Privacy (P) is integrated with CS and CR, resulting in a single, indivisible global reality called CSPCR. This entire multidimensional/multi-layered outcome, with extreme redundancy/factorization, has been built using STEMAI elements (Science-Technology/Engineering/Mathematics + next-generation superior AI of all types: generative, agentic, LLM/SLM, etc.) whose elements continuously self-analyze, evaluate, verify, monitor, certify/accredit, audit, improve/repair, etc. CSPCR is a single, truly indivisible unit, merging/integrating three enhanced, differentiated pieces/entities: CS, P, and CR, into a multidimensional universe where all elements self-control, self-certify, self-improve, and self-monitor each other, supported by a globally operational, supervised, verified, certified, and extremely monitored sovereign super-AI.

Figure 2 CSPCR

DIMENSIONS/PROCESSES-STEMAI IN CSPCR.

CSPCR provides global-proactive-offensive-defensive-extreme protection on all fronts-depths-dimensions-planes:

(1) Dimension of elimination, deletion, deactivation, nullification, blocking, deep isolation with extreme anticipation of all attempts of malware-virus, cyberattacks/cyber-incidents such as: MITM (Man-In-The-Middle), DoS, trackers, undeletable temporary files/archives/elements no matter where they are located, trolls, deep-fakes, ransomware, phishing elements, vishing, smshing, emailshing, videoshing…., vulnerabilities that exist or intend to exist 0-day/N-day. This dimension also acts proactively against all types of reconnaissance/surveillance attempts, infiltration-exfiltration, injection, exploration-tracking, attempts to establish hidden and subliminal/C2C (Channel-To-Control) channels used by adversaries/cyber-attackers to remotely control their malicious activities. It also acts proactively against all types of malicious attempts to manipulate internal elements such as the kernel, registry, etc., preventing wiretaps that do not allow for the termination of a connection/call/communication and making it impossible to maliciously turn devices such as PLCs, smartphones, vehicles, mobile phones, PCs, etc., off or on. (prevents malicious agents from draining portable power supplies,…), against injection or activation of sleeper agents, Trojans, malicious change generators,… CSPCR uses Sandboxing, DMZs, integrated TTPs/Trusted Third Parties, Pentesting, Red-Team/Blue-Teams, and “hydra” functionalities (this STEMAI operates as follows: for each element that is targeted for damage/infection, it neutralizes it and generates in response an extreme set of new, healthy, alternative elements to continue functioning, even with improved performance),…. The STEMAI called Pentesting integrates all penetration tests to analyze all possible ports and entry and exit points for damage/infection. The STEMAI called ZT (Zero-Trust) consists of verifying entities at all times, their identity, authentication, and the actions/operations/tasks they perform from the moment of their creation and throughout their entire lifespan. Nothing and no one can be trusted, neither inside nor outside the system/infrastructure/organization. The only valid approach is to constantly monitor, analyze, evaluate, audit, and certify/accredit everything, not just when logging in. Zero-touch (ZT) techniques are used across the board, including anticipating cyber incidents/cyberattacks to proactively neutralize them. They are also used to explore the operating system, registries, folders, temporary/undeletable files, updates, vulnerabilities, malicious reconnaissance, malicious messages, dormant files, infiltrations, injection of elements/commands, malicious pop-ups of all kinds, generative AI/insidious agents, chatbot buttons/links/connections/SMS/Telephony/Instant Messaging/WhatsApp/Telegram/…, and C2C connections for cyberattacks. Zero-touch (ZT) techniques operate on elements received in supply chains from anywhere, connections with browsers/videos,…

(2) Dimension of total extreme compliance with standards, norms, minutes, regulations, etc. at all times (not every certain period of time). In this way, evaluation, analysis, auditing, monitoring, certification, and accreditation are carried out using standards such as the maturity level based on the Common Criteria/EAL Level 7 standard, standards such as ISO/IEC, NIST, IEEE, DORA (in Europe, the "Digital Operational Resilience Act," for the financial sector, insurers, investors, crypto assets, financial analysts, cloud services, etc.), HIPAA (in the USA, the "Health Insurance Portability and Accountability Act"), GDPR (in Europe/Spain, the "General Data Protection Regulation," under the Spanish Data Protection Agency), and LOPDGDD (in Spain, the "Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights," complemented by the Law). 41/2002-on-Patient-Autonomy); Law 14/2007-Biomedical research: rules for the use of samples-and-health-data-in-scientific-research and clinical trials. (3) Dimension of technical aspects. Privacy is completely intertwined with confidentiality (its mission is to prevent the disclosure/leakage of secrets, sensitive/personal information, etc.; it protects against eavesdropping, surveillance/observers/reconnaissance/stalkers…). To achieve this, CSPCR uses a multitude of techniques: various types of anonymizers/pseudonymizers/mimicry/encoding/multi-layer subliminal encryption (based on bits and qubits), subliminal technologies, transcribed transfer operations, secure multi-party encrypted communications/SMPC, Zero Trust/ZT, Zero Knowledge/ZK, etc. The STEMAI called “transcribed transfers” enables confidentiality/privacy because if entity A requests an item (file, folder, etc.) from storage entity B, it doesn't specify what it wants; it simply retrieves it, and furthermore, it cannot see the rest of the items. B stores. In SMPC (Secure-Secret Multi-Party Encrypted Computing) several parties interact with complete confidentiality to perform joint operations on data stored by multiple parties and the result remains secret.

