# AI Phishing Detection System Example (Defensive Perspective)
import hashlib
from datetime import datetime

class PhishingDetector:
    def __init__(self):
        self.known_patterns = []
        self.ai_score_threshold = 0.75

    def analyze_email(self, email_content, sender_info):
        features = {
            "urgency_score": self._check_urgency(email_content),
            "link_analysis": self._analyze_links(email_content),
            "sender_reputation": self._check_sender(sender_info),
            "ai_generated_probability": self._detect_ai_text(email_content),
            "context_mismatch": self._check_context(email_content, sender_info),
        }
        risk_score = sum(features.values()) / len(features)
        return {
            "risk_level": "HIGH" if risk_score > self.ai_score_threshold else "LOW",
            "features": features,
            "timestamp": datetime.now().isoformat(),
        }

    def _detect_ai_text(self, content):
        # AI-generated text characteristic analysis
        # - Excessively perfect grammar
        # - Statistical text pattern analysis
        # - Perplexity-based detection
        pass

# Ransomware Response -- Backup Verification Script Example
#!/bin/bash

BACKUP_DIR="/backup/daily"
LOG_FILE="/var/log/backup-verify.log"
ALERT_EMAIL="security@company.com"

echo "=== Backup Verification Started: $(date) ===" >> "$LOG_FILE"

# Backup integrity verification
for backup_file in "$BACKUP_DIR"/*.tar.gz; do
    if tar -tzf "$backup_file" > /dev/null 2>&1; then
        echo "[OK] $backup_file" >> "$LOG_FILE"
    else
        echo "[FAIL] $backup_file - CORRUPTED" >> "$LOG_FILE"
        echo "Backup corruption detected: $backup_file" | \
            mail -s "ALERT: Backup Verification Failed" "$ALERT_EMAIL"
    fi
done

# 3-2-1 backup rule verification
local_count=$(find "$BACKUP_DIR" -name "*.tar.gz" -mtime -1 | wc -l)
if [ "$local_count" -lt 1 ]; then
    echo "[WARN] No recent local backup found" >> "$LOG_FILE"
fi

# AWS Config Rules Example -- Automated Cloud Security Auditing
# aws-config-rules.yaml
Resources:
  S3BucketPublicReadRule:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: s3-bucket-public-read-prohibited
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_PUBLIC_READ_PROHIBITED
      Scope:
        ComplianceResourceTypes:
          - AWS::S3::Bucket

  IAMRootAccessKeyRule:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: iam-root-access-key-check
      Source:
        Owner: AWS
        SourceIdentifier: IAM_ROOT_ACCESS_KEY_CHECK

  EncryptionAtRestRule:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: encrypted-volumes
      Source:
        Owner: AWS
        SourceIdentifier: ENCRYPTED_VOLUMES
      Scope:
        ComplianceResourceTypes:
          - AWS::EC2::Volume

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "EnforceMFA",
      "Effect": "Deny",
      "NotAction": [
        "iam:CreateVirtualMFADevice",
        "iam:EnableMFADevice",
        "iam:GetUser",
        "iam:ListMFADevices",
        "iam:ListVirtualMFADevices",
        "iam:ResyncMFADevice",
        "sts:GetSessionToken"
      ],
      "Resource": "*",
      "Condition": {
        "BoolIfExists": {
          "aws:MultiFactorAuthPresent": "false"
        }
      }
    }
  ]
}

# Kubernetes NetworkPolicy Example -- Micro-segmentation
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict-backend-access
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend-api
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: api-gateway
        - namespaceSelector:
            matchLabels:
              env: production
      ports:
        - protocol: TCP
          port: 8080
  egress:
    - to:
        - podSelector:
            matchLabels:
              app: database
      ports:
        - protocol: TCP
          port: 5432
    - to:
        - namespaceSelector: {}
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53

# PQC Transition Preparation -- Cryptographic Inventory Scan Example
class CryptoInventoryScanner:
    """Scans organizational cryptographic usage to identify quantum-vulnerable algorithms."""

    QUANTUM_VULNERABLE = [
        "RSA-1024", "RSA-2048", "RSA-4096",
        "ECDSA-P256", "ECDSA-P384",
        "ECDH", "DH",
        "DSA",
    ]

    QUANTUM_SAFE = [
        "ML-KEM-768", "ML-KEM-1024",
        "ML-DSA-65", "ML-DSA-87",
        "SLH-DSA-SHA2-128s",
        "AES-256",  # Symmetric keys are quantum-resistant (require 2x key length)
    ]

    def scan_certificates(self, cert_paths):
        results = []
        for path in cert_paths:
            cert_info = self._parse_certificate(path)
            is_vulnerable = cert_info["algorithm"] in self.QUANTUM_VULNERABLE
            results.append({
                "path": path,
                "algorithm": cert_info["algorithm"],
                "key_size": cert_info["key_size"],
                "expiry": cert_info["expiry"],
                "quantum_vulnerable": is_vulnerable,
                "migration_priority": "HIGH" if is_vulnerable else "LOW",
            })
        return results

    def generate_migration_plan(self, scan_results):
        vulnerable = [r for r in scan_results if r["quantum_vulnerable"]]
        return {
            "total_certificates": len(scan_results),
            "vulnerable_count": len(vulnerable),
            "high_priority": [r for r in vulnerable if r["migration_priority"] == "HIGH"],
            "recommended_timeline": "2026-2028",
            "target_algorithms": self.QUANTUM_SAFE,
        }

# LLM Output Filtering -- Sensitive Information Leakage Prevention
import re

class LLMOutputFilter:
    """Detects and masks sensitive information in LLM responses."""

