Archive

Report

The United States’ Nuclear Command, Control, and Communications (NC3) Operations

The United States’ Nuclear Command, Control, and Communications (NC3) Operations

IST's Brandon Cortino and Catherine Murphy co-authored a primer that serves to create a stronger understanding of the systems comprising the U.S. NC3 network, summarize modernization plans, and explore the challenges that emerge in an increasingly uncertain threat environment.

command, communications, control, Department of Defense, deterrence, EDTs, modernization, NC3, nuclear, stability

May 7, 2026

AI Agents & Agency in the Internet Ecosystem

Report, White Paper

AI Agents & Agency in the Internet Ecosystem

AI agents are rapidly reshaping how the internet functions. Software systems operate, interact, and execute tasks autonomously – marking a structural shift in our digital ecosystem. A new report presents three core insights into the AI agent landscape, supporting activities by policymakers, industry leaders, and standards bodies to enhance trust and stability.

agency, agentic, agents, AI, artificial intelligence, attribution, authorization, identity, intellectual property, stability, trust

April 30, 2026

Counter Ransomware Initiative Tabletop Exercise: After-Action Report

Counter Ransomware Initiative Tabletop Exercise: After-Action Report

IST, in partnership with the Australian Department of Home Affairs and the Counter Ransomware Initiative’s Private Sector Advisory Panel—led by Public Safety Canada and BlackBerry—held a multinational ransomware tabletop exercise on the margins of Singapore International Cyber Week and the Fifth CRI Summit. A new after action report summarizes the discussion and presents 3 key takeaways.

coordination, counter ransomware initiative, cyber, cybersecurity, disruption, information sharing, operational collaboration, Ransomware, Singapore, tabletop exercise

March 31, 2026

Comparative Analysis of National and Regional Product Cybersecurity Frameworks

Comparative Analysis of National and Regional Product Cybersecurity Frameworks

Author Taylor Roberts presents a structured, data-driven analysis of product cybersecurity frameworks across multiple jurisdictions for policymakers.

Australia, comparative analysis, cyber, Cyber Resilience Act, EU, FAR, product cybersecurity, South Korea

March 19, 2026

AI Loss of Control Risk: Indications & Warning

AI Loss of Control Risk: Indications & Warning

Though technologists and policymakers alike are eager to address AI Loss of Control–a state in which an AI system diverges from authorized constraints–there are significant gaps in the ways stakeholders understand, anticipate, and perceive this risk. "AI Loss of Control Risk" proposes applying the Indications & Warning (I&W) methodology used by the intelligence community to monitor this risk.

AI, AI Loss of Control, artificial intelligence, deception, model drift, risk reduction, scheming

February 19, 2026

Fighting Cyber-Enabled Fraud: A Systemic Defense Approach

Fighting Cyber-Enabled Fraud: A Systemic Defense Approach

Phishing and cyber-enabled fraud are escalating global threats affecting users, consumers, organizations and countries alike. A new white paper, developed by the World Economic Forum’s Partnership against Cybercrime in collaboration with IST, presents a systemic defense framework to confront this challenge.

cybersecurity, DNS, fraud, ICANN, phishing, systemic defense, WEF

December 2, 2025

The Missing Middle: How to Close America’s Deep-Tech Financing Gap in Strategic Competition with China

The Missing Middle: How to Close America’s Deep-Tech Financing Gap in Strategic Competition with China

The United States and China are locked in competition to finance & deploy foundational technologies that will underwrite economic leadership and ensure national security for decades to come. Building on the prior work of IST’s Strategic Balancing Initiative, "The Missing Middle" digs into the systematic gap between early-stage capital and late-stage financing facing American deep-tech companies and the strengths and weaknesses of China's bifurcated system.

capital, China, deep tech, finance, hardware, national security, quantum, venture capital

October 31, 2025

AI, NC3, and Strategic Stability: Scenario Exercise

AI, NC3, and Strategic Stability: Scenario Exercise

How might the integration of AI into global NC3 systems transform strategic stability and deterrence dynamics? In Washington, D.C. this spring, IST convened more than 60 senior officials, technical experts, and civil society actors for an in-depth analysis of the risks and opportunities of AI in NC3 using this scenario exercise.

adaptive targeting, AI, decision support, nuclear, nuclear command, scenario, strategic warning, TTX

October 16, 2025

CVE at a Crossroads: A Blueprint for the Next 25 Years

CVE at a Crossroads: A Blueprint for the Next 25 Years

The Common Vulnerabilities and Exposures (CVE) Program is a critical public good, yet it is at a crossroads. Established by MITRE with support from the U.S. government, the index of software vulnerability identifiers has been a core element of software security since 1999. But recent funding issues have laid bare fundamental challenges, and without action, the vulnerability identification landscape will fragment. This report provides recommendations for global policymakers on how to reimagine the CVE Program for the next 25 years.

