Every Surface. Every Profile. Every Claim.

Abstract

The attack surface has exploded. Every device, every protocol, every management plane an organisation operates is observable, fingerprinted, and exploitable if it stays static long enough. The reconnaissance cycle — Observe, Map, Model, Stage, Exploit — applies identically whether the target is a web server, a Nutanix Prism Central management plane, a Siemens S7 PLC, a 5G Access and Mobility Management Function, or a national power grid SCADA controller. The vulnerability is universal: the surface is static, and static surfaces can be mapped.

This paper maps the ACSE protection model across six waves of coverage — from production IT infrastructure available today, through HCI and storage fabrics, cloud-native and container orchestration, OT/ICS/SCADA, telecom and 5G core, to national critical infrastructure. For every surface in every wave it identifies the appropriate mutation profile, the specific patent claim enforced, and the exact attacker capability defeated.

1. The Universal Surface Problem

Every cyberattack begins with reconnaissance. The attacker observes the target, builds a model of its surface, and stages an exploit against what they found. This cycle succeeds because the surface observed today is the surface that will still exist when the exploit fires — hours, days, or months later. This assumption holds in every environment without exception.

A Nutanix Prism Central API token is static by default. A Siemens S7 management password might not change in years. A 5G AMF service endpoint is registered in the NRF with a stable fingerprint by design. A national power grid SCADA controller has been running the same management credentials since deployment. Nobody designed these systems to rotate their observable identity continuously. That gap is universal, and it is the gap ACSE was built to close.

2. The Six-Wave Framework

ACSE's coverage expands in six waves. The waves are not product lines — they are a single engine (the Polymorphic Mutation Engine) applied to progressively broader surface categories as connectors are added. The Kali Invariant at the centre is identical in every wave.

3. Wave 1 — IT Infrastructure (Production-Ready)

Wave 1 is live in ACSE v0.2.0. The eleven domain profiles cover the full spectrum of enterprise IT surfaces, each tuned to its specific threat model and enforcing the Kali Invariant at sub-millisecond speeds.

4. Wave 2 — HCI & Storage Fabrics

HCI management planes and storage fabric controllers carry catastrophic blast radii. A single set of Nutanix Prism Central credentials gives an attacker access to every VM in the cluster. A compromised Pure Storage FlashArray management token gives access to every volume. A Brocade FC fabric login gives access to every SAN zone. These surfaces have historically been completely static — no vendor has addressed this until now.

The Change Healthcare breach exposed 192.7 million patient records partly because storage-level credentials remained valid long enough for a 6TB exfiltration pipeline to be established. The Stryker-Handala wiper destroyed 200,000+ devices across 79 countries after gaining access to management consoles. ACSE would have expired both management surfaces before either attack could execute.

5. Wave 3 — Cloud-Native & Container Orchestration

Container orchestration surfaces are uniquely dangerous because they are designed for automation at scale — which means a compromised Kubernetes API server can redeploy every workload, exfiltrate every secret, and establish persistent backdoors across every namespace in a single API call. Cloud provider management planes (AWS IAM, Azure Entra, GCP IAM) carry the same risk at hyperscaler scale. The SolarWinds attack demonstrated that management plane access at this level produces dwell times measured in months — because the surface never changes.

6. Wave 4 — OT / ICS / SCADA

Operational Technology is the most underprotected surface category on earth. The air-gap assumption was demolished by Stuxnet in 2010. The Ukraine power grid attacks in 2015 and 2016 demonstrated that OT surfaces are actively targeted by nation-state actors. What makes OT uniquely dangerous for ACSE purposes: OT management credentials are often the most static surfaces in any organisation. A Siemens S7 management password might not change in years. A SCADA HMI session token might persist indefinitely.

7. Wave 5 — Telecom & 5G

5G core network functions communicate over HTTP/2 Service-Based Interfaces (SBI). Every network function — AMF, SMF, UPF, NRF — exposes a REST API with a stable, fingerprinted identity registered in the Network Repository Function. The 5G SBI was designed for interoperability, which means it was designed to be observable. An attacker who maps the 5G core surface can interfere with access management, session handling, and user plane functions for millions of subscribers.

