through the 'Blind Spot' exercise—a simplified starting point for individuals and SMEs to audit their own security.]]></description>
    </item>
    <item>
      <title>Quantum Computing and AI: New Magic, Same Threats</title>
      <link>https://www.tlctc.net/tlctc-quantum-ai-velocity.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-quantum-ai-velocity.html</guid>
      <pubDate>Thu, 08 Jan 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Threat Analysis</category>
      <description><![CDATA[A strategic analysis of how Quantum and AI act as threat amplifiers. While the 10 clusters remain stable, the shift to high-velocity (VC-3) attacks mandates a transition to automated and architectural controls.]]></description>
    </item>
    <item>
      <title>GovCERT-CH Blocked Filetypes: TLCTC Analysis</title>
      <link>https://www.tlctc.net/tlctc-govcert-blocked-filetypes.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-govcert-blocked-filetypes.html</guid>
      <pubDate>Tue, 06 Jan 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Standards Integration</category>
      <description><![CDATA[A strategic restructuring of the GovCERT-CH blocked filetypes list. Why conflating Tier 1 (Native FEC) with Tier 3 (Parser Bugs) creates false confidence.]]></description>
    </item>
    <item>
      <title>The File Type Fallacy: Why Extension Blocklists Miss the Point</title>
      <link>https://www.tlctc.net/tlctc-file-type-fallacy.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-file-type-fallacy.html</guid>
      <pubDate>Tue, 06 Jan 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Threat Analysis</category>
      <description><![CDATA[Applying TLCTC's cause-based classification to understand the three-tier distinction: native executables, application-mediated execution, and data files requiring parser exploits.]]></description>
    </item>
    <item>
      <title>The End of Semantic Diffusion</title>
      <link>https://www.tlctc.net/tlctc-semantic-diffusion.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-semantic-diffusion.html</guid>
      <pubDate>Tue, 30 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Philosophy</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[Why cybersecurity is stuck in a pre-paradigmatic phase. Thomas Kuhn, Semantic Diffusion, and the scientific necessity of a shared threat language.]]></description>
    </item>
    <item>
      <title>ENISA Threat Landscape 2025 - TLCTC Analysis</title>
      <link>https://www.tlctc.net/tlctc-enisa-2025-threat-report.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-enisa-2025-threat-report.html</guid>
      <pubDate>Thu, 25 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Research &amp; Insights</category>
      <category>Threat Analysis</category>
      <description><![CDATA[A strategic decomposition of 4,900+ incidents from the ENISA Threat Landscape 2025 report. Mapping the landscape to TLCTC clusters to reveal the polarization between human manipulation and server exploitation.]]></description>
    </item>
    <item>
      <title>The Logical Contradiction in Control-First Regulation</title>
      <link>https://www.tlctc.net/tlctc-control-first-regulation.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-control-first-regulation.html</guid>
      <pubDate>Thu, 25 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Regulations &amp; Compliance</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[Why cybersecurity regulations mandate controls without identifying threats, contradicting the standards they cite. A structural critique of the regulatory gap. Reminder: Dont conflate compliance risk with cyber risk!]]></description>
    </item>
    <item>
      <title>M-Trends 2025: TLCTC Analysis</title>
      <link>https://www.tlctc.net/tlctc-mtrends-2025.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-mtrends-2025.html</guid>
      <pubDate>Thu, 25 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Research &amp; Insights</category>
      <category>Threat Analysis</category>
      <description><![CDATA[A cause-based analysis of Mandiant's M-Trends 2025 Report. Reframing outcome-based data (Ransomware, Dwell Time) into root-cause clusters to reveal the true 2025 threat landscape.]]></description>
    </item>
    <item>
      <title>The Same Attack, Four Different Stories</title>
      <link>https://www.tlctc.net/tlctc-threat-report-chaos.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-threat-report-chaos.html</guid>
      <pubDate>Thu, 25 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Research &amp; Insights</category>
      <category>Threat Analysis</category>
      <description><![CDATA[Verizon, CrowdStrike, Mandiant, and ENISA all see the same threats but speak different languages. Why the industry needs a common denominator.]]></description>
