Adaptive zero trust response balances security and system continuity
Zero Trust-Enabled Adaptive Incident Response using Hierarchical Reinforcement Learning
Cryptography and Security
Summary
Modern companies face fast and smart cyber attackers that exploit trusted access within their systems. The authors designed a system called ZT-AIR that learns how to quickly decide what security actions to take without disrupting normal operations. It uses a layered learning approach to separate planning from action and adapts its responses based on context. Tests show it manages to keep systems safe while avoiding unnecessary interruptions.
What this means in practice
- •For security operation teams: Implement zero trust-based automated incident response strategies that adapt dynamically to evolving cyber threats while minimizing disruption to business processes.
- •For cloud infrastructure engineers: Integrate adaptive reinforcement learning-driven trust decisions in cloud environments to enhance security monitoring and response for complex network scales.
Authors
Jisoo Lee, Bhagath Singh Bondili, Harshith Doppalapudi, Gwynith Godin, Nathaniel D. Bastian, Ankit Shah
Abstract
Modern enterprises increasingly operate through complex information systems (IS) enabled by cloud computing, remote and hybrid work practices, and digitally integrated supply chains. These structural shifts have expanded organizational attack surfaces and weakened traditional perimeter-based trust assumptions, giving rise to new and persistent forms of cyber threats. In response, adversaries have shifted toward identity-centric, trust-based intrusion techniques that exploit legitimate access within organizational systems. This evolution has created a pronounced speed asymmetry, whereby attackers can adapt and act at machine speed while defenders remain constrained by reactive or rule-based incident response (IR) processes. Drawing on design science research, we propose ZT-AIR, an adaptive IR artifact that uses zero trust architecture as its design theory and hierarchical reinforcement learning as its kernel theory. ZT-AIR learns context-aware trust decisions, separates strategic prioritization from tactical execution, encodes zero-trust controls as actions, and jointly optimizes security effectiveness and operational continuity. Experimental results across diverse adversarial strategies, network scales, and defense environments show that ZT-AIR achieves a strong balance between security and continuity through frequent, minimally disruptive interventions. Practitioner validation further confirms the design's practical viability. This study contributes to IS research by extending computational design science from threat identification to response execution, theorizing zero trust architecture for adaptive IR, and deriving reusable design principles for adaptive decision support artifacts.