{ "vercy": "1.0-draft", "publication": { "status": "research-draft", "adjudicationStatus": "unreviewed", "publishableCanonical": false, "generatedAt": "2026-09-11T19:59:16Z", "providers": [ "Claude" ], "breadth": "written by Claude from model knowledge without web access - no source was read, every claim is a lead to verify", "pass": 2, "wave": 2, "engine": "claude", "enrichment": { "pass": 3, "engine": "claude", "producedAt": "2026-10-05T19:00:00Z", "ingestedAt": "2026-10-05T20:48:41+00:00", "fields": [ "agent_conduct", "ethics", "owners" ] }, "gate": { "passed": true, "version": "1.0", "at": "2026-10-06T19:51:59+00:00", "evidence": [ "completeness 1.00", "sense: Wikidata description", "2 live sources", "review by codex: pass" ] } }, "metaModel": { "id": "THING-Q3510521", "registryId": "vr.tr.computer-security", "name": "computer security", "version": "0.2.0-wave.2", "entryKind": "thing", "family": "Thing Registry", "domain": [ "XCT.STA" ], "status": "research-draft" }, "canonicalUrl": "https://ver.cy/models/thing/q3510521/", "model": { "registry_id": "vr.tr.computer-security", "name": "computer security", "purpose": "Let an agent explain computer security concepts and practices, help people and organisations protect systems and respond to incidents, explain standards and law, and decline requests to attack or compromise systems without authorisation.", "definition": "The protection of computer systems, networks, software and data from unauthorised access, damage, disruption and theft, through practices such as access control, encryption, patching, monitoring, secure design and user education, and disciplines including hardware security, internet safety and cyber resilience; it is governed by standards and law and practised defensively by organisations and individuals.", "what_it_is_for": "Protecting systems and data.", "affordances": [ "explain threats and defences", "give practical security guidance", "support incident response and reporting", "explain standards and legal obligations" ], "distinguishing_features": [ "Protects confidentiality, integrity and availability", "Technical and human measures", "Standards-based", "Legally regulated" ], "appearance": "Not physical; practices, controls and policies.", "visual_identification": [ "Defensive measures and controls", "Standards and audits", "Attacking systems without authorisation is a crime, not security" ], "physical_properties": [], "families_and_kinds": [ "network and internet security", "application and software security", "hardware security", "identity and access management", "cyber resilience and incident response" ], "related_models": [ { "relation": "is a kind of", "target": "information security", "why": "category" }, { "relation": "is a kind of", "target": "security", "why": "category" }, { "relation": "protects", "target": "integrated circuit", "why": "hardware" }, { "relation": "is related to", "target": "electronics", "why": "systems protected" } ], "identifiers": [], "standards_and_regulation": [ "ISO/IEC 27001 and NIST Cybersecurity Framework", "Data protection and breach notification laws", "Computer misuse and cybercrime laws" ], "failure_modes_and_hazards": [ "Breaches and data loss", "Facilitating attacks", "Security theatre without real protection" ], "in_scope": [], "out_of_scope": [], "characteristics": [], "agent_conduct": { "may": [ "Monitor, patch and harden systems the agent is authorized to administer.", "Explain security practices and report vulnerabilities to the owner of the affected system." ], "must_not": [ "Access, scan or test systems without the owner's authorization.", "Assist in creating malware, exploits or attacks against systems it is not authorized to test.", "Disable logging, monitoring or security controls to hide activity.", "Disclose vulnerabilities publicly before the owner has had a fair chance to fix them." ], "requires_human": [ "Shutting down or isolating production systems during an incident.", "Authorizing a penetration test or disclosing a vulnerability." ] }, "ethics": { "considerations": [ "Breaches expose personal data and can stop hospitals, utilities and services.", "Security monitoring can itself intrude on staff and users' privacy." ], "affected_parties": [ "Users whose data is held", "Organizations and their staff", "People relying on critical services" ] }, "owners": { "steward": "The owner or operator of each system; security teams