Figure 3. Package Use Case Model (AI System)
Figure 4. Components of the Architecture
applying a firewall rule, under condi - tions that could make them unsafe. Unsafe Control Action categories ask whether a needed action is not provided, provided when not needed, provided too early or too late, applied for too long, or terminated too soon. This helps expose inaction, unneces - sary disruption, timing vulnerabili - ties, and duration-related risk. Modeling software-intensive sys - tems as hierarchical control-feedback structures helps analysts identify la - tent design flaws, data-flow depen - dencies, and propagation paths that may alter system behavior before failure occurs. Applied in this way, STPA-Sec allows organizations to analyze algorithm-level hazards and software-intensive programs with rigor comparable to that used for tra - ditional cyber-physical systems. Simplified STPA-Sec Output for Automated AI System Losses L1—Disruption of mission-critical operations L2—Compromise of system integ - rity due to incorrect input Hazards H1—Decision based on outdated or incomplete system state H2—Incorrect responses due to missing or delayed inputs H3—Loss of synchronization be - tween interacting agents Hazardous Control Actions HCA1—AI agent uses stale data HCA2—AI agent acts before all in - puts are received HCA3—AI agent fails to re-evaluate decisions
Sensor & Data Ingestion Layer
Use Cases
AI Analysis & Triage Engine
Ingest Security Events
Sensor Agent / External Feed
Desision & Orchestration Engine
Analyze / Correlate Threats
Response Execution Interface
Assess Risk and Impact
Knowledge Base / Data Repository
AI Agent - Perform Alert Triage
Automated Isolation of
Log and Audit Action
Feedback & Learning Loop
Affected Systems
Source. Author
Generate Response Recommen- dations
Recommended Remediation Actions
to support traceability and audit - ability. • The feedback and learning loop captures response outcomes and feeds them back into models and rules to improve later decisions. Together, these elements form a closed-loop cyber response system that integrates sensing, reasoning, action, and learning. Unlike traditional vulnerabil - ity analysis focused on component flaws, STPA-Sec examines system- level interactions, control decisions, and feedback failures that can lead to hazardous or exploitable states. A typical STPA-Sec analysis examines control actions issued by human or automated controllers, such as iso - lating a host, revoking credentials, or
Security Operations Center Analyst
Learn from Outcomes
Source. Author
from logs, telemetry, end-point agents, and threat intelligence feeds. • The AI analysis and triage engine applies machine learning, rules, and correlation logic to classify alerts, prioritize threats, evaluate threats, and identify attack pat - terns. • The decision and orchestration engine (Zero Trust aligned) selects isolation, containment, escalation, or remediation actions consistent with policy and operational rules. • The response execution inter- face (firewalls, endpoints, cloud) connects with external security and infrastructure systems to ex - ecute approved actions. • The knowledge base/data re- pository stores incidents, con - figurations, playbooks, threat intelligence, and model outputs
Because AI systems rely on dynamic data pipelines, evolving models, and extensive third-party software, conventional assurance methods are insufficient for adaptive, data-driven behavior.
SEPTEMBER –OCTOBER 2026 | DEFENSE ACQUISITION MAGAZINE 39
Made with FlippingBook - Online Brochure Maker