    SENSITIVE_PATTERNS = {
        "credit_card": r"\b\d{4}[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4}\b",
        "ssn": r"\b\d{3}-\d{2}-\d{4}\b",
        "email": r"\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b",
        "api_key": r"\b(sk|pk|api)[-_][A-Za-z0-9]{20,}\b",
        "ip_address": r"\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b",
    }

    def filter_response(self, response_text):
        filtered = response_text
        detected = []
        for pattern_name, pattern in self.SENSITIVE_PATTERNS.items():
            matches = re.findall(pattern, filtered)
            if matches:
                detected.append({
                    "type": pattern_name,
                    "count": len(matches),
                })
                filtered = re.sub(pattern, f"[REDACTED_{pattern_name.upper()}]", filtered)
        return {
            "original_length": len(response_text),
            "filtered_text": filtered,
            "detections": detected,
            "was_filtered": len(detected) > 0,
        }

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "version": 1,
  "metadata": {
    "component": {
      "type": "application",
      "name": "my-web-app",
      "version": "2.1.0"
    }
  },
  "components": [
    {
      "type": "library",
      "name": "express",
      "version": "4.18.2",
      "purl": "pkg:npm/express@4.18.2",
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "type": "library",
      "name": "lodash",
      "version": "4.17.21",
      "purl": "pkg:npm/lodash@4.17.21",
      "vulnerabilities": []
    }
  ]
}

# GitHub Actions -- Dependency Security Scan Workflow
name: Dependency Security Scan
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 6 * * 1'  # Every Monday at 6 AM

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'

      - name: Upload Trivy scan results
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'

      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          format: cyclonedx-json
          output-file: 'sbom.json'

      - name: Check for known vulnerabilities
        run: |
          npm audit --audit-level=high
          echo "Dependency audit completed"

## Developer Security Checklist 2026

### Code Security
- [ ] No hardcoded secrets (API keys, tokens) in code
- [ ] Input validation applied
- [ ] SQL injection, XSS, CSRF defenses implemented
- [ ] Latest OWASP Top 10 vulnerabilities reviewed

### Dependency Management
- [ ] npm audit / pip audit results clean
- [ ] SBOM generated and maintained
- [ ] Unused dependencies removed
- [ ] License compliance verified

### Authentication/Authorization
- [ ] MFA applied
- [ ] Least privilege principle followed
- [ ] JWT token expiration times appropriate
- [ ] Session management implemented securely

### AI/LLM Security
- [ ] Prompt injection defenses applied
- [ ] LLM output filtering implemented
- [ ] AI model access permissions restricted
- [ ] Training data privacy ensured

## Security Administrator Checklist 2026

### Infrastructure Security
- [ ] Zero trust architecture implemented
- [ ] Network segmentation applied
- [ ] EDR deployed on all endpoints
- [ ] Cloud CSPM enabled

### Incident Response
- [ ] Incident Response Plan (IRP) up to date
- [ ] Backup recovery tests performed regularly
- [ ] SOC team 24/7 monitoring operational
- [ ] Forensic analysis tools ready

### Compliance
- [ ] ISMS-P certification maintained
- [ ] Privacy impact assessment conducted
- [ ] PQC transition roadmap established
- [ ] Third-party security audits completed

### Training/Awareness
- [ ] All-staff security awareness training conducted 2+ times per year
- [ ] Deepfake/phishing simulations performed quarterly
- [ ] Security incident reporting system clearly defined
- [ ] Development team secure coding training conducted

+------------------------------------------------------------------+
|                    2026 Security Architecture                     |
+------------------------------------------------------------------+
|                                                                   |
|  [Identity Layer]                                                 |
|    - Zero Trust Identity (ZTNA)                                   |
|    - MFA + Biometrics                                             |
|    - Continuous Authentication                                    |
|                                                                   |
|  [Network Layer]                                                  |
|    - Micro-segmentation                                           |
|    - Encrypted Transit (mTLS)                                     |
|    - SASE / SSE                                                   |
|                                                                   |
|  [Application Layer]                                              |
|    - SAST / DAST / IAST                                           |
|    - SBOM + SCA                                                   |
|    - AI/LLM Security (Prompt Guard)                               |
|                                                                   |
|  [Data Layer]                                                     |
|    - PQC (Post-Quantum Cryptography)                              |
|    - DLP (Data Loss Prevention)                                   |
|    - Encryption at Rest + In Transit                              |
|                                                                   |
|  [Detection & Response]                                           |
|    - AI-SOC (SIEM + SOAR)                                         |
|    - EDR / XDR                                                    |
|    - Threat Intelligence                                          |
|                                                                   |
+------------------------------------------------------------------+