Common Vulnerabilities and Exposures, CVE, Global Vulnerability Catalog, National Vulnerability Management Program, software, vulnerability identification, vulnerability management

October 8, 2025

Artificial Intelligence in Nuclear Command, Control & Communications: A Technical Primer

Artificial Intelligence in Nuclear Command, Control & Communications: A Technical Primer

AI has been integral to nuclear weapons systems and operations for decades, but rapidly advancing “novel” models pose unforeseen technical opportunities. For the Institute for Security and Technology’s scenario-driven workshop on the integration of AI into NC3 systems, IST’s Sylvia Mishra and Philip Reiner co-authored a short primer to establish what constitutes 'novel' AI in the context of nuclear weapons decision-making.

AI, artificial intelligence, NC3, nuclear, system of systems

September 10, 2025

Improving Private Sector Cyber Victim Notification and Support

Improving Private Sector Cyber Victim Notification and Support

Building off the Cyber Safety Review Board’s recommendation that cloud service providers work with mobile device platform vendors to develop an “amber alert”-style notification mechanism, IST Adjunct Advisor Rob Knake explores the challenges to developing the native-notification concept and lays out a roadmap for overcoming them.

cyber, incident response, Victim Notification

August 14, 2025

Exercise VEIL STORM I: After Action Report

Exercise VEIL STORM I: After Action Report

In partnership with Europol, the Institute for Security and Technology and the Ransomware Task Force’s International Engagement Working Group designed and delivered Exercise VEIL STORM I, a tabletop exercise focused on operational collaboration across international law enforcement agencies and private sector firms in responding to cyber incidents. This after-action report summarizes the proceedings and key takeaways of the exercise.

cyber insurance, cybersecurity, disruption, Europol, information sharing, operational collaboration, public-private collaboration, Public-private partnerships, Ransomware

July 23, 2025

Plan directeur de défense contre les rançongiciels

Plan directeur de défense contre les rançongiciels

En réponse à la mesure 3.1.1 du rapport du Groupe de travail sur la lutte contre les rançongiciels, qui recommande à la communauté de la cybersécurité d’« élaborer un cadre clair de mesures exécutables d’atténuation, d’intervention et de récupération relatives aux rançongiciels », le Groupe de travail sur le Plan directeur de défense contre les rançongiciels a intégré au présent document un sous-ensemble structuré de mesures de protection essentielles en matière de cyberhygiène3, puisées dans le site Web Contrôles de sécurité essentiels du contrôles du CIS® v8.

blueprint, cybersecurity, defend, protect, Ransomware, respond

July 14, 2025

Nuclear Command, Control, and Communications (NC3): A Primer on Strategic Warning, Decision Support, and Adaptive Targeting Subsystems

Nuclear Command, Control, and Communications (NC3): A Primer on Strategic Warning, Decision Support, and Adaptive Targeting Subsystems

Originally drafted to guide substantive discussions for a scenario-driven workshop hosted by IST in Washington, DC on the risks and opportunities of AI integration in NC3, this primer provides a technical and in-depth overview and analysis of strategic warning, decision support, and adaptive targeting subsystems that comprise the NC3 “system of systems.”

adaptive targeting, decision support, NC3, NC3 architecture, nuclear, strategic warning, system of systems

July 7, 2025

Securing the Signal: Mitigation Strategies to Strengthen Crisis Communication Channels

Securing the Signal: Mitigation Strategies to Strengthen Crisis Communication Channels

As global norms are challenged and emerging technologies accelerate, crisis communication systems between nuclear-armed states face urgent new threats. This report identifies four critical scenarios and outlines a matched set of mitigation strategies designed to reinforce the reliability of crisis communications in high-stakes environments.

CATALINK, cold war, crisis communications, electromagnetic pulse, EMP, escalation, miscalculation, nuclear

May 28, 2025

Strengthening Nuclear Crisis Communications: Steps to Implement Mesh Networks to Enhance Resilience & Security

Strengthening Nuclear Crisis Communications: Steps to Implement Mesh Networks to Enhance Resilience & Security

To advance work on secure crisis communications, IST convened a diverse group of experts for a technical workshop to explore potential avenues for improving the resilience of nuclear crisis communications networks, including IST’s CATALINK Initiative. In this report, IST’s Christian Steins shares critical takeaways from their discussion.

crisis communications, mesh network, nuclear weapon state, resilience, ROCCS

May 22, 2025