Legacy telecom surfaces (SS7, Diameter) are even more static. SS7 vulnerabilities have been publicly known since 2014 and remain exploitable today. The surface that enables location tracking, call interception, and SMS hijacking has never been rotated — by design or by practice. ACSE changes that.

8. Wave 6 — National Critical Infrastructure

National critical infrastructure represents the highest-value, highest-consequence attack surface category on earth. A successful attack on a national power grid can cause loss of life and economic damage measured in billions. A compromised national PKI invalidates the cryptographic trust chain for an entire country. These surfaces have historically received the least cybersecurity investment because they are the most difficult to reach — but nation-state adversaries have demonstrated repeatedly that reach is not the obstacle it once was.

ACSE is uniquely qualified for national critical infrastructure for three reasons: the Kali Invariant is mathematical and cannot be misconfigured out of effectiveness; the Control Plane runs fully air-gapped with no internet dependency; and TEE attestation provides hardware-rooted trust that no software vulnerability can subvert.

9. Linux & Agentless Environments

Many environments — cloud-native shops, startups, mixed estates, and OT floors — operate without Active Directory. Linux servers, containerised workloads, and cloud VMs have no domain controller. The ACSE discovery layer addresses this directly with multiple discovery methods, each producing the same result: the asset enters the catalog, receives a profile suggestion, awaits admin approval, and comes under the Kali Invariant.

10. Universal Profile Selection Guide

10.1 Decision Framework

10.2 Master Surface-to-Profile Table

11. Patent Coverage Across All Surfaces

Patent Application IN202641070690 covers a single mathematical property — the Kali Invariant — and four specific claims derived from it. None of these claims are surface-specific. They apply to any observable surface S at any time t, in any wave, on any protocol.

Claim A — Surface Fingerprint Independence: For every protected surface S and every access event at time t, the observable fingerprint F(S, t+1) is cryptographically independent of F(S, t). The Hamming distance between successive fingerprints averages 128 bits. This claim covers every surface in every wave without amendment.

Claim B — Transport Channel Fingerprint Defeat: The observable transport channel fingerprint (JA3/JA3S, p0f, cipher suite order) changes on every session such that passive fingerprinting cannot link successive sessions. Applies to TorpedoRay surfaces in any wave — from iSCSI in Wave 2 to GTP-U in Wave 5 to any TCP/TLS surface in any wave.

Claim C — Session Token Independence: Session tokens, credentials, and access identifiers are rotated such that a valid token at time t is invalid at t+1. Applies across all profiles — AD credentials (Wave 1), HCI management tokens (Wave 2), cloud IAM keys (Wave 3), SCADA operator sessions (Wave 4), 5G SMF session identifiers (Wave 5), and government access tokens (Wave 6).

Claim D — Torpedo Mechanism: When the EWMA anomaly score reaches 0.70, a disruptive full-surface rotation executes without terminating the legitimate session. Applies to any surface running TorpedoRay or KaliCoreTarget — from a payment API to a 5G UPF to a national power grid SCADA controller.

12. Conclusion

The surface explosion is accelerating. Every new cloud-native deployment adds Kubernetes API surfaces. Every HCI deployment adds management planes with catastrophic blast radii. Every OT modernisation adds SCADA surfaces that have been static for decades. Every 5G rollout adds SBI surfaces that are observable by design. Every critical infrastructure programme adds national-consequence surfaces that have historically received the least cybersecurity investment.

ACSE is the only architecture designed from first principles to address this at every layer. The Kali Invariant does not care what the surface is. F(S, t+1) is cryptographically independent of F(S, t) whether S is a payment API, a Nutanix cluster, a Siemens PLC, a 5G AMF, or a national power grid SCADA controller.

Six waves. One invariant. One patent. Every surface protected.