Experimental Model for Validating the Effectiveness of Security Controls in Enterprise Environments

📄 Published in: Advances in IT and Electrical Engineering (2026)
👤 Author: Olek Danczewski
🏛 Affiliation: Rzeszów University of Technology
🔗 DOI: https://doi.org/10.7862/ra.2026.3
📥 Original publication: https://journals.prz.edu.pl/aitee/article/view/2329

Published in Advances in IT and Electrical Engineering (2026)

📄 Original publication (DOI): https://doi.org/10.7862/ra.2026.3

Abstract

Modern enterprise environments are characterized by increasing technological complexity, including hybrid infrastructures, cloud computing, remote work models and extensive supply-chain dependencies. At the same time, the cyber threat landscape evolves dynamically, making it insufficient to assess security solely through formal compliance with security frameworks. Organizations increasingly require verifiable methods to determine whether implemented security controls are effective in real operational conditions.

This paper introduces the Unified Security Validation Model (USVM), a structured approach for experimental validation of security controls in enterprise environments. The model shifts the focus from declarative compliance toward empirical verification of resilience through controlled attack emulation, telemetry analysis and measurement of detection and response capabilities. USVM formalizes a validation experiment as a set of interconnected components including attack scenarios, security controls, device trust attributes, telemetry sources, detection mechanisms, response capabilities and effectiveness metrics. Security effectiveness is evaluated across prevention, observability, detection and response dimensions, enabling comparative assessment under different trust configurations.

A key element of the model is the inclusion of device trust level, including hardware-rooted trust mechanisms such as TPM and Secure Boot, as an experimental variable influencing the effectiveness of security controls and detection mechanisms within realistic attack scenarios. The proposed model provides a unified framework for evidence-based validation of cybersecurity controls under operational conditions.

Keywords: cybersecurity validation, security controls effectiveness, attack emulation, device trust, enterprise security

Introduction

Modern enterprise environments are characterized by increasing complexity, including hybrid infrastructures, cloud computing, remote work models, extensive outsourcing and supply-chain dependencies, as well as a rapidly evolving threat landscape. Cross-sectional analyses presented in ENISA reports [enisa2024; microsoft2025; verizon2024] indicate that threats and attack techniques evolve in close relation to geopolitical and economic contexts, while cybersecurity incidents directly impact business continuity and organizational reputation. From the organizational perspective, this implies that merely implementing security controls does not guarantee their effectiveness in conditions of constantly changing attack techniques and evolving system configurations.

An important challenge therefore becomes verifiable visibility: the ability to observe the behavior of systems and networks in such a way that events recorded in telemetry can be reliably correlated with hypotheses about the progression of an attack. NIST guidelines in the area of Information Security Continuous Monitoring (ISCM) emphasize that monitoring programs should ensure visibility of assets, awareness of threats and vulnerabilities, and insight into the effectiveness of implemented security controls. This perspective shifts attention toward measurement and operational validation rather than solely formal compliance [nist800137].

At the same time, regulatory pressure further strengthens the need to assess the effectiveness of cybersecurity measures. The NIS2 Directive establishes obligations related to cybersecurity risk management and incident reporting, and explicitly highlights the requirement for policies and procedures that evaluate the effectiveness of implemented risk management measures [nis2]. Consequently, the importance of methods that can repeatedly and audibly demonstrate whether security controls actually work in practice, rather than merely confirming their implementation, continues to grow.

This paper introduces the Unified Security Validation Model (USVM) as a proposed unified approach to the experimental validation of security controls in enterprise environments. The model shifts the focus of evaluation from declarative compliance toward empirical verification of resilience through attack emulation, telemetry analysis and the measurement of detection and response capabilities, while considering device trust level as an experimental variable.

The remainder of the paper is organized as follows. Section 2 reviews related work on cybersecurity control validation and detection effectiveness in enterprise environments. Section 3 introduces the proposed USVM model. Section 4 describes the experimental design and validation methodology. Section 5 discusses the results and their implications. Finally, Section 6 concludes the paper.

2. Review of Approaches and Research Gap

This section reviews existing approaches related to the validation of cybersecurity controls and detection capabilities in enterprise environments. It also identifies the key research gap that motivates the development of the Unified Security Validation Model (USVM) presented in this work.

