Analysis of VERIS Using TLCTC v2.0 Principles

Executive Summary

This analysis evaluates the Vocabulary for Event Recording and Incident Sharing (VERIS) framework through the axiomatic definitions and classification logic of the Top Level Cyber Threat Clusters (TLCTC) framework, version 2.0.

Key Findings

Definitional Divergence: VERIS is designed for incident description — it captures what happened using its A4 model (Actor, Action, Asset, Attribute). TLCTC is designed for incident explanation — it categorizes why it happened by identifying the generic vulnerability exploited at each attack step. VERIS's "Action" conflates TTPs, mechanisms, and sometimes outcomes in a single descriptive layer. TLCTC enforces strict separation between causes (Threat Clusters), the central event (Loss of Control / System Compromise), and effects (Data Risk Events).

Logical Model Differences: VERIS follows a descriptive, flat schema. TLCTC is built on an axiomatic, causal Bow-Tie model with normative rules. From TLCTC's perspective, VERIS conflates cause-side and effect-side elements: it records actions (causes) alongside attributes (effects) at the same structural level without enforcing causal hierarchy.

Category Overlap vs. Non-Overlap: VERIS action varieties can overlap and mix levels of abstraction — a single incident record may list "Phishing," "Use of stolen creds," and "Ransomware" as co-equal actions. TLCTC requires mutual exclusivity at the strategic level: each attack step maps to exactly one cluster based on the generic vulnerability exploited (Axiom VI), and multi-step complexity is handled through ordered attack path sequences (Axiom IX).

Causal Clarity and Detection Windows: TLCTC's Bow-Tie explicitly distinguishes the Loss of Control event (system compromise) from subsequent Data Risk Events (Loss of Confidentiality, Integrity, Accessibility, or Availability). This structural separation reveals detection windows — the interval between compromise and data impact where intervention remains possible. VERIS captures C/I/A loss via its Attribute dimension but does not structurally enforce this temporal-causal separation.

Velocity and Temporal Analysis: TLCTC v2.0 introduces Attack Velocity (Δt) as a formal edge property between attack steps, with four Velocity Classes (VC-1 through VC-4) that determine which control types are structurally viable. VERIS captures timeline data but lacks a formal model connecting attack speed to defensive feasibility.

Domain Boundary Awareness: TLCTC v2.0 introduces Domain Boundary Operators that formally mark where an attack path crosses responsibility spheres (e.g., from vendor to organization, from physical to cyber domain). VERIS records assets and actors but does not formalize the concept of domain crossings or responsibility transitions in attack sequences.

Key Recommendations

1. Employ TLCTC as the strategic categorization layer for threat analysis, causal reasoning, and risk management, leveraging its definitional rigor, Bow-Tie structure, and axiomatic consistency.
2. Utilize VERIS for detailed operational data capture — actors, specific action varieties/vectors, assets, impact quantification, and timeline information.
3. Integrate the frameworks by mapping VERIS action varieties to their corresponding TLCTC clusters based on the generic vulnerability exploited, applying TLCTC's R-* classification rules for precision.
4. Structure incident analysis using the TLCTC Bow-Tie model and attack path notation to impose causal order on VERIS-recorded data, including velocity annotations and domain boundary markers.

VERIS Overview

The Vocabulary for Event Recording and Incident Sharing (VERIS) is a standardized schema designed to provide a common language for describing security incidents. Its core purpose is to enable consistent data collection, facilitate analysis, trending, and sharing of anonymized incident information. VERIS is the foundation of the annual Verizon Data Breach Investigations Report (DBIR).

VERIS structures incident descriptions around four primary dimensions, known as the "A4" model:

Additionally, VERIS includes fields for timeline, discovery methods, impact assessment (including financial loss estimation), and victim demographics.

Detailed Analysis

Definitional Clarity

Core Misalignment: The fundamental divergence lies in the organizing principle. VERIS organizes around observed incident characteristics (A4). TLCTC organizes around the generic vulnerability being exploited at each step (the "why"). VERIS's Action dimension often captures how an attack occurred (TTPs/mechanisms), whereas TLCTC's Cluster identifies what fundamental weakness allowed it.