    </item>
    <item>
      <title>ENISA Gap Analysis: Integrating TLCTC for Semantic Precision</title>
      <link>https://www.tlctc.net/tlctc-enisa-gap-analysis.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-enisa-gap-analysis.html</guid>
      <pubDate>Wed, 24 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Regulations &amp; Compliance</category>
      <description><![CDATA[A deep dive into ENISA's current cybersecurity framework gaps and how TLCTC's cause-oriented taxonomy provides the missing semantic layer for EU compliance (NIS2/DORA).]]></description>
    </item>
    <item>
      <title>Enhancing CVE Details</title>
      <link>https://www.tlctc.net/tlctc-cve-nvd.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-cve-nvd.html</guid>
      <pubDate>Wed, 24 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Tools &amp; Applications</category>
      <description><![CDATA[Enhancing CVE Details with the TLCTC Framework: A Strategic Approach incl. json.]]></description>
    </item>
    <item>
      <title>Cobalt Strike Capabilities Mapped to TLCTC Framework</title>
      <link>https://www.tlctc.net/tlctc-cobaltstrike-mapping.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-cobaltstrike-mapping.html</guid>
      <pubDate>Tue, 23 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <category>Threat Analysis</category>
      <description><![CDATA[Comprehensive Implementation Guide: Mapping Cobalt Strike features to TLCTC V2.0 clusters, with corrections for credential dumping (R-CRED) and LOLBAS execution sequences.]]></description>
    </item>
    <item>
      <title>Beyond Encryption: Understanding the Full Scope of Communication Path Threats</title>
      <link>https://www.tlctc.net/tlctc-mitm-encryption-scion.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-mitm-encryption-scion.html</guid>
      <pubDate>Tue, 23 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Threat Analysis</category>
      <description><![CDATA[Why encryption addresses only half the #5 threat. A deep dive into Path Control (SCION), Post-Quantum TLS, and East-West traffic defense.]]></description>
    </item>
    <item>
      <title>TLCTC Analysis: CrowdStrike 2025 Threat Hunting Report</title>
      <link>https://www.tlctc.net/tlctc-crowdstrike-2025-threat-report.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-crowdstrike-2025-threat-report.html</guid>
      <pubDate>Mon, 22 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Research &amp; Insights</category>
      <category>Threat Analysis</category>
      <description><![CDATA[A strategic TLCTC breakdown of the 2025 report. Visualizing the shift to 81% malware-free attacks (#1, #4) and mapping adversaries like Scattered Spider to the 10 Clusters.]]></description>
    </item>
    <item>
      <title>TLCTC Intelligence Brief: The 2025 CrowdStrike Global Threat Report</title>
      <link>https://www.tlctc.net/tlctc-crowdstrike-2025-report.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-crowdstrike-2025-report.html</guid>
      <pubDate>Mon, 22 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Research &amp; Insights</category>
      <category>Threat Analysis</category>
      <description><![CDATA[The 2025 CrowdStrike report confirms a strategic shift to Identity (#4) and Abuse of Functions (#1). 79% of attacks are now malware-free, with a 48-minute breakout time.]]></description>
    </item>
    <item>
      <title>Control Matrices for Starters (SME &amp; Priv)</title>
      <link>https://www.tlctc.net/tlctc-sme-private-controls.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-sme-private-controls.html</guid>
      <pubDate>Thu, 18 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[TLCTC is not only for Big Orgs. No. See the unified 10x12 and 10x6 control matrices for SMEs and Private users, mapped to NIST CSF 2.0 functions. Take it as a Starter Kit]]></description>
    </item>
    <item>
      <title>Time for a Reboot: Why MITRE CWE Needs Taxonomic Discipline</title>
      <link>https://www.tlctc.net/tlctc-cwe-reboot.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-cwe-reboot.html</guid>
      <pubDate>Fri, 12 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[MITRE's latest update adds 12 organizational containers, not weaknesses. An analysis of why 20 years of 'integration' created a registry without a taxonomy.]]></description>
    </item>
    <item>
      <title>Why ORX Must Rethink the "Cyber Event": A Methodological Critique</title>
      <link>https://www.tlctc.net/tlctc-orx-rethink-cyber-event.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-orx-rethink-cyber-event.html</guid>
      <pubDate>Thu, 11 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Risk Management</category>
