Demand-Driven Vulnerability Detection for Cloud Security Posture Management: Removing Human Rule Authoring from the Disclosure-to-Protection Critical Path

A tenant-local, continuously derived rule set that eliminates vendor release cadence from the CVE disclosure-to-protection window

Prashant Kumar Pathak· 2026· DOI 10.48550/arXiv.2606.07957

The core problem

Cloud Security Posture Management (CSPM) systems detect known vulnerabilities through a three-stage pipeline: maintain a rule set, distribute it to customers, and evaluate it against periodically collected asset inventories. In publicly documented architectures, the rule set is environment-agnostic and curated centrally by the vendor. Updates are batched into release cycles and shipped on a cadence ranging from hours to days depending on detection severity. The paper identifies the resulting latency as the central problem. The **disclosure-to-protection window** is defined as the interval from a CVE being published to the customer's system being capable of detecting affected assets. For version-match detections, this window is bounded by the vendor's release cadence. For richer detections that incorporate configuration predicates beyond the affected-software string, the window is extended by additional human authoring time. The proposed architecture inverts the distribution model: the rule set is not vendor-distributed but continuously derived within the customer's tenant from the intersection of public catalogue feeds and the live asset graph. A rule comes into existence when a

Innovation

The paper reports architectural and analytical results rather than measured production outcomes. The principal results are: - **Latency consequence.** The disclosure-to-protection window is no longer bounded by vendor release cadence for version-match detections, nor by human authoring time for configuration-predicate detections. A rule can come into existence as soon as a catalogue entry and an applicable asset are simultaneously present. - **Bidirectional triggering.** Both new catalogue entries and new assets trigger derivation, so protection tracks both disclosure events and environment change. - **Full structured-field incorporation.** Derivation uses the full structured-field content of catalogue entries, not only the affected-software predicate, enabling richer detections without additional human authoring. - **Bounded rule set.** The live rule set is bounded by environment diversity rather than catalogue breadth, which constrains resource consumption independent of catalogue growth. - **Equivalence.** The formal semantics support an equivalence theorem relating the derived rule set to the baseline authored rule set. - **Complexity characterization.** The complexity analysi

Cloud Security Posture Management (CSPM) systems detect known vulnerabilities through a three-stage pipeline: maintain a rule set, distribute it to customers, and evaluate it against periodically collected asset inventories. In publicly documented architectures, the rule set is environment-agnostic and curated centrally by the vendor. Updates are batched into release cycles and shipped on a cadence ranging from hours to days depending on detection severity.

The paper identifies the resulting latency as the central problem. The **disclosure-to-protection window** is defined as the interval from a CVE being published to the customer's system being capable of detecting affected assets. For version-match detections, this window is bounded by the vendor's release cadence. For richer detections that incorporate configuration predicates beyond the affected-software string, the window is extended by additional human authoring time.

Why it matters

The analysis centers on the architectural inversion: moving from a vendor-distributed, environment-agnostic rule set to a tenant-local, continuously derived rule set. This shift changes the unit of incrementality. Prior systems incrementally evaluate a static rule set; the proposed system incrementally derives the rule set itself. The practical consequence is that the disclosure-to-protection critical path no longer includes human rule authoring or release batching. The discussion frames the live rule set as an emergent property of the intersection between public catalogue feeds and the live asset graph. This has several implications: - **Environment-relative coverage.** Coverage is determined by what the tenant actually runs, not by what the vendor chooses to author. The live rule set is bounded by environment diversity rather than catalogue breadth. - **Lifecycle symmetry.** Rules appear and disappear with their supporting inputs, so the rule set remains synchronized with both disclosure state and asset state. - **Resource profile.** Continuous derivation trades batch release cycles for ongoing computation within the tenant, with complexity characterized in the paper. The paper is explicit about scope boundaries. Rule correctness and alert prioritization are out of scope, so the contribution is positioned as the architectural shift and its latency and resource consequences. The evaluation methodology is presented as a plan, and the equivalence theorem provides the formal bridge between the derived rule set and the baseline authored rule set. The overall claim is that removing human rule authoring from the disclosure-to-protection critical path is achievable through tenant-local, demand-driven derivation.

Who should read this

CS practitioners and researchers

Opening member content…