Alignment: Both aim to structure security event information. VERIS's Attribute dimension (C/I/A) aligns conceptually with TLCTC's Data Risk Events on the consequence side of the Bow-Tie. VERIS's Actor separation aligns with TLCTC's Axiom IV (Threats Are Not Threat Actors), which excludes actor identity from threat categorization.

Logical Consistency

VERIS Consistency: VERIS is internally consistent within its descriptive A4 model. It provides a repeatable structure for cataloging who did what to what, and how it was affected.

TLCTC Axiomatic Foundation: TLCTC derives its consistency from ten non-negotiable axioms organized into four groups:

• Scope Axioms (I–II): No system-type differentiation; client–server as universal interaction model.
• Separation Axioms (III–V): Threats are causes, not outcomes; threats are not threat actors; control failure is not a threat.
• Classification Axioms (VI–VIII): One step = one generic vulnerability = one cluster; attack vectors defined by initial generic vulnerability; strategic vs. operational layering.
• Sequence Axioms (IX–X): Clusters chain into attack paths with velocity; credentials have dual operational nature (acquisition vs. application).

Evaluation from TLCTC Perspective: VERIS is pragmatic and descriptive; it is not axiomatically derived. From the TLCTC viewpoint, VERIS commits several structural conflations:

Causes and Effects at the Same Level: VERIS records Action (cause-side: what the attacker did) alongside Attribute (effect-side: what happened to C/I/A) as co-equal dimensions of the same incident record. The TLCTC Bow-Tie normatively requires that these remain structurally distinct — threats on the left (cause) side, consequences on the right (effect) side, with Loss of Control as the central pivot.

Threats and Mechanisms Not Separated by Generic Vulnerability: VERIS action varieties describe TTPs and mechanisms without isolating the type of vulnerability targeted as the primary classification axis. TLCTC's Axiom VI mandates that every attack step maps to exactly one cluster based on the generic vulnerability exploited.

No Causal Hierarchy Enforcement: VERIS records multiple actions for a single incident without enforcing which action exploited which vulnerability in which order. TLCTC's attack path notation with the sequence operator (→) enforces explicit causal ordering.

Non-Overlapping Categories

VERIS Categories:

• The top-level A4 dimensions (Actor, Action, Asset, Attribute) are definitionally distinct from each other.
• Within Action, the primary types (Malware, Hacking, Social, Misuse, Physical, Error, Environmental) aim for distinction, but a single incident frequently involves multiple types, which VERIS records as co-occurring.
• The action.variety enumerations can overlap depending on interpretation — for instance, "exploitation of vulnerability" could mean different things depending on context.
• VERIS mixes levels of abstraction: high-level action types, specific action.variety TTPs, and implicit outcome-flavored categories coexist in the same descriptive space.

TLCTC Approach:

• TLCTC enforces mutual exclusivity at the strategic level through Axiom VI: each attack step maps to exactly one cluster based on exactly one generic vulnerability.
• Multi-step complexity and apparent overlap are handled through attack path sequences (Axiom IX). What looks like "overlap" is actually distinct steps in a causal chain: #9 → #4 → #1 → #7, where each step exploits a different generic vulnerability.
• Ambiguity is resolved through tie-breaker rules and the R-* global mapping rules (R-ROLE, R-CRED, R-EXEC, R-FLOOD, R-ABUSE, R-HUMAN, R-PHYSICAL, R-MITM, R-SUPPLY), which provide normative decision logic for classification edge cases.
• TLCTC maintains a clear separation between the Strategic Management Layer (clusters #1–#10, stable) and the Operational Security Layer (TLCTC-XX.YY sub-threats, concrete CVEs and TTPs — evolving), per Axiom VIII.
• Topology classification further structures the clusters: seven internal clusters (#1–#7, operating within the software domain's technical attack surfaces) and three bridge clusters (#8, #9, #10 — enabling crossing into or leveraging over a different domain's control regime).

Evaluation: VERIS action varieties exhibit overlap and mixed abstraction. TLCTC's focus on unique generic vulnerabilities per cluster, combined with R-* rules, tie-breakers, and the sequence operator, enforces non-overlap at the strategic level while providing clear, auditable classification logic.