      <description><![CDATA[Why the ORX Reference Taxonomy's static 'Cyber Event' category fails at defense. How TLCTC's causal, velocity-aware approach resolves overlap and operational blind spots.]]></description>
    </item>
    <item>
      <title>The Power of Causality: Why the Bow-Tie Model Transforms Cyber Risk Management</title>
      <link>https://www.tlctc.net/tlctc-bow-tie-causality.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-bow-tie-causality.html</guid>
      <pubDate>Fri, 05 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Threat Analysis</category>
      <description><![CDATA[Transforming cyber risk from guesswork to science by mapping the causal flow from Threat Clusters to Business Impact using the TLCTC Bow-Tie logic.]]></description>
    </item>
    <item>
      <title>Threat-Driven Development: Integrating TLCTC into the SSDLC</title>
      <link>https://www.tlctc.net/tlctc-ssdlc-integration.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-ssdlc-integration.html</guid>
      <pubDate>Thu, 04 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[Why most 'secure by design' initiatives fail—and how cause-oriented threat modeling using TLCTC transforms development from Design to Decommissioning.]]></description>
    </item>
    <item>
      <title>TLCTC Harbor Integration App</title>
      <link>https://www.tlctc.net/tlctc-harbor-integration.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-harbor-integration.html</guid>
      <pubDate>Wed, 03 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <category>Standards Integration</category>
      <description><![CDATA[A client-side app integrating Harbor Registry scans with TLCTC. Map CVEs to the 10 Clusters and visualize strategic risk.]]></description>
    </item>
    <item>
      <title>MITRE ATT&amp;CK for ML (AML) × TLCTC</title>
      <link>https://www.tlctc.net/tlctc-mitre-aml-mapping.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-mitre-aml-mapping.html</guid>
      <pubDate>Mon, 01 Dec 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <category>Standards Integration</category>
      <category>AI Security</category>
      <description><![CDATA[An interactive tool mapping MITRE ATT&CK for Machine Learning (AML) techniques to the 10 TLCTC clusters. Strategic threat analysis and risk management for AI systems.]]></description>
    </item>
    <item>
      <title>Kill the Hype: Capability-Based Planning via the 10x(6x2) Matrix</title>
      <link>https://www.tlctc.net/tlctc-capability-based-planning.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-capability-based-planning.html</guid>
      <pubDate>Sun, 30 Nov 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Strategic Threat Intelligence</category>
      <description><![CDATA[Transform capability planning from consulting theater into engineered defense. Introducing the 10 Clusters × 6 Functions × 2 Scopes matrix strategy.]]></description>
    </item>
    <item>
      <title>Beyond STRIDE: Upgrading Microsoft Threat Modeling to TLCTC</title>
      <link>https://www.tlctc.net/tlctc-microsoft-threat-modeling-stride.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-microsoft-threat-modeling-stride.html</guid>
      <pubDate>Sun, 30 Nov 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Tools &amp; Applications</category>
      <description><![CDATA[Why the Microsoft Threat Modeling Tool needs to evolve from STRIDE's list-based approach to TLCTC's causal attack paths. A blueprint for modernizing DevSecOps.]]></description>
    </item>
    <item>
      <title>The Audit Trap</title>
      <link>https://www.tlctc.net/tlctc-audit-trap.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-audit-trap.html</guid>
      <pubDate>Sun, 30 Nov 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Strategy &amp; Governance</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[Why Compliance Doesn't Equal Security—and How Threat-Control Mapping Fixes It. Learn how strict threat-control mappings with TLCTC break the circular nightmare.]]></description>
    </item>
    <item>
      <title>Strategic Threat Profiling: The Actor Profile Designer</title>
      <link>https://www.tlctc.net/tools/actor-profile-designer.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tools/actor-profile-designer.html</guid>
      <pubDate>Sat, 29 Nov 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <category>Threat Analysis</category>
      <description><![CDATA[A strategic guide to designing, scoring, and visualizing threat actor capabilities. Includes the full download of 40+ Google APT groups mapped to TLCTC.]]></description>
    </item>
    <item>
      <title>TLCTC App Suite Gallery</title>
      <link>https://www.tlctc.net/tlctc-app-gallery.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-app-gallery.html</guid>
