Where KTP lands on the defense map.
The field already has a coordinate system: ATT&CK, D3FEND, CSF, Zero Trust, ATLAS, the OWASP LLM Top 10, the AI RMF. This page locates KTP on it — framework by framework, primitive by primitive, with the contradictions left in.
§01how to read this map
Each framework below gets three honest answers: what it covers in its own vocabulary, where autonomous agents strain its assumptions, and where each KTP primitive lands against it. Every mapping carries one of three verdicts. Where a framework already owns the ground, the verdict says so.
The framework names the need but ships no mechanism. KTP supplies one.
Both have mechanisms. They compose — KTP slots into the framework's own architecture.
KTP rejects an assumption the framework depends on. The tension is the finding.
§02the seven frameworks
Four are the core canon a CISO already navigates by. Three are where the field is codifying AI-specific threat and risk right now. Sources and full citations live in the dossier; each card links to the framework's primary surface.
ATT&CK
A curated knowledge base of real-world adversary tactics and techniques, organized as 15 enterprise tactics over 200-plus techniques and sub-techniques. It is a descriptive catalog of how compromise unfolds, built to align detection and red-teaming to observed behavior.
- It catalogs adversary behavior and assumes the adversary is human-paced and already past admission.
- Autonomous agents execute technique chains at machine speed from inside a trusted identity, with no malware to signature.
- It is descriptive, not prescriptive: it names techniques, not who is allowed to act.
ATT&CK already models adversaries as technique sequences over time. KTP applies the same trajectory lens to authorization, not just detection.
ATT&CK enumerates the capability that gets exercised when no enforcement surface vetoes it. It names no enforcement ceiling; A ≤ E is that ceiling.
ATT&CK's continuous behavioral detection composes with KTP: detect a technique on the path, recompute the authority that permitted it.
ATT&CK's Lateral Movement tactic is the attack against flat trust. It names the threat, not the segmentation boundary that denies it.
ATT&CK counts techniques as discrete events. Ambient Breach integrates them into a sustained rate. The catalog feeds the rate.
ATT&CK has no trust or vouching model; it assumes the adversary is already inside. Sponsorship governs the admission ATT&CK does not.
D3FEND
A defensive countermeasure ontology and knowledge graph: 267 defensive techniques across seven tactical categories (harden, detect, isolate, deceive, evict, restore, model), each linkable to the ATT&CK techniques it counters.
- Its countermeasures are catalogued as capabilities, applied at design and configuration time.
- It models defenses against external adversaries, not authority decisions for trusted agents acting continuously.
- It has no runtime notion of an identity that earns or loses standing along a path.
D3FEND's ontology has slots for credential and session countermeasures. Trajectory-is-identity is a new defensive technique that extends the taxonomy rather than breaking it.
D3FEND is a catalog of the enforcement surfaces A ≤ E says authority must be bounded by. The principle and the catalog compose directly.
D3FEND catalogs countermeasures but deploys them statically. Governance-in-motion is the runtime recomputation the ontology does not model.
D3FEND's Isolate tactic is the mechanism layer. Blue Net is the trust topology that decides where the isolation boundaries fall.
D3FEND inventories countermeasure coverage, not the breach rate that persists despite them. Ambient Breach supplies the rate metric.
D3FEND has no admission or vouching technique. Sponsorship fills the cold-start control the taxonomy lacks.
CSF 2.0
An outcome-based framework of cybersecurity governance and risk, organized into six Functions: Govern, Identify, Protect, Detect, Respond, Recover. The 2.0 release added Govern to center oversight, strategy, roles, and policy.
- Its outcomes are assessed on a program cadence: assess, implement, review, repeat.
- Autonomous agents act between assessment cycles, faster than the governance loop can turn.
- It specifies outcomes, not the mechanisms that achieve them at machine speed.
CSF's PR.AA calls for identity management and access control but specifies no identity primitive. Trajectory-is-identity is the mechanism CSF leaves to the implementer.
CSF.GV establishes governance as an outcome. A ≤ E supplies the principle that ungoverned authority is silently exercised, which CSF asserts but does not formalize.
CSF.GV models governance as a program cycle, assessed periodically. Governance-in-motion rejects the approve-once cadence for autonomous agents. The tension is the finding.
CSF calls for segmentation and resilient architecture as outcomes. Blue Net is one trust topology that satisfies the outcome.
CSF's Detect function is organized around discrete detectable events and incidents. Ambient Breach holds that breach is a continuous default below the detection threshold. The event model and the rate model conflict.
CSF.SC names third-party and supplier trust as an outcome but ships no admission mechanism. Sponsorship supplies the costly-vouch primitive.