System Compromise vs. Data Risk Events

VERIS Handling:

• System Compromise: Captured implicitly through the combination of Action (e.g., Malware, Hacking) affecting an Asset (e.g., Server, Endpoint). There is no single field or structural concept explicitly labeling "System Compromise" or "Loss of Control."
• Data Risk Events: Captured via the Attribute dimension (Confidentiality, Integrity, Availability) and detailed sub-fields. The Impact section quantifies the result.

TLCTC Bow-Tie Model:

• Left (Cause) Side: Threat Cluster exploitation — the attack steps, each exploiting a specific generic vulnerability.
• Central Event (Knot): Loss of Control / System Compromise — the decisive moment where the attacker achieves unauthorized control.
• Right (Effect) Side: Consequences — Data Risk Events (Loss of Confidentiality, Loss of Integrity, Loss of Accessibility, Loss of Availability) and subsequent business risk events.

Crucially, TLCTC recognizes that the Loss of Control event can precede the Data Risk Event in time, creating a detection window — the operational interval between system compromise and data impact where intervention (DETECT, RESPOND) is still possible.

TLCTC v2.0 — Four Data Risk Events (not three):

A critical distinction VERIS does not make is between Accessibility and Availability:

VERIS uses a traditional C/I/A triad that conflates Accessibility and Availability. TLCTC separates them because the distinction has direct operational consequence: ransomware causes Loss of Accessibility (data present but unusable), not Loss of Availability (system down). This distinction matters for control selection — backups address LoAc; failover and capacity address LoAv.

Assessment: VERIS effectively records that data compromise occurred and what actions were involved. TLCTC provides the structural apparatus to distinguish when system compromise occurred relative to data impact, enabling detection window analysis and velocity-appropriate control selection.

Attack Velocity and Temporal Analysis

VERIS Timeline: VERIS includes timeline fields capturing when actions occurred, when the incident was discovered, when containment began, etc. This provides useful operational chronology but is purely descriptive — it does not connect temporal data to defensive feasibility.

TLCTC v2.0 Attack Velocity: TLCTC v2.0 formalizes the temporal dimension through Attack Velocity (Δt) — the time interval between adjacent attack steps in a path. Δt is an edge property attached to the sequence operator:

#9 →[Δt=24h] #4 →[Δt=5m] #1 →[Δt=0s] #7

This notation reads: phishing succeeded, then 24 hours later stolen credentials were used (#4), 5 minutes later legitimate functions were abused (#1), and immediately (0 seconds) malware executed (#7).

Velocity Classes categorize these intervals into defender-feasible response modes:

Synergy: VERIS timeline data can be enriched by mapping it to TLCTC velocity annotations. An organization recording VERIS incidents could derive Δt values between mapped TLCTC steps and aggregate them into velocity profiles per attack pattern, informing control investment decisions.

Domain Boundaries and Responsibility Spheres

VERIS Handling: VERIS records Actors (external, internal, partner) and Assets, which implicitly captures some domain information. However, it does not formalize the concept of domain transitions within an attack sequence.

TLCTC v2.0 Domain Boundary Operators: TLCTC v2.0 introduces formal notation for marking where an attack path crosses responsibility spheres — organizational boundaries where different control regimes, policies, and teams apply:

#9 ||[phishing][@External→@Org]|| → #4 →[Δt=2h] #1 ||[cloud-admin][@Org→@CloudProvider]|| → #7

This notation explicitly marks: social engineering crossed from the external domain into the organization's domain; later, function abuse crossed from the organization into the cloud provider's control regime.

Bridge clusters (#8 Physical Attack, #9 Social Engineering, #10 Supply Chain Attack) have a special structural property: their generic vulnerability inherently enables crossing into a different domain's control regime. This is a topological insight — these three clusters are the "doors" between domains.

Assessment: VERIS captures who (actor type) and what (asset type) but not the structural transitions between domains of control. TLCTC's domain boundary operators enable precise mapping of where responsibility changes hands in an attack sequence, which is critical for incident coordination, legal attribution, and multi-party response.

Potential Synergies

Strategic Risk Management Integration

VERIS Integration Challenge: VERIS data reveals operational trends — common actions, actors, assets, and impacts. This informs risk management by highlighting control weaknesses and quantifying losses. However, aggregating this detailed, event-focused data into strategic risk categories aligned with fundamental threat types (rather than specific actions or outcomes) requires significant interpretation. VERIS lacks a built-in, repeatable mechanism for this strategic translation.