      <pubDate>Sat, 29 Nov 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[The central hub for all TLCTC applications: Architect V3.0, Threat Radar, Attack Path Designer, and JSON utilities.]]></description>
    </item>
    <item>
      <title>TLCTC Architect V.0 - User Guide &amp; Technical Documentation</title>
      <link>https://www.tlctc.net/tlctc-Architect-V3-UserGuide.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-Architect-V3-UserGuide.html</guid>
      <pubDate>Mon, 24 Nov 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[The official guide to modeling attack paths, visualizing velocity (Δt), and using the JSON schema in TLCTC Architect V3.0.]]></description>
    </item>
    <item>
      <title>Cyber Crime Taxonomy: The Critical #9 Bifurcation</title>
      <link>https://www.tlctc.net/tlctc-social-engineering-bifurcation.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-social-engineering-bifurcation.html</guid>
      <pubDate>Mon, 24 Nov 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Threat Analysis</category>
      <description><![CDATA[Taxonomy/Definition: Understanding where social engineering splits determines everything. #9.1 (Liability) vs #9.2 (Cyber Threat). A guide to precise classification and response.]]></description>
    </item>
    <item>
      <title>TLCTC Infographics: Learn with Images</title>
      <link>https://www.tlctc.net/tlctc-infographics.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-infographics.html</guid>
      <pubDate>Sun, 23 Nov 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[A high-resolution gallery of the Nano 2 infographic series, featuring the Cyber Bow-Tie, the IT Monolith thought experiment, and the Attacker's Perspective and many more. Images can empower Words!]]></description>
    </item>
    <item>
      <title>Mapping the Chaos: Introducing the TLCTC Emerging Tech &amp; Actors Radar</title>
      <link>https://www.tlctc.net/tlctc-emerging-tech-radar.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-emerging-tech-radar.html</guid>
      <pubDate>Sat, 22 Nov 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Strategic Threat Intelligence</category>
      <category>Framework &amp; Concepts</category>
      <category>Tools</category>
      <description><![CDATA[Introducing a standardized visualization and JSON format that maps emerging technologies and threat actors directly to the 10 TLCTC clusters.]]></description>
    </item>
    <item>
      <title>TLCTC Glossary V2.0: The Complete Definitions</title>
      <link>https://www.tlctc.net/tlctc-glossar.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-glossar.html</guid>
      <pubDate>Sat, 22 Nov 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Reference</category>
      <description><![CDATA[The definitive guide to TLCTC V2.0. Comprehensive definitions for the 10 Clusters, plus new concepts: Attack Velocity (Δt), DCS, and the new JSON Architecture.]]></description>
    </item>
    <item>
      <title>The Topology of Cyber Attacks</title>
      <link>https://www.tlctc.net/tlctc-topology-of-cyber-attacks.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-topology-of-cyber-attacks.html</guid>
      <pubDate>Thu, 20 Nov 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Threat Analysis</category>
      <description><![CDATA[Why #8, #9, and #10 are fundamentally different. A deep dive into Bridge Clusters, Domain Boundaries, and the architecture of modern cyber defense in TLCTC V2.0.]]></description>
    </item>
    <item>
      <title>Cyber Risk: EU Regulation vs. TLCTC</title>
      <link>https://www.tlctc.net/tlctc-eu-regulation.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-eu-regulation.html</guid>
      <pubDate>Thu, 20 Nov 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Regulations &amp; Compliance</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[A detailed comparison of EU Regulations (NIS2, DORA, CRA) and the TLCTC Framework regarding definitions, taxonomy, and operational synergy.]]></description>
    </item>
    <item>
      <title>The Fourth Dimension: Attack Velocity (Δt)</title>
      <link>https://www.tlctc.net/tlctc-attack-velocity.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-attack-velocity.html</guid>
      <pubDate>Thu, 20 Nov 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Threat Analysis</category>
      <description><![CDATA[Why Attack Velocity (Δt) defines your true defense reality. Introducing TLCTC V2.0 temporal notation and the Detection Coverage Score (DCS).]]></description>
    </item>
    <item>
      <title>Grok AI 4.1: Validation of the TLCTC Framework</title>
      <link>https://www.tlctc.net/tlctc-grok-ai-validation.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-grok-ai-validation.html</guid>
      <pubDate>Thu, 20 Nov 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>AI Analysis</category>