STEMAI (Science, Technology, Engineering, Mathematical-Artificial-Intelligence) processes for human and non-human entities/subjects to sign on to devices (PCs, cloud edges, IT, OT/ICS, smartphones, PLCs/CPS, vehicles, satellites, weapons, systems, services…);

Figure 3 CSPCR

The Sign-On process consists of several stages:

(A) Identification Process, (consists of the entity/subject entering their username (or user-name explicitly/implicitly-someone/something-strongly-recognizes-it). Within identification we find many techniques, one of them endowed with confidentiality/privacy is ZK (Zero Knowledge) which consists of the entity/subject to be verified exchanging a series of messages with the entity in charge of identity verification and at the end of the process the verification entity will know the identity of the subject who was to be identified without revealing information in the exchanged messages.

(B) Single-factor authentication (SFA) or multi-factor authentication (MFA) process (this involves an entity/subject proving their identity through implicit or explicit identification). This proof may require a single factor or multiple factors. Two-factor authentication can consist of something the subject knows and a secret code received on their mobile device that they must enter. Single Sign-On (SSO) involves logging into system A by providing the authentication credentials, eliminating the need to log into any other interconnected systems. However, this procedure is not very secure. If a system shuts you down, or you accidentally shut it down, and the session doesn't close automatically, then logging back in should at least require authentication.

The five main factors of Authentication are:

(i) Something that the entity/subject knows, such as a password (high entropy; a long string of numbers, lowercase letters, uppercase letters, and special characters, for example 12, 18… characters) or solving riddles, questions, problems, puzzles, specifying the secret value of the intersection of the coordinates received from the authenticating entity if the subject has a table of numbers (Battleship) 2D/3D/4D, …

(ii) Something that the entity/subject is like, such as physiological or behavioral biometrics. Behavioral biometrics refers to how an entity/person/subject walks, speaks, signs, writes (graphology), their gestures, facial expressions/tics, reflex movements, etc. (it is not very secure since the subject can be trained to imitate another). Physiological biometrics (which is more secure) refers to physiological-genetic aspects of a subject such as fingerprints, retina, iris, DNA, genetic map, vein structure, volume/structure/shape of the hands, etc.

(iii) Something that the entity/subject has and runs in the form of an APP. Such as a smart card/a ring/a mobile phone/a watch/an implant/a tattoo/running an APP/API.

(iv) The geographical location or GPS/Galileo/Glonass/BeiDou geolocation coordinates where the entity/subject to be authenticated is actually located.

(v) The instant of time: year, month, day, hour, minute, second, tenth/hundredth/thousandth-of-a-second… in which the entity/subject is authenticated.

Figure 4 CSPCR

(C) Access management/control/governance process.

It consists of controlling/managing, using access control matrices/tables, the operations that each entity can perform on each object to which it has access rights, such as: execute/read/write/delete/geolocate/locate, etc. Likewise, it continuously monitors/tracks/observes/analyzes/explores all objects/subjects (real/authorized and latent/illegal), wherever they may be; and completely eliminates unauthorized/illegal ones (all subjects/objects are monitored for attempts at malicious/perverse actions; if any are found, they are completely eliminated/deactivated. Similarly, based on the principle of "non-repudiation," those who attempt to deny having done something are eliminated). In this way, the access control matrix is ​​constructed with all identified/authorized objects and subjects. An access control matrix/table lists subjects/entities horizontally and objects they can interact with vertically. At the intersection of rows and columns are placed the operations each subject can perform on each object, such as read, write, execute, delete, create folders, workflows, etc. Access Control Lists (ACLs) are built from the columns of the access control matrix; that is, they specify the operations each subject can perform on all objects they have permission to access. Capability Lists (CLs) are built from the rows of the access control matrix; that is, they specify which operations each object can perform, for example, read, write, execute, etc., on all subjects with access.