TLCTC Strategic Design: TLCTC is explicitly designed to bridge strategic and operational levels through its two-layer architecture (Axiom VIII):

• Strategic Management Layer (clusters #1–#10): Stable, high-level taxonomy suitable for defining risk appetite per threat type, aligning resource allocation based on exposure to fundamental vulnerabilities, and communicating risk posture to leadership.
• Operational Security Layer (TLCTC-XX.YY sub-threats): Concrete techniques, CVEs, and procedures used in detection, response, and engineering.

This enables organizations to:

• Define strategic risk appetite per Threat Cluster
• Align resource allocation based on exposure to generic vulnerabilities
• Communicate cyber risk posture to leadership using 10 manageable categories
• Map controls to their Bow-Tie position (preventive vs. detective/corrective)
• Use NIST CSF functions as a control overlay mapped to cluster positions

Case Study

Scenario: Phishing Email Leads to Credential Theft and Ransomware Deployment

A targeted phishing email tricks an employee into entering credentials on a convincing fake login page. The attacker uses those credentials to log into the organization's VPN, then accesses a file server using legitimate administrative functions, and finally deploys ransomware that encrypts critical business files.

VERIS Analysis

TLCTC v2.0 Analysis

Attack Path Notation:

#9 →[Δt=24h] #4 →[Δt=10m] #1 →[Δt=0s] #7

Step-by-step decomposition using R-* rules:

Central Event: Loss of Control — account compromised (#4), then server compromised (#1/#7).

Data Risk Events (Consequence Side):

• LoC (Loss of Confidentiality): Credentials disclosed during phishing (consequence of #9 step).
• LoI (Loss of Integrity): Unauthorized software installed on server (consequence of #7 step).
• LoAc (Loss of Accessibility): Files encrypted by ransomware — server operational but data unusable. Note: this is not Loss of Availability (LoAv). The server is still up; the data is inaccessible due to encryption.

Domain Boundary Notation (full path with boundaries):

#9 ||[phishing][@Attacker→@Org]|| →[Δt=24h] #4 →[Δt=10m] #1 →[Δt=0s] #7 + [DRE: C, I, Ac]

Velocity Analysis:

• #9 → #4: Δt=24h (VC-1/Strategic) — Threat hunting or anomaly detection on credentials could intervene. Detection of credential use from unusual location is viable.
• #4 → #1: Δt=10m (VC-3/Operational) — Automated detection (EDR/SIEM) and containment playbooks are the viable response mode.
• #1 → #7: Δt=0s (VC-4/Real-Time) — Only architectural controls (application whitelisting, code signing, execution restrictions) can prevent this transition. Human analyst response is structurally impossible at this speed.

Comparative Insight

Mapping VERIS Action Categories to TLCTC Clusters

A systematic mapping between VERIS's action categories and TLCTC's Threat Clusters provides the operational-to-strategic bridge essential for integration. This mapping applies TLCTC's R-* classification rules for precision.

Critical Mapping Considerations

Context Sensitivity and R-* Rules: Some VERIS action varieties require contextual analysis and application of specific R-* rules to determine the correct TLCTC cluster. "Exploitation of vulnerability" is a common example — it maps to #2 or #3 depending on role determination (R-ROLE), and may chain to #7 if foreign executable content is executed (R-EXEC).

Credential Dual Nature (Axiom X, R-CRED): This is the most common source of misclassification. VERIS records "Use of stolen creds" as a single hacking action. TLCTC requires separating:

• Credential acquisition (how were they obtained?) → Maps to the enabling cluster (#9 for phishing, #2 for server-side disclosure, #7 for keylogger, #5 for MitM interception, #8 for physical theft)
• Credential application (how were they used?) → MUST always map to #4 Identity Theft

When both occur, they MUST be represented as at least two steps: (enabling cluster) → #4.

Attack Sequencing: VERIS may record multiple actions for a single incident. TLCTC requires determining which action is the initial vector, which are follow-on steps, and what the causal order is. The TLCTC attack path sequence (Axiom IX) imposes this structure.

Outcome Labels Are Not Clusters: VERIS action varieties like "Ransomware" describe a tool/outcome hybrid. In TLCTC, "ransomware" is not a valid threat category — it's a description of an outcome (LoAc) and possibly a tool (#7). The actual threat path might be #9 → #4 → (#1 + #7) with LoAc as the consequence.