      <description><![CDATA[An independent, critical analysis by Grok AI confirming that TLCTC fills the 'missing link' gap between strategic risk management and operational security, validating its uniqueness against MITRE and NIST.]]></description>
    </item>
    <item>
      <title>TLCTC JSON Architecture</title>
      <link>https://www.tlctc.net/TLCTC-JSON-Architecture.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/TLCTC-JSON-Architecture.html</guid>
      <pubDate>Wed, 19 Nov 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Tools &amp; Applications</category>
      <description><![CDATA[A technical guide to the TLCTC JSON architecture, separating universal framework definitions from specific attack instances for scalable, worldwide threat intelligence sharing.]]></description>
    </item>
    <item>
      <title>TLCTC Enhanced Prompt for AI Analysis</title>
      <link>https://www.tlctc.net/tlctc-ai-analysis-prompt.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-ai-analysis-prompt.html</guid>
      <pubDate>Mon, 17 Nov 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[A ready-to-paste prompt that instructs an AI to analyze any Security Report, Cyber Incident Report, or similar document through the lens of the Top Level Cyber Threat Clusters (TLCTC) framework.]]></description>
    </item>
    <item>
      <title>NIST and Cyber Threat Definition and its Consequences</title>
      <link>https://www.tlctc.net/tlctc-NIST-Threat-Definition.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-NIST-Threat-Definition.html</guid>
      <pubDate>Mon, 17 Nov 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[NIST's frameworks are process-oriented, creating a structural gap in risk management. We analyze why this gap exists and how a cause-oriented taxonomy like TLCTC is essential to bridge it.]]></description>
    </item>
    <item>
      <title>2025 DBIR Analysis Through the TLCTC Lens</title>
      <link>https://www.tlctc.net/tlctc-dbir-2025.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-dbir-2025.html</guid>
      <pubDate>Fri, 24 Oct 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Research &amp; Insights</category>
      <category>Threat Analysis</category>
      <description><![CDATA[Mapping the Verizon Data Breach Investigations Report to the Top Level Cyber Threat Clusters Framework v2.0. Key findings on Ransomware, Credential Misuse, and Edge Device Exploitation.]]></description>
    </item>
    <item>
      <title>Integrating NIST NICE Tasks with the TLCTC Framework</title>
      <link>https://www.tlctc.net/tlctc-NIST-NICE.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-NIST-NICE.html</guid>
      <pubDate>Fri, 24 Oct 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[A practical framework for integrating NIST NICE tasks with the 10 Top Level Cyber Threat Clusters (TLCTC) to bridge the gap between workforce development and real-world threats.]]></description>
    </item>
    <item>
      <title>The Kill Chain Fallacy: Why Process is Not Taxonomy</title>
      <link>https://www.tlctc.net/tlctc-KillChainFallacy.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-KillChainFallacy.html</guid>
      <pubDate>Wed, 15 Oct 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Threat Analysis</category>
      <description><![CDATA[An analysis of why the Cyber Kill Chain fails at threat categorization and attack path notation, and how the TLCTC framework provides the missing causal link for Risk Management.]]></description>
    </item>
    <item>
      <title>From Threat to Business Impact: Operationalizing the TLCTC Two-Layer Framework</title>
      <link>https://www.tlctc.net/blog-tlctc-two-layer-framework.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/blog-tlctc-two-layer-framework.html</guid>
      <pubDate>Fri, 03 Oct 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Standards Integration</category>
      <description><![CDATA[The TLCTC framework bridges the critical gap between boardroom risk discussions and SOC operations through a two-layer approach centered on the cyber risk event (system compromise/loss of control).]]></description>
    </item>
    <item>
      <title>CKC x ATT&amp;CK x TLCTC: A Practical Synthesis</title>
      <link>https://www.tlctc.net/blog-ckc-attack-tlctc-synthesis.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/blog-ckc-attack-tlctc-synthesis.html</guid>
      <pubDate>Wed, 01 Oct 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Threat Analysis</category>
      <description><![CDATA[A guide for modern defenders on synthesizing CKC for timelines, ATT&CK for techniques, and TLCTC for a cause-oriented taxonomy and governance integration.]]></description>
    </item>
    <item>