SP 800-207
The reference architecture for Zero Trust: per-request access decisions made by a policy decision point and enforced at a policy enforcement point, under the tenet that no access is implicitly trusted and every request is verified from identity, device, and context.
- Its trust algorithm is specified, but its inputs, including any historical signal, are left to the implementer.
- It evaluates per request and largely per session; it does not model an agent's full trajectory as the subject.
- Cold-start and cross-domain federation are named as hard problems but not solved.
The per-request evaluation is the natural host for trajectory-as-identity. KTP supplies the trajectory as a richer subject signal the policy decision point consumes.
The policy enforcement point is the enforcement surface A ≤ E names. Zero Trust already embodies autonomy bounded by the environment's enforced capacity at the per-request level.
Per-request, continuous trust evaluation is governance-in-motion at the session boundary. KTP extends the recomputation cadence from request to trajectory.
Implicit trust zones and microsegmentation are the substrate. Blue Net adds the federated treaty-trust at zone borders that 800-207 leaves underspecified across domains.
Zero Trust already adopts an assume-breach posture. Ambient Breach quantifies that assumption as a measurable rate rather than a design stance.
800-207 specifies a trust algorithm but leaves its scoring and the cold-start case to the implementer. The Trust Force Equation quantifies the score; sponsorship handles cold-start.
ATLAS
A living knowledge base of adversary tactics and techniques against AI-enabled systems: 16 tactics and 84 techniques spanning evasion, model poisoning, model theft, prompt injection, RAG poisoning, and, since 2025, AI-agent and generative-AI attacks.
- It catalogs attacks on AI systems; it specifies no trust or authority model for the agents themselves.
- Agent impersonation, hijack, and multi-agent compromise are named as techniques, not defended.
- Like ATT&CK, it is a threat language, not a control.
ATLAS catalogs agent impersonation and hijack. It names the threat trajectory-is-identity defends against but ships no identity model.
ATLAS enumerates the capability adversaries exercise against ungoverned AI. A ≤ E is the enforcement ceiling those techniques presume absent.
ATLAS describes adversary progression through AI attack stages. Governance-in-motion is the runtime response ATLAS does not provide.
ATLAS's AI supply-chain and multi-agent techniques are attacks on flat agent trust. Blue Net segmentation is the boundary ATLAS names no defense for.
ATLAS enumerates AI-specific breach techniques. Ambient Breach aggregates them into the rate of compromise across an agent fleet.
ATLAS documents impersonation and poisoned-provenance attacks. Sponsorship's costly-vouch is the admission control ATLAS shows is missing.
LLM Top 10
The consensus list of the ten most critical risks in LLM applications for 2025, led by prompt injection, sensitive-information disclosure, supply chain, data and model poisoning, and excessive agency. It is a risk inventory for builders of LLM and agentic systems.
- It names agentic risks precisely, Excessive Agency and indirect prompt injection chief among them, but ships guidance, not mechanism.
- Its unit is the application risk, not the continuously acting agent.
- Mitigations are recommended in prose and left to each implementer to build.
LLM06 Excessive Agency names the over-privileged-agent risk directly. Trajectory-is-identity scopes agency to the demonstrated path. OWASP names the risk; KTP ships the control.
Excessive Agency is A ≤ E violated: capability granted beyond the enforcement surface. OWASP lists it as a risk; A ≤ E is the principle and KTP the bound.
Indirect prompt injection (LLM01) is the trajectory going hostile after authorization. Governance-in-motion is the recompute that catches it. OWASP lists the vuln; KTP supplies the runtime response.
LLM03 Supply Chain and agent-to-agent exposure are flat-trust failures. Blue Net segmentation is the containment OWASP recommends in prose but does not specify.
The OWASP risks are the failure modes. Ambient Breach is the rate at which they aggregate into sustained compromise across an LLM fleet.
Poisoned models and components (LLM04, LLM03) are admission failures. Sponsorship's costly-vouch and provenance-debit fill the trust-admission OWASP lacks.
AI RMF
A voluntary framework for managing AI risk across four functions, Govern, Map, Measure, and Manage, anchored by seven characteristics of trustworthy AI. The 2024 Generative AI Profile (NIST AI 600-1) adds twelve risk categories unique to or exacerbated by generative AI.
- Its functions are process outcomes, measured and managed on a lifecycle cadence.
- It is architecture-agnostic by design and specifies no runtime authority mechanism.
- Autonomous agents act continuously, between the intervals at which the framework measures and manages.
AI RMF calls for AI actors and system provenance to be mapped. Trajectory-is-identity is the runtime identity primitive the framework leaves unspecified.