Bridge vs. Internal Topology: VERIS actions like Social, Physical, and supply-chain-related incidents map to TLCTC's bridge clusters (#8, #9, #10), which have a special structural property: they enable domain crossings. This topology information can enrich VERIS analysis by highlighting where responsibility spheres change.

Integration Recommendations

1. Adopt TLCTC for Strategic Categorization: Use the 10 TLCTC clusters as the authoritative high-level framework for categorizing threats based on the root generic vulnerability exploited. This layer is essential for strategic risk management, board communication, and comparable incident documentation.
2. Map VERIS Detail to TLCTC Operational Layer: Treat VERIS action.variety and action.vector data as Tactics, Techniques, and Procedures that fall within the TLCTC Operational Security Layer (Axiom VIII). Apply R-* rules for precise classification. Maintain a mapping dictionary as outlined in the mapping section above.
3. Utilize VERIS for Data Capture: Leverage the comprehensive VERIS schema for detailed, consistent recording of incident specifics (Actors, Actions, Assets, Attributes, Timeline, Discovery, Impact).
4. Structure Analysis with TLCTC Bow-Tie: When analyzing incidents recorded via VERIS, apply the TLCTC Bow-Tie:
   • Identify the initiating TLCTC cluster(s) and build the full attack path sequence.
   • Pinpoint the Loss of Control / System Compromise event (the Bow-Tie central event).
   • Map VERIS Attribute and Impact data to the consequence side as Data Risk Events (LoC, LoI, LoAc, LoAv).
   • Derive velocity annotations (Δt) from VERIS timeline data and assign Velocity Classes.
   • Identify domain boundary crossings using TLCTC's bridge cluster topology.
5. Dual-Layer Reporting:
   • Operational reports: Use granular VERIS data for SOC-level trending, detection engineering, and incident response.
   • Strategic reports: Aggregate VERIS incident frequency and impact by mapped TLCTC cluster. Include velocity profiles and domain boundary analysis for leadership dashboards.
6. Enrich VERIS Records with TLCTC Fields: Enhance VERIS implementations by adding custom fields:
   • plus.tlctc_primary_cluster — The initiating TLCTC cluster.
   • plus.tlctc_attack_path — Full attack path sequence (e.g., "#9 → #4 → #1 → #7").
   • plus.tlctc_velocity_class — Dominant velocity class of the attack.
   • plus.tlctc_domain_crossings — Domain boundaries crossed during the incident.
   • plus.tlctc_data_risk_events — Specific DREs: LoC, LoI, LoAc, LoAv.
7. Maintain a Living Mapping Reference: Develop and maintain an organization-specific reference mapping VERIS action varieties to TLCTC clusters, updated regularly as new techniques emerge and R-* rules are applied to new edge cases.

Conclusion

VERIS and TLCTC offer distinct but highly complementary capabilities. VERIS provides an invaluable, battle-tested schema for describing the observable characteristics of security incidents — it excels at answering what happened. TLCTC, grounded in ten non-negotiable axioms and organized around generic vulnerabilities, delivers a logically consistent, non-overlapping framework for understanding why it happened — identifying the fundamental weaknesses that made each attack step possible.

The integration of these frameworks creates capabilities neither possesses alone:

VERIS without TLCTC produces detailed incident inventories that require significant interpretation to yield strategic insight. Trends in "phishing" and "ransomware" actions describe symptoms without exposing the underlying vulnerability chain.

TLCTC without VERIS provides powerful causal logic and strategic categorization but lacks a mature, widely-adopted operational data capture schema.

Together, VERIS supplies the operational evidence while TLCTC provides the causal grammar. VERIS timeline data feeds TLCTC velocity analysis. VERIS actor and asset information enriches TLCTC domain boundary mapping. TLCTC's Bow-Tie structures VERIS data into cause → event → consequence chains. TLCTC's R-* rules resolve the classification ambiguities inherent in VERIS's descriptive approach.

The result is an analytical capability that transforms incident recording from description into explanation — connecting granular operational data to strategic risk management through a shared, cause-oriented taxonomy that remains stable as specific threats evolve.