      <title>Mapping CWE-514 (Covert Channel) to TLCTC: A Cause-Oriented Analysis</title>
      <link>https://www.tlctc.net/blog-cwe-514-covert-channel-mapping.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/blog-cwe-514-covert-channel-mapping.html</guid>
      <pubDate>Wed, 01 Oct 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Threat Analysis</category>
      <description><![CDATA[A deep dive into mapping CWE-514 to TLCTC #8, explaining the cause-oriented logic, multi-stage attack paths like #1 → #8, and why specific CWEs are better for control selection.]]></description>
    </item>
    <item>
      <title>EU Cybersecurity Act (CSA): TLCTC Pain Points &amp; Fixes</title>
      <link>https://www.tlctc.net/blog-eu-cybersecurity-act-csa.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/blog-eu-cybersecurity-act-csa.html</guid>
      <pubDate>Sun, 28 Sep 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Regulations &amp; Compliance</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[We assess the EU Cybersecurity Act (CSA) through the TLCTC framework, highlighting where certification may under‑deliver and how to fix it.]]></description>
    </item>
    <item>
      <title>Cyber Resilience Act (CRA): TLCTC Pain Points &amp; Fixes</title>
      <link>https://www.tlctc.net/blog-tlctc-cra-pain-points.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/blog-tlctc-cra-pain-points.html</guid>
      <pubDate>Sun, 28 Sep 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Regulations &amp; Compliance</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[We assess the EU Cyber Resilience Act exclusively through the TLCTC framework and highlight where CRA implementation may under‑deliver unless stakeholders adopt a cause‑oriented threat language.]]></description>
    </item>
    <item>
      <title>EU Cyber Regulation Will Fail Without a Common Threat Taxonomy (Enter TLCTC)</title>
      <link>https://www.tlctc.net/blog-eu-regulation-tlctc-taxonomy.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/blog-eu-regulation-tlctc-taxonomy.html</guid>
      <pubDate>Sun, 28 Sep 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Regulations &amp; Compliance</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[The EU's flagship cyber regulations (NIS2, Cybersecurity Act, CRA) will under-deliver on actual cyber risk reduction because they lack a shared, cause-based understanding and categorization of cyber threats. TLCTC provides the unifying taxonomy.]]></description>
    </item>
    <item>
      <title>Why "Cyber" in the Name Doesn't Win Cyber Wars</title>
      <link>https://www.tlctc.net/blog-iso27001-iso27005.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/blog-iso27001-iso27005.html</guid>
      <pubDate>Sun, 28 Sep 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[ISO standards are essential for governance, but they lack a cyber-specific threat taxonomy. Learn how TLCTC fills this critical gap to create a truly path-aware defense program.]]></description>
    </item>
    <item>
      <title>The Tactics Evolve. The 10 Threats Are Constant.</title>
      <link>https://www.tlctc.net/tlctc-blog-cyber-hype.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-blog-cyber-hype.html</guid>
      <pubDate>Sun, 28 Sep 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[A critique of the 'constantly evolving' threat landscape narrative. TLCTC reveals the strategic stability of 10 core threats, enabling a shift from reactive firefighting to proactive, cause-oriented defense.]]></description>
    </item>
    <item>
      <title>Attack Path Notation: Domain Boundaries and Supply-Chain Transitions</title>
      <link>https://www.tlctc.net/blog-attack-path-supply-chain.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/blog-attack-path-supply-chain.html</guid>
      <pubDate>Sun, 14 Sep 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Threat Analysis</category>
      <description><![CDATA[Learn about TLCTC's sequential attack-path notation system for mapping domain boundaries and supply-chain transitions using #10 markers to denote trust domain crossings.]]></description>
    </item>
    <item>
      <title>Gemini 2.5 Pro: Chat about the biggest problem in cyber riskmanagement and cyber threats discussions.</title>
      <link>https://www.tlctc.net/blog-tlctc-ai-conversation-from-scratch.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/blog-tlctc-ai-conversation-from-scratch.html</guid>
      <pubDate>Wed, 03 Sep 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[An in-depth AI analysis of the TLCTC framework through conversation format. Exploring whether Bernhard Kreinz's novel cybersecurity approach truly solves the industry's biggest problem or reinvents existing solutions. Features detailed discussion on the Rosetta Stone metaphor and framework actionability.]]></description>