Review of Approaches and Research Gap

In industrial practice and academic literature, a wide range of partial approaches exist that support selected elements of security validation, including security testing and assessment, control evaluations, adversary emulation, monitoring programs, and approaches integrating telemetry with response mechanisms [zhang2020; pecarina2021; mitre_attack; mitre_caldera; mitre_evals; nist800115; nist80053a]. NIST indicates that technical security testing and evaluation should include test planning, execution of technical examinations, analysis of findings, and the design of mitigation measures, which together provide an important methodological foundation for an experimental approach. At the same time, NIST explicitly emphasizes that control assessments should not be reduced to checklists or “paper compliance”, but should verify whether selected controls are implemented and achieve their intended objectives.

In the area of adversary emulation and detection validation, the MITRE ATT&CK knowledge base (tactics, techniques, and procedures) plays a significant role by providing a common language for describing attacker behavior and supporting the design of test scenarios as well as the mapping of detection and mitigation mechanisms [mitre_attack]. Platforms such as MITRE Caldera are designed as adversary emulation frameworks that support repeatable breach-and-attack simulation exercises, while testing libraries (e.g., Atomic Red Team) enable rapid, portable, and repeatable execution of techniques mapped to ATT&CK [mitre_caldera]. Furthermore, the MITRE Engenuity ATT&CK Evaluations demonstrate in practice that detection quality is multidimensional, encompassing not only the detection itself but also classification and operationally useful context [mitre_evals].

At the same time, security architectures such as Zero Trust provide design principles that shift the focus from traditional network perimeters toward users, resources, and policy enforcement. NIST describes Zero Trust Architecture (ZTA) as an approach to planning infrastructure and workflows according to the principle of “never trust, always verify” [nist800207]. However, ZTA itself does not constitute a method for experimentally measuring end-to-end effectiveness; rather, it provides an architectural framework that requires complementary validation procedures and metrics grounded in telemetry and attack scenarios.

In the area of detection and response, the industry is moving from siloed security tools toward approaches that integrate telemetry across multiple domains. In analytical definitions, Extended Detection and Response (XDR) is described as a technology or approach that provides built-in integration of multiple security telemetry sources combined with analytics and response [xdr]. Recommendations related to logging and detection emphasize the need to establish logging policies, centralize log collection and correlation, and protect log integrity, particularly in the context of “living off the land” techniques [cisa_logging].

Against this background, the area of hardware trust becomes particularly significant. NIST describes firmware and platform components as critical elements for secure system startup and operation. Guidelines on firmware resilience (SP 800-193) focus on mechanisms for protection, compromise detection, and secure recovery following attacks on the platform layer. Specifications of TPM 2.0 published by the Trusted Computing Group indicate that the Trusted Platform Module provides a set of cryptographic functions and trust mechanisms used as a foundation for platform security [tpm]. Similarly, Secure Boot in the UEFI framework represents a mechanism for enforcing trust policies during the boot process, reducing the risk of executing unauthorized components during the pre-boot phase.

The research gap emerges in the integration of these areas. Existing approaches typically:

• Focus on a single layer (e.g., attack technique testing, control assessment, telemetry analysis),

• Do not treat device trust level as an experimental variable influencing the effectiveness of preventive and detection-response controls, and

• Do not provide a unified measurement axis linking: attack scenario $\rightarrow$ control behavior $\rightarrow$ observability in telemetry $\rightarrow$ detection quality $\rightarrow$ response effectiveness (time and outcome).

2.1 Limitations and Research Gap

Despite the existence of the approaches described above, three fundamental limitations can be observed:

Layer fragmentation – attack testing, control assessments, telemetry analysis, and response activities are often conducted independently.

Lack of formal treatment of device trust level as an experimental variable.

Absence of a coherent measurement axis linking the attack scenario, control behavior, observability in telemetry, and the quality of detection and response.

The research gap therefore, lies in the absence of a unified model for the experimental validation of security control effectiveness that integrates the attack layer, security controls, device trust, telemetry, as well as detection and response within a single measurement framework.

To address this gap, the present work makes the following contributions:

• Formalization of a unified validation experiment integrating attack scenarios, security controls, device trust attributes, telemetry, detection, response, and effectiveness metrics;

• Introduction of device trust level as an explicit experimental variable influencing security control and detection effectiveness;

• Definition of a measurement framework covering prevention, observability, detection, and response dimensions;

• Proposal of an aggregated USVM Score enabling comparative evaluation of security effectiveness across different trust configurations.

