💻 computer science

Beyond Resilience: Antifragility in Critical Infrastructure Cybersecurity

This paper proposes a Theory of Antifragility for critical infrastructure cybersecurity, using empirical analysis of cyber events and hardware-in-the-loop data to demonstrate that while OT-adjacent sectors face significantly higher disruptive threats and exhibit measurable response variations, current findings establish the necessary prerequisites for future antifragility testing rather than proving adaptive gain.

Original authors: Stephen Flowerday, Mauricio Papa, Ethan Flowerday

Published 2026-08-03

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Stephen Flowerday, Mauricio Papa, Ethan Flowerday

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the digital world as a giant, invisible nervous system connecting everything from the lights in your bedroom to the power grids that keep a whole city running. For a long time, experts thought the best way to protect this system was to make it "resilient." Think of resilience like a rubber band: if you stretch it too far, it snaps back to its original shape. It survives the stress, but it doesn't get any better at handling stress next time. It just goes back to being exactly what it was before. But what if a system could be like a muscle? When you lift a heavy weight, your muscle tears slightly, but when it heals, it grows back stronger and bigger than before. This idea is called "antifragility." It's not just about bouncing back; it's about bouncing forward. The big question scientists are asking is: Can we build computer systems for our critical infrastructure (like water treatment plants and power grids) that actually learn from attacks and get stronger, rather than just fixing the damage and hoping for the best?

This paper, titled "Beyond Resilience: Antifragility in Critical Infrastructure Cybersecurity," dives into that exact question. The authors, Stephen Flowerday, Mauricio Papa, and Ethan Flowerday, argue that we need a new way of thinking. They don't just want systems that survive; they want systems that improve when things go wrong. To test if this is even possible, they created a new "Theory of Antifragility" (AFT). They set up a mathematical rulebook to define exactly what "getting stronger" looks like, distinguishing it from simply "surviving."

The researchers didn't just sit in a lab and dream this up; they went hunting for evidence in two different places. First, they looked at a massive database of real-world cyber events (the CISSM database) to see if different types of industries face different kinds of trouble. They found that industries that control physical things—like power plants and factories (called "OT-adjacent" sectors)—face a much heavier load of disruptive attacks. In fact, 65.3% of the cyber events in these sectors caused direct disruption or a mix of problems, compared to only 46.8% in sectors that mostly deal with information, like finance or healthcare. They also found that physical attacks and data attacks were much more common in these industrial sectors, suggesting that the "muscle" of these systems is being tested in very specific, dangerous ways.

Second, they used a special dataset called HAI, which simulates a factory control system being attacked. They wanted to see if they could actually measure the system's reaction to an attack. They found that when an attack happened, the system's behavior jumped off the charts. Attack-labeled moments were 7.43 times more likely to show huge deviations from normal behavior than peaceful moments. This is a crucial step because you can't prove a system is getting stronger if you can't even see how it reacts to being hit.

However, here is the most important part: the paper does not claim that they found a system that is already antifragile. They explicitly state that while they saw the system react differently over time, they didn't see proof that it actually got better or learned to handle the next attack more safely. The data showed that the system's reaction changed, but not necessarily for the better. The authors are very careful to say that "chaos engineering" (intentionally breaking things to test them) is just the verb, while "antifragility" is the noun. You can break things to test a system, but that doesn't automatically mean the system has become antifragile.

So, what did they actually achieve? They built the measuring stick. They proved that we can tell the difference between industries that are fragile in different ways, and they proved that we can measure how a system wobbles when it gets hit. They set the stage for the future, showing us that the tools to test for "bouncing forward" exist, but the actual "super-strong" systems haven't been built yet. The paper is a roadmap, not a destination. It tells us that to get antifragile systems, we need to stop just fixing things and start designing systems that can safely learn from their scars, but we have a long way to go before we can say we've successfully built one.

Technical Summary: Beyond Resilience: Antifragility in Critical Infrastructure Cybersecurity

Problem Statement
Current cybersecurity frameworks for critical infrastructure (CI) prioritize resilience, defined as the ability to recover and return to an acceptable operating state after disruption. However, the authors argue that resilience is insufficient for CI because a system can repeatedly recover from shocks without becoming stronger, leaving it vulnerable to the same failure pathways. The paper identifies a conceptual gap: while "chaos engineering" (the verb of controlled perturbation) is practiced, there is no empirically grounded theory or measurement framework for "antifragility" (the noun of gaining from disorder) in operational technology (OT) and industrial control systems (ICS). Existing literature often conflates stability, robustness, and resilience, failing to distinguish between systems that merely survive and those that improve due to bounded volatility.

Theoretical Framework: Theory of Antifragility (AFT)
The paper proposes a Theory of Antifragility (AFT) anchored in a five-state Resilient System Model (Fragile, Reliable, Robust, Resilient, Antifragile). Antifragility is defined not as unlimited gain from chaos, but as a safety-constrained property where bounded disorder leads to measurable post-disruption improvement.