(D) Non-Repudiation Process. This consists of preventing any entity/person/subject from denying something they have done (operation/action/activity/omission,…) such as executing, deleting, writing, reading, being in a specific geographical location, …

(E) Availability Process (cyber resilience, tolerance to cyberattacks/failures). This consists of preventing an entity/subject/system/service/application from being blocked/saturated/disabled/unavailable due to any type of cyber incident/cyberattack, such as the mass sending of requests, data, or information to a server, website, email, mobile device, cloud/edge or next-gen cloud, application, vehicle, etc., and rendering it inoperative using Denial-of-Service (DoS) cyberattacks. Availability integrates a large set of cyber resilience elements that prevent any type of denial-of-service attempt against a system/entity. For example, if an adversary deletes folders/files/applications/apps/hard drives, blocks processors/I/O units, etc. With this information, availability will utilize encrypted/steganographic backup mechanisms located in various geographical locations, some very far from where the cyberattacked system is located. If a system/data center loses its power supply due to a blackout, availability will use multiple backup mechanisms such as generators, UPSs (Uninterruptible Power Supply), DC batteries, (DC batteries) + AC inverters, etc., which switch automatically/very quickly and do not interrupt (even for an instant) its power supply. If a system is cyberattacked by ransomware and its files are protected using confidentiality/privacy measures (such as encryption, steganography, anonymity, mimicry, sublimation-based STEMAI, etc.), the attacker can steal and delete them. However, this is irrelevant because the attacker will not understand the ransomware and will automatically disable it, recovering all the hard drives. The problem with backup storage locations, such as cloud services, is that they must be protected. If backups are delegated to companies with unprotected clouds and a cyberattack occurs, the system will be unable to recover the contents of its hard drives. If an organization needs to use access channels and an adversary blocks or damages them with cyberattacks, availability will be addressed by using additional backup channels, including unknown, subliminal channels. If geolocation satellites are shot down, the availability solution is to have unknown, invisible backup satellites. If hardware, firmware, apps/APIs, operating systems, AI, memory, etc., are cyberattacked, availability/cyber resilience will have anonymous/hidden/camouflaged backups, and everything will continue as if nothing had happened. If a set of sensors in a sensor system is disabled, availability will have other hidden backup sensors.

(F) Integrity Process. This process detects whether any software product, firmware, data/metadata, intelligence information, apps/APIs, hardware, etc., has been maliciously modified, changed, or manipulated (at any point, including along the supply chain from manufacturer/producer to consumer, by maliciously contaminating, modifying, or manipulating hardware/software). For software/firmware/data/metadata/information/apps/APIs, error detection and correction codes such as CRC-8192 or better, sophisticated hash functions, and digital signatures are used. For detecting malicious modifications to hardware products, PUF hardware functions are used (this would allow, for example, determining whether a surveillance camera, PLC, computer, chip, etc., has been maliciously modified or manipulated). CSPCR addresses vulnerabilities with automatic code correction, software/firmware composition analysis, and for all proactive remediation processes uses certified sovereign AI agents.

Figure 5 CSPCR

FINAL ASPECTS.

Cybersecurity, Privacy, and CyberResilience are three distinct pieces/entities/sources that, when fused in perfect harmony, give rise to a single, indivisible, true reality called CSPCR (multidimensional/multilayered proactive offensive/defensive protection superstructure with in-depth architecture, maximum maturity, continuous monitoring/analysis/traceability/audit/verification/certification-accreditation… of all its STEMAI elements/components with replicated/global/verified/tested/certified sovereign super-AI (ISO42001, NIST-IR-8596, ISO27701:2025, ISO-IEC-27001/27002…) continuously).

REFERENCES.

  • Areitio, J. “Information Security: Networks, Computing and Information Systems”. Cengage Learning-Paraninfo. 2025.
    - Areitio, J. “Synthesis of NG-CR based on AI with extreme factorization-anticipation in all its dimensions/operations/functions”. Revista-Conectronica. No. 267-June-July-2025.
    - Czarny, B. “Cybersecurity-Upside-Down: Rethink Your Cybersecurity Strategy”. Ed. OPSWAT. 2026.
    - Bayuk, JL, Ehuan, A., Healey, J., Rohmeyer, P., Sachs, MH et al. “Cybersecurity Policy Guidebook”. Wiley. 2026.
    - Tiepolo, G. & Sorensen, D. “Advanced Cyber-Threat-Intelligence and Hunting: Detect APTs and Zero-Day-Attacks using CTI, Behavioral Analytics, and AI Techniques.”Ed.Packt-Pub.2026.
    - Azrour,M.&Alabdulatif.A.“AI-Driven-Security for Next-Generation-IoT-Systems”. Ed.Springer.2026.
    - Thakur,K.&Pathan,AS.K.“Transforming Cybersecurity with Machine-Learning”.Ed.CRC-Press.2026.

Author: Prof. Dr. Javier Areitio Bertolín – Director of the Networks and Systems Research Group.