How is AI governed in Cyber Crucible's development lifecycle?
Short answer: Because Cyber Crucible's Genetic AI is used only at design time, it is governed under the secure development lifecycle (SDLC) rather than as a live production system. The discovery work happens in a controlled internal environment, its output is validated and translated into deterministic kernel heuristics, and the resulting drivers are independently signed under Microsoft WHCP before release.
The governed lifecycle
| Phase | Governance |
|---|---|
| Design | Security requirements set; AI discovery is part of the design phase, under the SDLC |
| Discovery | Genetic AI identifies deterministic attack-indicating variables using internal research datasets only |
| Derivation | Findings become fixed, deterministic kernel heuristics — no live model is deployed |
| Validation | Deterministic outcomes are repeatable and testable; models and drivers validated through QA |
| Release | Windows drivers WHCP-signed; changes follow formal change management |
Data and integrity
No customer content, credentials, or keys are used to train, feed, or tune a model. Models are proprietary and built in-house, with no third-party model dependency. Model integrity is maintained through version control, SDLC/QA validation, and WHCP signing; confidentiality through a controlled development environment.