AI RMF.GOVERN assigns accountability for AI authority. A ≤ E formalizes the ceiling that autonomy cannot exceed the environment's capacity to carry it — enforced at the surface, not held as a value — which the framework asserts but does not bound.
AI RMF models governance as a lifecycle process measured at intervals. Governance-in-motion requires per-action recomputation for autonomous agents. The cadence assumptions conflict.
AI RMF is process-level and architecture-agnostic. Blue Net supplies a federation topology the framework neither specifies nor precludes.
AI RMF.MEASURE calls for risk metrics. Ambient Breach (B = Kρ as a rate) is a concrete agentic-breach metric that instantiates the Measure function.
The GenAI Profile names value-chain and component-integration risk. Sponsorship's costly-vouch is the admission mechanism the profile calls for but does not define.
§03the synthesis matrix
Six KTP primitives against seven frameworks, at a glance. The matrix is derived from the cards above — same data, no drift. Read a row to see where one primitive lives across the field; read a column to see how much of KTP a single framework already anticipates.
| KTP primitive | MITRE ATT&CK | MITRE D3FEND | NIST CSF 2.0 | NIST SP 800-207 | MITRE ATLAS | OWASP LLM Top 10 | NIST AI RMF |
|---|---|---|---|---|---|---|---|
| Trajectory-is-identity | complements — ATT&CK already models adversaries as technique sequences over time. KTP applies the same trajectory lens to authorization, not just detection. | complements — D3FEND's ontology has slots for credential and session countermeasures. Trajectory-is-identity is a new defensive technique that extends the taxonomy rather than breaking it. | fills — CSF's PR.AA calls for identity management and access control but specifies no identity primitive. Trajectory-is-identity is the mechanism CSF leaves to the implementer. | complements — The per-request evaluation is the natural host for trajectory-as-identity. KTP supplies the trajectory as a richer subject signal the policy decision point consumes. | fills — ATLAS catalogs agent impersonation and hijack. It names the threat trajectory-is-identity defends against but ships no identity model. | fills — LLM06 Excessive Agency names the over-privileged-agent risk directly. Trajectory-is-identity scopes agency to the demonstrated path. OWASP names the risk; KTP ships the control. | fills — AI RMF calls for AI actors and system provenance to be mapped. Trajectory-is-identity is the runtime identity primitive the framework leaves unspecified. |
| A ≤ E (Silent Veto) | fills — ATT&CK enumerates the capability that gets exercised when no enforcement surface vetoes it. It names no enforcement ceiling; A ≤ E is that ceiling. | complements — D3FEND is a catalog of the enforcement surfaces A ≤ E says authority must be bounded by. The principle and the catalog compose directly. | fills — CSF.GV establishes governance as an outcome. A ≤ E supplies the principle that ungoverned authority is silently exercised, which CSF asserts but does not formalize. | complements — The policy enforcement point is the enforcement surface A ≤ E names. Zero Trust already embodies autonomy bounded by the environment's enforced capacity at the per-request level. | fills — ATLAS enumerates the capability adversaries exercise against ungoverned AI. A ≤ E is the enforcement ceiling those techniques presume absent. | fills — Excessive Agency is A ≤ E violated: capability granted beyond the enforcement surface. OWASP lists it as a risk; A ≤ E is the principle and KTP the bound. | fills — AI RMF.GOVERN assigns accountability for AI authority. A ≤ E formalizes the ceiling that autonomy cannot exceed the environment's capacity to carry it — enforced at the surface, not held as a value — which the framework asserts but does not bound. |
| Governance in motion | complements — ATT&CK's continuous behavioral detection composes with KTP: detect a technique on the path, recompute the authority that permitted it. | fills — D3FEND catalogs countermeasures but deploys them statically. Governance-in-motion is the runtime recomputation the ontology does not model. | contradicts — CSF.GV models governance as a program cycle, assessed periodically. Governance-in-motion rejects the approve-once cadence for autonomous agents. The tension is the finding. | complements — Per-request, continuous trust evaluation is governance-in-motion at the session boundary. KTP extends the recomputation cadence from request to trajectory. | fills — ATLAS describes adversary progression through AI attack stages. Governance-in-motion is the runtime response ATLAS does not provide. | fills — Indirect prompt injection (LLM01) is the trajectory going hostile after authorization. Governance-in-motion is the recompute that catches it. OWASP lists the vuln; KTP supplies the runtime response. | contradicts — AI RMF models governance as a lifecycle process measured at intervals. Governance-in-motion requires per-action recomputation for autonomous agents. The cadence assumptions conflict. |