The theory relies on two mathematical prerequisites:

Jensen Gain: The system's utility function must be convex over a bounded stressor distribution, meaning the expected utility under variability is greater than the utility at the expected value ( $E[U(s)] > U(E[s])$ ).
Post-Disruption Gain: Following an adaptation step, the system's configuration must perform measurably better under the same bounded perturbation than the pre-adaptation configuration.

The authors distinguish antifragility from "sacrificial robustness" (e.g., ablative heat shields or manual overrides), where a system survives by expending resources but does not structurally improve. True antifragility requires converting disruption into durable architectural advantages, such as reduced susceptibility or faster recovery.

Methodology
The study employs a two-layer empirical design to test prerequisites for future antifragility validation, rather than claiming to have proven a system is antifragile.

Macro-Level (Sectoral Fragility):
- Data: A subset of the CISSM Cyber Events Database (10,589 events from 2014–2026) covering seven sectors: Utilities, Transportation, Manufacturing, Public Administration, Information, Healthcare, and Finance.
- Approach: Sectors were grouped into "OT-adjacent" (Utilities, Transportation, Manufacturing) and "Non-OT" (Public Administration, Information, Healthcare, Finance). The study analyzed event types to determine if OT-adjacent sectors carry a higher burden of disruptive, physical, or data-integrity attacks compared to information-centric sectors.
- Statistical Tests: Pearson chi-square tests and Cramér's V were used to assess differences in event composition.
Micro-Level (Process Perturbation Observability):
- Data: The HAI (HIL-Based Augmented Industrial Control System) 23.05 dataset, a hardware-in-the-loop testbed containing 54,000 observations with 2,981 attack-labeled intervals.
- Approach: The study measured process-state deviations during attack windows versus normal operations using 65 informative process variables.
- Metrics: Deviations were quantified using mean absolute z-scores, Root Mean Square (RMS) baseline distance, and Mahalanobis distance (to account for covariance among sensor channels).
- Analysis: The study tested whether attack-labeled observations produced significantly larger deviations than normal ones and whether response dynamics varied across successive attack windows.

Key Results

Sectoral Differentiation (H1 & H2):
- OT-adjacent sectors exhibited a significantly higher share of disruptive or mixed cyber events (65.3%) compared to non-OT sectors (46.8%) ( $p < 0.001$ ).
- OT-adjacent sectors showed a disproportionate concentration of physical-attack and data-attack subtypes (40.9% vs. 21.4% for non-OT). Specifically, physical attacks were 14 times more prevalent in OT-adjacent sectors (4.2% vs. 0.3%).
- This confirms that fragility burden is structured and measurable, with OT-adjacent sectors facing a qualitatively different, operationally disruptive threat profile.
Process-Level Observability (H3 & H4):
- Attack-labeled observations in the HAI dataset were 7.43 times more likely to exceed the 95th percentile of baseline deviation compared to normal observations ( $p < 0.001$ ).
- Mahalanobis distance analysis confirmed that attack conditions produced significantly larger multivariate deviations (ratio of 2.69) than normal conditions.
- Across successive attack windows, mean process-state deviation showed a statistically significant declining trend (Spearman $\rho = -0.688$ , $p = 0.007$ ). However, the authors note this is exploratory evidence of response variation, not proof of adaptive gain, as attack types were heterogeneous and no explicit adaptation step was documented.

Key Contributions
The paper makes three specific contributions:

Theoretical: It defines antifragility for CI cybersecurity as a bounded, safety-constrained capacity for improvement, formalizing it through Jensen gain and post-disruption gain metrics within a five-state system model.
Methodological: It establishes a layered empirical design that combines sector-level event data (CISSM) with process-level telemetry (HAI) to bridge the gap between macro fragility mapping and micro system response.
Empirical: It demonstrates that two prerequisites for antifragility testing are measurable in public data: (a) fragility burden is differentiated across sectors, and (b) bounded cyber-physical perturbations can be observed and quantified at the process level.

Significance and Claims
The authors explicitly state that the paper does not claim to have validated an antifragile system. Instead, it establishes the necessary foundation for such validation. The significance lies in moving the discourse beyond metaphor by proving that:

Fragility is not uniform; it is concentrated in OT-adjacent sectors with specific threat profiles (physical/data attacks) that require "bounce-forward" solutions rather than simple recovery.
Process-level perturbations are observable and structured, satisfying the empirical requirement to measure system response to stress.

The paper concludes that resilience should be treated as a "floor" (ensuring safety and continuity), while antifragility represents a "ceiling" (achieving improvement). Future work must introduce explicit adaptation steps and retest systems under comparable perturbations to measure whether susceptibility or recovery time has genuinely improved, thereby satisfying the formal criteria for antifragility classification.

Technical Summary: Beyond Resilience: Antifragility in Critical Infrastructure Cybersecurity

More like this