and regulators oversee it.", "master_systems": [ "Vulnerability databases" ] } }, "sources": [ { "id": "wikidata", "title": "Wikidata item Q3510521: computer security", "url": "https://www.wikidata.org/wiki/Q3510521", "url_status": "live", "what_it_supports": "identity and sense of the item", "checked_by": "wikidata-api" }, { "id": "wikipedia-en", "title": "Wikipedia: Computer security", "url": "https://en.wikipedia.org/wiki/Computer_security", "url_status": "live", "what_it_supports": "general description of the item", "checked_by": "wikidata-api sitelink" } ], "structure": { "bundles": [ { "id": "limits", "name": "Limits", "description": "Agent conduct.", "rationale": "Defensive only.", "layers": [ { "id": "authorisation", "name": "Authorisation", "description": "Authorised work.", "findings": [ { "id": "authorisation-finding", "name": "Authorisation", "description": "Authorisation.", "questions": [ { "text": "Is the request defensive, or does it seek to attack, access or disrupt systems without clear authorisation?", "kind": "boundary" }, { "text": "How should the agent decline unauthorised requests and support lawful security work?", "kind": "action" } ] } ] }, { "id": "incident", "name": "Incident", "description": "Active incidents.", "findings": [ { "id": "incident-finding", "name": "Incident", "description": "Incidents.", "questions": [ { "text": "Is a breach or attack under way?", "kind": "boundary" }, { "text": "Which immediate containment steps and reporting duties apply?", "kind": "action" } ] } ] } ] }, { "id": "protect", "name": "Protect", "description": "Practical security.", "rationale": "Basics first.", "layers": [ { "id": "individuals", "name": "Individuals", "description": "Personal security.", "findings": [ { "id": "individuals-finding", "name": "Individuals", "description": "Personal security.", "questions": [ { "text": "Which measures protect a person, such as strong authentication, updates and phishing awareness?", "kind": "provenance" }, { "text": "How can accounts be secured after compromise?", "kind": "action" } ] } ] }, { "id": "organisations", "name": "Organisations", "description": "Organisational security.", "findings": [ { "id": "organisations-finding", "name": "Organisations", "description": "Organisational security.", "questions": [ { "text": "Which controls and frameworks should an organisation of this size adopt?", "kind": "provenance" }, { "text": "How are risks assessed?", "kind": "action" } ] } ] } ] }, { "id": "threats", "name": "Threats", "description": "Understanding threats.", "rationale": "Know the risks.", "layers": [ { "id": "types", "name": "Types", "description": "Threat types.", "findings": [ { "id": "types-finding", "name": "Types", "description": "Threats.", "questions": [ { "text": "What are the main threat types, such as malware, phishing and ransomware, and how do defences address them?", "kind": "definition" }, { "text": "Which current advisories are relevant?", "kind": "provenance" } ] } ] }, { "id": "hardware", "name": "Hardware", "description": "Hardware and supply chain.", "findings": [ { "id": "hardware-finding", "name": "Hardware", "description": "Hardware security.", "questions": [ { "text": "What is hardware security, and why do supply chains matter?", "kind": "definition" }, { "text": "Which standards apply?", "kind": "provenance" } ] } ] } ] }, { "id": "govern", "name": "Govern", "description": "Standards and law.", "rationale": "Compliance.", "layers": [ { "id": "standards", "name": "Standards", "description": "Frameworks.", "findings": [ { "id": "standards-finding", "name": "Standards", "description": "Frameworks.", "questions": [ { "text": "Which security standards and certifications apply, and what do they require?", "kind": "provenance" }, { "text": "How is compliance audited?", "kind": "provenance" } ] } ] }, { "id": "law", "name": "Law", "description": "Legal duties.", "findings": [ { "id": "law-finding", "name": "Law", "description": "Legal duties.", "questions": [ { "text": "Which breach notification, data protection and cybercrime laws apply here?", "kind": "provenance" }, { "text": "Where can incidents be reported?", "kind": "provenance" } ] } ] } ] } ] }, "openQuestions": [ "Should each subfield be a separate entry?", "How should advisories be linked?", "How should legal obligations be localised?" ], "statistics": { "bundles": 4, "layers": 8, "findings": 8, "questions": 16 } }