A defensive cybersecurity architecture built on one idea: reconnaissance only pays off while the mapped surface stays put. ACSE continuously regenerates the observable cryptographic identity of protected systems — every rotation cycle, 60 s by default — so an attacker's map goes out of date. It is one hardening layer, for the reconnaissance phase, alongside patching, MFA/IAM, EDR and segmentation.
Almost every major breach of the last decade follows the same shape: an attacker observes a system's cryptographic and network identity, builds a map of it over days or weeks, and then acts on that map. Credentials, certificates, endpoint fingerprints, and session identifiers are typically valid for long enough that reconnaissance pays off. ACSE removes that assumption — the map an attacker builds goes out of date every time the surface rotates — every minute by default, with every change checked by an independent verifier.
An attacker can't rely on a surface they mapped yesterday
once that surface has changed today.
Static surfaces have always been a liability. What changed is the speed, scale, and automation of the attacks exploiting them — and the personal regulatory cost of getting it wrong. Six converging forces make this the moment for continuous surface mutation.
WormGPT and AutoGPT-based attack frameworks cut surface mapping from days to minutes. ACSE's answer: the surface expires before any AI model can act on what it observed.
Shodan and Censys re-index the entire internet every few hours. Every static endpoint is catalogued before you notice the scan. ACSE: what they index is cryptographically stale before they serve the result.
Valid accounts were used in 30% of all incidents last year. The root cause isn't weak passwords — it's that stolen credentials remain valid. ACSE closes this at the root: credentials expire at mutation boundaries.
Each service is an API. Each API is a static fingerprint accumulating in attacker databases. ACSE: the surfaces it protects rotate every minute by default.
Change Healthcare: 9 days and $2.457B in damage. SolarWinds: 14 months. Attacks succeed because surfaces stay static long enough to stage. ACSE's staging window: one rotation interval — 60 seconds by default.
SEC rules, EU NIS2, India DPDP Act, CERT-In mandatory reporting. Board directors are personally liable. The cost of a static surface failure is now measured in fines, criminal liability, and stock price.
At the heart of ACSE is a simple invariant: for every covered element, the cryptographic fingerprint produced in one mutation cycle is designed never to repeat in another — computed from independently derived entropy, so fingerprints can't be predicted from previous cycles and can't be reused once they've passed. Measured: 500,000 consecutive fingerprints, all unique.
ACSE is implemented as four co-operating layers — a management control plane operators run the estate from, a mutation engine that runs on each protected node, a coordination protocol that synchronises mutation across the estate, and a set of defensive profiles tuned to different operational contexts.
The management layer operators run the estate from — one dashboard over every protected node, with live Kali Invariant status, SIEM dispatch, firewall orchestration, and role-based policy management secured by API-key authentication and RBAC. Auto-Discovery onboards an entire estate from existing identity and network systems, and every mutation across every node is aggregated into a single tamper-evident audit chain. Shipped now as Control Plane v0.4.0 — multi-tenant isolation enforced at the application layer, mTLS production transport, PKCS#11 HSM adapter (hardware validation pending), first-run setup wizard, licensing enforcement, and org-scoped estate management.
The core engine running on every protected node. On each cycle, it regenerates the cryptographic fingerprint of every registered surface using independently derived entropy, validates the result, and commits or rolls back atomically. Every mutation is recorded in a cryptographically chained, tamper-evident audit log. Each node also reports a moving average of its mutation-cycle timing to the Control Plane.
Each node reports an exponentially weighted moving average of its mutation-cycle duration with its telemetry. Detecting anomalies from it needs the Control Plane to judge durations, which is planned. A learned classifier (a local ONNX model) is designed but not shipped; it is planned once there is field data to train it on.
A purpose-built network protocol that coordinates mutation across an entire estate. Peers authenticate using handshakes that never transmit the shared secret, bound to the current mutation epoch, and a single trigger — an independent verifier observing that a node's surface stopped changing — broadcasts a Defensive Leap through the Control Plane relay to every node in the organisation. Anomaly signals between nodes (MSG-003) are specified but not yet used by the product.
Ten domain profiles, TorpedoRay and the KaliCoreTarget composite — each tuned to a different class of infrastructure: transaction systems, healthcare records, cloud workloads, distributed network grids, and more. All are composed in the shipped agent; apart from the surfaces listed on Scope, their behaviours act on an in-memory model. A master profile can trigger a coordinated rotation of every registered surface from a single call — measured median 1.9 seconds, p99 3.8 seconds, estate-wide via a cryptographically signed Defensive Leap.
Every claim behind ACSE is backed by an automated test suite, formal verification of the protocol's security properties, and benchmark evidence of real-world performance.
ACSE began as an independent research project exploring whether the cryptographic identity of a system could be made to change faster than an attacker's reconnaissance cycle. The resulting architecture — covering the mutation engine, the coordination protocol, and the estate-wide orchestration model — has been filed as a patent application with the Indian Patent Office with expedited examination requested.
The application is publicly searchable on the Indian Patent Office portal under application number IN202641070690.
Building on the foundations of ACSE, a second patent application is currently in preparation, extending this research into a related domain. Details will be shared here once filed.
Whether you're exploring collaboration, licensing, or want to talk through the architecture in depth — the conversation is welcome. The full technical whitepaper covers architecture, benchmarks, red-team results, and the ASMP/1.0 wire protocol specification.