Decision libraryCross-sector technical reference
Browse by the decision, not only by the sector.
The same assurance problem often appears in OT, automotive, railway, product and AI systems under different names. These collections group the analyses by the decision that remains after the incident facts are established.
Generated from the published Analysis library; no separate editorial index to maintain.
7 analyses
Recovery & Assurance
When containment or restoration is not enough: what evidence makes restart, release or continued operation defensible?
OT & ICS · PLC Security · Operational Resilience · 23 Sep 2026Rockwell Logix Shows Why PLC Vulnerability Management Must Include Recovery
→Hardware Security · Verification · Release Assurance · 18 Sep 2026Chip Security Sign-Off Needs Evidence, Not Another Checkbox
→Automotive · Vehicle Security · IDS · 31 Aug 2026AutoHack Shows Why IDS Validation Must Follow the Real Attack Path
→Product Security · Supply Chain · 9 Aug 2026The CRA Reporting Clock Is Really a Decision-Readiness Test
→Product Security · 7 Aug 2026Why Patching Windchill Is Not Enough
→OT & ICS · 1 Aug 2026The Restart Bottleneck Is Not the Backup. It Is the Evidence.
→5 analyses
Supplier Trust
How identities, evidence, engineering data and lifecycle obligations cross organisational boundaries.
Manufacturing · Supply Chain Security · Product Assurance · 25 Sep 2026NIST IR 8536 Shows Why Supply-Chain Traceability Must Become Verifiable Assurance
→Hardware Security · ASIC · Supply Chain Assurance · 14 Sep 2026NSA ASIC Guidance Shows Why Hardware Assurance Starts Before the Chip Exists
→OT & ICS · Industrial Network Security · Supply Chain · 24 Aug 2026RUGGEDCOM Shows Why Industrial Firewalls Need Lifecycle Transparency
→Railway · Supply Chain · 2 Aug 2026Stadler Rail: When Supplier Trust Becomes the Attack Surface
→Automotive · Supply Chain · 30 Jul 2026The Next Production Delay May Be Missing Cybersecurity Evidence
→6 analyses
Identity & Remote Access
Where persistent authority, weak attribution or over-privileged interfaces become the real attack path.
OT & ICS · Industrial Networking · Remote Access · 9 Sep 2026Weidmüller Shows Why a Security Router Is a Privileged OT Asset
→Physical Security · Video Management · Privileged Access · 4 Sep 2026Siveillance Shows Why Least Privilege Must Cross the Application Boundary
→OT & ICS · 9 Aug 2026Zero Trust in OT Should Mediate Authority, Not Modernise Every PLC
→OT & ICS · Critical Infrastructure · 9 Aug 2026Oldsmar Is a Warning About Standing Remote Authority
→Automotive · Product Security · 9 Aug 2026The Connected Vehicle Perimeter Includes Dealer APIs
→OT & ICS · 28 Jul 2026The Remote Access Path Nobody Questions Anymore
→8 analyses
Safety & Operational Resilience
Security decisions that must preserve safe degraded operation, physical continuity and engineering authority.
OT & ICS · Manufacturing · Robotics · 19 Aug 2026Trusted Robot Code Does Not Prove Trusted Motion
→Automotive · Product Security · Safety · 17 Aug 2026The Bendix EC80 Recall Shows Why Safety Fixes Need a Cybersecurity Handoff
→OT & ICS · Water Security · Critical Infrastructure · 10 Aug 2026An OT Alert Is Not Protection Until It Becomes a Safe Physical Action
→OT & ICS · Critical Infrastructure · 9 Aug 2026Safety Independence Must Survive a Cyber Compromise
→Railway · OT & ICS · 9 Aug 2026Legacy Rail Assets Do Not Become Secure Because the Policy Improved
→OT & ICS · 9 Aug 2026Industrial 5G Makes Radio Availability Part of the Safety and Production Model
→8 analyses
Software Integrity
Build, signing, provenance, vulnerability state and the evidence needed to trust software across its lifecycle.
OT & ICS · PLC Security · Vulnerability Lifecycle · 21 Sep 2026SIMATIC S7-1500 MFP Shows Why an Embedded Linux Subsystem Needs Its Own Assurance Case
→Product Security · Cryptography · Lifecycle · 16 Sep 2026Airwall Shows Why a Hardcoded Key Becomes a Lifecycle Problem
→Automotive · Product Security · Software Supply Chain · 28 Aug 2026A Trusted Automotive Update Path Can Become the Malware Delivery Path
→Automotive · Product Security · Supply Chain · 12 Aug 2026A Valid Signature Does Not Make Vulnerable Firmware Safe
→Product Security · Supply Chain · Automotive · 9 Aug 2026A VEX Statement Is a Claim That Needs Evidence
→Automotive · Product Security · Supply Chain · OT & ICS · 9 Aug 2026How a Software-Defined Vehicle Could Inherit Compromise Before Delivery
→3 analyses
AI Authority
The security boundary created when AI can interpret untrusted content, inherit trust or exercise tools and permissions.
Railway · AI Security · OT & ICS · 14 Aug 2026Railway AI Needs Independent Evidence Before It Gets Exceptional Authority
→AI Security · Product Security · 9 Aug 2026Prompt Injection Is an Authority-Boundary Failure
→AI Security · Product Security · 9 Aug 2026AI Agents Turn Excessive Permission into Operational Risk
→9 analyses
Trust Boundaries
Cases where an apparently isolated system inherits reach, authority or risk from dependencies around it.
Automotive · Platform Security · Privilege Boundaries · 23 Sep 2026Qualcomm CVE-2026-24083 Shows Why Local Does Not Mean Low Impact in Automotive Compute
→Automotive · Aftermarket · Trust Boundaries · 11 Sep 2026KARR/SWDS Shows Why Aftermarket Vehicle Authority Must Be Constrained
→Railway · Diagnostics · Trust Boundaries · 7 Sep 2026Frauscher FDS102 Shows Why Railway Diagnostics Belong Inside the Security Boundary
→OT & ICS · PLC Security · Network Segmentation · 2 Sep 2026PLCnext Shows Why Critical CVEs Need Reachability Evidence
→OT & ICS · PLC Security · Critical Infrastructure · 26 Aug 2026AI Is Not the Main Security Problem in the Siemens S7 Campaign
→Railway · Data Trust · OT & ICS · 21 Aug 2026Authenticated Railway Data Can Still Be Operationally Wrong
→