| Blue Net | fills — ATT&CK's Lateral Movement tactic is the attack against flat trust. It names the threat, not the segmentation boundary that denies it. | complements — D3FEND's Isolate tactic is the mechanism layer. Blue Net is the trust topology that decides where the isolation boundaries fall. | complements — CSF calls for segmentation and resilient architecture as outcomes. Blue Net is one trust topology that satisfies the outcome. | complements — Implicit trust zones and microsegmentation are the substrate. Blue Net adds the federated treaty-trust at zone borders that 800-207 leaves underspecified across domains. | fills — ATLAS's AI supply-chain and multi-agent techniques are attacks on flat agent trust. Blue Net segmentation is the boundary ATLAS names no defense for. | fills — LLM03 Supply Chain and agent-to-agent exposure are flat-trust failures. Blue Net segmentation is the containment OWASP recommends in prose but does not specify. | fills — AI RMF is process-level and architecture-agnostic. Blue Net supplies a federation topology the framework neither specifies nor precludes. |
| Ambient Breach | complements — ATT&CK counts techniques as discrete events. Ambient Breach integrates them into a sustained rate. The catalog feeds the rate. | fills — D3FEND inventories countermeasure coverage, not the breach rate that persists despite them. Ambient Breach supplies the rate metric. | contradicts — CSF's Detect function is organized around discrete detectable events and incidents. Ambient Breach holds that breach is a continuous default below the detection threshold. The event model and the rate model conflict. | complements — Zero Trust already adopts an assume-breach posture. Ambient Breach quantifies that assumption as a measurable rate rather than a design stance. | complements — ATLAS enumerates AI-specific breach techniques. Ambient Breach aggregates them into the rate of compromise across an agent fleet. | complements — The OWASP risks are the failure modes. Ambient Breach is the rate at which they aggregate into sustained compromise across an LLM fleet. | complements — AI RMF.MEASURE calls for risk metrics. Ambient Breach (B = Kρ as a rate) is a concrete agentic-breach metric that instantiates the Measure function. |
| Trust Force Equation / Sponsorship | fills — ATT&CK has no trust or vouching model; it assumes the adversary is already inside. Sponsorship governs the admission ATT&CK does not. | fills — D3FEND has no admission or vouching technique. Sponsorship fills the cold-start control the taxonomy lacks. | fills — CSF.SC names third-party and supplier trust as an outcome but ships no admission mechanism. Sponsorship supplies the costly-vouch primitive. | fills — 800-207 specifies a trust algorithm but leaves its scoring and the cold-start case to the implementer. The Trust Force Equation quantifies the score; sponsorship handles cold-start. | fills — ATLAS documents impersonation and poisoned-provenance attacks. Sponsorship's costly-vouch is the admission control ATLAS shows is missing. | fills — Poisoned models and components (LLM04, LLM03) are admission failures. Sponsorship's costly-vouch and provenance-debit fill the trust-admission OWASP lacks. | fills — The GenAI Profile names value-chain and component-integration risk. Sponsorship's costly-vouch is the admission mechanism the profile calls for but does not define. |
§04what the map means
Four lines that survive translation into the security review, the architecture board, and the budget meeting.
Every framework here governs at a gate or after an event. KTP governs along the path.
The canon names the agentic risk. Almost none of it ships an agentic mechanism. That gap is the product.
Where the field assumes governance is a cycle you audit, KTP assumes it is a quantity you recompute. The approve-once cadence is what autonomous agents break.
Zero Trust got the verb right: never trust, always verify. KTP supplies the object. Verify the trajectory, not the credential.
§05honest gaps
What these frameworks cover that KTP does not. A map that only shows where you win is a brochure. These are the grounds the canon owns and KTP does not contest.
Detection engineering
ATT&CK and D3FEND encode thousands of concrete detection and countermeasure techniques. KTP decides who may act and when. It does not tell you how to detect a given technique on the wire. The catalogs remain the detection substrate.
Organizational governance
CSF 2.0 and the AI RMF cover board oversight, roles, policy, workforce, and program maturity. KTP governs machine authority, not human accountability structures. The two operate at different altitudes, and both are required.
Recovery and resilience
CSF's Respond and Recover functions cover incident handling, continuity, and restoration. KTP lowers the breach rate. It does not restore service after an incident. Recovery stays with the canon.
Model-layer robustness
ATLAS and the OWASP LLM Top 10 cover evasion, poisoning, embedding weaknesses, and model theft at the model layer. KTP governs the agent's authority, not the model's robustness. A trustworthy trajectory can still run on a poisoned model.
Supply-chain provenance
Supply-chain integrity (CSF.SC, LLM03, ATLAS supply-chain) requires provenance, SBOMs, and vendor assurance. Sponsorship debits a vouch after the fact. It does not verify a component's build pedigree. Provenance tooling stays upstream of KTP.