    </item>
    <item>
      <title>Comparing OCTAVE and TLCTC</title>
      <link>https://www.tlctc.net/blog-tlctc-octave.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/blog-tlctc-octave.html</guid>
      <pubDate>Sat, 28 Jun 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[While OCTAVE pioneered organizational-focused security evaluation, TLCTC advances the field with structured, cause-based threat classification that integrates seamlessly with modern security frameworks.]]></description>
    </item>
    <item>
      <title>The Missing Link: Bridging Strategy and Operations</title>
      <link>https://www.tlctc.net/tlctc-fillthegap.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-fillthegap.html</guid>
      <pubDate>Sun, 15 Jun 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Standards Integration</category>
      <description><![CDATA[How TLCTC bridges the critical gap between high-level risk management and hands-on operational security.]]></description>
    </item>
    <item>
      <title>Visualizing Threats with TLCTC Cyber Radars</title>
      <link>https://www.tlctc.net/blog-tlctc-radar-applications.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/blog-tlctc-radar-applications.html</guid>
      <pubDate>Sat, 14 Jun 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Tools &amp; Applications</category>
      <description><![CDATA[An innovative approach to communicate and prioritize diverse cyber threats for different stakeholders.]]></description>
    </item>
    <item>
      <title>The Big Picture: Connecting NIST, MITRE and more</title>
      <link>https://www.tlctc.net/tlctc-big-picture.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-big-picture.html</guid>
      <pubDate>Fri, 13 Jun 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[Understand TLCTC's role as a unifying layer for strategic frameworks like NIST and operational ones like MITRE.]]></description>
    </item>
    <item>
      <title>Integrating TLCTC with NIST CSF 2.0</title>
      <link>https://www.tlctc.net/nist-csf-tlctc.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/nist-csf-tlctc.html</guid>
      <pubDate>Thu, 12 Jun 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <description><![CDATA[A practical guide on mapping TLCTC to the NIST Cybersecurity Framework to enhance your security posture.]]></description>
    </item>
    <item>
      <title>AI Security: NIST AI RMF, MITRE ATLAS &amp; TLCTC</title>
      <link>https://www.tlctc.net/tlctc-nist-ai-rmf-mitre-cti.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-nist-ai-rmf-mitre-cti.html</guid>
      <pubDate>Wed, 11 Jun 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Threat Analysis</category>
      <description><![CDATA[A look at securing AI systems by integrating the NIST AI Risk Management Framework and MITRE ATLAS using TLCTC.]]></description>
    </item>
    <item>
      <title>MFA Bypass Attacks Through the TLCTC Lens</title>
      <link>https://www.tlctc.net/blog-MFAbypass.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/blog-MFAbypass.html</guid>
      <pubDate>Tue, 10 Jun 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Standards Integration</category>
      <description><![CDATA[Examining MFA bypass techniques and attack paths, and how to classify them using TLCTC.]]></description>
    </item>
    <item>
      <title>Distinguishing Between Coding and Programming in TLCTC</title>
      <link>https://www.tlctc.net/tlctc-sdlc-prog-coder.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-sdlc-prog-coder.html</guid>
      <pubDate>Sun, 08 Jun 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Standards Integration</category>
      <description><![CDATA[The Distinction: Programmer vs. Coder.]]></description>
    </item>
    <item>
      <title>ATT&amp;CK - Detection Meets Risk Management</title>
      <link>https://www.tlctc.net/tlctc-mitre-enterprise.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-mitre-enterprise.html</guid>
      <pubDate>Sat, 07 Jun 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Threat Analysis</category>
      <description><![CDATA[MITRE ATT&CK and TLCTC: Detection Meets Risk Management.]]></description>
    </item>
    <item>
      <title>Vulnerability Insights: SonarQube, CWE, and TLCTC</title>
      <link>https://www.tlctc.net/tlctc-sonar-cwe.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-sonar-cwe.html</guid>
      <pubDate>Fri, 06 Jun 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Tools &amp; Applications</category>
      <description><![CDATA[Mapping static analysis findings from SonarQube through CWE to the strategic view of TLCTC.]]></description>
    </item>
    <item>
      <title>Aligning with NIST SP 800-218 (SSDF) using TLCTC</title>
      <link>https://www.tlctc.net/tlctc-NIST.SP.800-218.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-NIST.SP.800-218.html</guid>
      <pubDate>Thu, 05 Jun 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <description><![CDATA[How to use TLCTC to structure and demonstrate compliance with the Secure Software Development Framework.]]></description>
    </item>
    <item>
      <title>Enhancing Threat Intel with STIX, ATT&amp;CK, and TLCTC</title>
      <link>https://www.tlctc.net/mitre-tlctc.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/mitre-tlctc.html</guid>
      <pubDate>Tue, 03 Jun 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Tools &amp; Applications</category>
      <description><![CDATA[A proposal for extending STIX and ATT&CK objects with a TLCTC extension for better strategic context.]]></description>
    </item>
    <item>
      <title>The Threat Modeling Manifesto &amp; TLCTC</title>
      <link>https://www.tlctc.net/tlctc-threat-modeling-manifesto.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-threat-modeling-manifesto.html</guid>
      <pubDate>Fri, 30 May 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[Analyzing the values and principles of the Threat Modeling Manifesto in the context of the TLCTC framework.]]></description>
    </item>
    <item>
      <title>Comparative Analysis: TLCTC vs. STRIDE</title>
      <link>https://www.tlctc.net/tlctc-stride.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-stride.html</guid>
      <pubDate>Wed, 28 May 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Standards Integration</category>
      <description><![CDATA[An analysis of the similarities, differences, and complementary nature of TLCTC and the STRIDE framework.]]></description>
    </item>
    <item>
      <title>Comparative Analysis: TLCTC vs. PASTA</title>
      <link>https://www.tlctc.net/tlctc-pasta.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-pasta.html</guid>
      <pubDate>Tue, 27 May 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Standards Integration</category>
      <description><![CDATA[Enhance the PASTA methodology by using TLCTC for a structured and comprehensive threat analysis stage.]]></description>
    </item>
    <item>
      <title>Comparative Analysis: TLCTC vs. FAIR</title>
      <link>https://www.tlctc.net/tlctc-fair.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-fair.html</guid>
      <pubDate>Mon, 26 May 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Framework &amp; Concepts</category>
      <description><![CDATA[Explore how TLCTC can provide the foundational cyber threat event categories for a FAIR quantitative risk analysis.]]></description>
    </item>
    <item>
      <title>Automotive Security: ISO/SAE 21434 &amp; TLCTC</title>
      <link>https://www.tlctc.net/tlctc-blog-IsoSae21434.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-blog-IsoSae21434.html</guid>
      <pubDate>Sun, 25 May 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Standards Integration</category>
      <category>Threat Analysis</category>
      <description><![CDATA[Applying TLCTC as a high-level threat categorization layer for the TARA method in the automotive security standard.]]></description>
    </item>
    <item>
      <title>Privacy Threat Modeling: LINDDUN &amp; TLCTC</title>
      <link>https://www.tlctc.net/tlctc-LINDDUN.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-LINDDUN.html</guid>
      <pubDate>Sat, 24 May 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Threat Analysis</category>
      <category>Regulations &amp; Compliance</category>
      <description><![CDATA[How the LINDDUN privacy threat modeling framework can be complemented by the cyber threat perspective of TLCTC.]]></description>
    </item>
    <item>
      <title>Meeting NIS2 Directive Requirements with TLCTC</title>
      <link>https://www.tlctc.net/tlctc-NIS2.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-NIS2.html</guid>
      <pubDate>Thu, 22 May 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Regulations &amp; Compliance</category>
      <description><![CDATA[How the TLCTC framework helps organizations structure their approach to NIS2 compliance and incident reporting.]]></description>
    </item>
    <item>
      <title>Cyber in the Name</title>
      <link>https://www.tlctc.net/tlctc-regulatorsANDstandards.html</link>
      <guid isPermaLink="true">https://www.tlctc.net/tlctc-regulatorsANDstandards.html</guid>
      <pubDate>Wed, 16 Apr 2025 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Bernhard Kreinz]]></dc:creator>
      <category>Framework &amp; Concepts</category>
      <category>Regulations &amp; Compliance</category>
      <description><![CDATA[TLCTC Framework vs. Existing Standards & Regulations - See it yourself]]></description>
    </item>
  </channel>
</rss>