3. Experimental Model for Validating the Effectiveness of Security Controls (USVM)

The proposed model, referred to as the Unified Security Validation Model (USVM), is motivated by the need to bridge the gap between theoretical security control coverage and their empirically observable effectiveness in real-world environments. While existing approaches such as the NIST framework for security control assessment emphasize verifying whether controls achieve their intended objectives [nist80053a; nist80055], and adversary-centric models such as MITRE ATT&CK provide structured representations of attack techniques [mitre_attack], there remains a lack of integrated methodologies that enable systematic validation of control effectiveness under realistic operational conditions.

The USVM model is derived from a synthesis of practical observations gathered from security operations, incident response activities, and monitoring practices across multiple enterprise environments, including both on-premises and cloud-based infrastructures. These observations are consistent with findings reported in the literature, which indicate that measuring security control effectiveness remains a complex and insufficiently standardized problem [zhang2020; pecarina2021]. In particular, the effectiveness of controls is influenced by factors such as telemetry quality, visibility, and detection capabilities, as emphasized in guidance related to continuous monitoring and logging practices [nist800137; cisa_logging].

In practice, security controls are often evaluated in terms of declarative coverage (i.e., mapping controls to attack techniques), while insufficient attention is given to how these controls perform under realistic attack scenarios and operational constraints. This limitation is also reflected in adversary emulation and evaluation approaches [mitre_evals].

The main contribution of this work is the formalization of a layered validation model that integrates adversary behavior, system trust properties, and telemetry-driven detection, and provides a structured basis for measuring security control effectiveness across prevention, detection, response, and observability dimensions.

Following this motivation, USVM is defined as a layered model in which organizational resilience is understood as a property resulting from the interaction of attack techniques, security mechanisms, device trust attributes, telemetry quality, and detection and response capabilities. The model aligns with the NIST approach, according to which security assessment should verify whether controls achieve their intended objectives, while monitoring programs should provide visibility into the effectiveness of those controls.

In the formalization of USVM, a validation experiment is defined as a tuple(E=(S,D,T,C,L,X,R,M)$,where

$S$ – the attack scenario described as a sequence of techniques $t_1,\ldots,t_n$ mapped to ATT&CK (or another attack technique classification),

$D$ – the set of assets/devices (endpoints, servers, identity elements, cloud components) included in the experiment,

$T$ – the device trust level function $T(d)$ (e.g., categories such as TPM 2.0 present/absent, Secure Boot enabled/disabled, managed/unmanaged device),

$C$ – the set of security mechanisms (preventive and detective controls, hardening measures, access policies) whose behavior is to be validated,

$L$ – the telemetry layer (sources of logs, security events, and system metrics) together with the data collection and retention policy,

$X$ – the detection and correlation layer (e.g., XDR-type approaches integrating telemetry and analytics),

$R$ – response mechanisms (procedures, automations, isolation/whitelisting/rollback actions) embedded in the incident response cycle,

$M$ – a set of metrics enabling the calculation of effectiveness in the dimensions of prevention, detection, response, and observability.

Within the model, these layers are interconnected through dependencies. For example, a change in $T(d)$ (e.g., disabling Secure Boot or the absence of TPM) modifies the probability of success for certain techniques and mitigations in $C$, influences the artifacts generated in $L$, and consequently affects the quality of detection in $X$ as well as the time and outcome of response in $R$. NIST emphasizes that attacks targeting firmware and the platform layer may be highly destructive and therefore require mechanisms for protection, detection, and recovery. This justifies treating the platform trust layer as a significant experimental variable in validation experiments rather than merely a technological background [secureboot].

A key property of USVM is the separation of two concepts that are often conflated in practice:

• Coverage understood as the declarative mapping of a control to an attack technique, and

• Effectiveness understood as the empirically demonstrated outcome of an experiment, measured through metrics and observable in telemetry.

This distinction is consistent with the NIST approach to control assessment, which emphasizes verification of whether security objectives are actually achieved rather than merely documenting formal compliance.

4. ## 3.1 USVM Model Description

The following subsection provides a structured interpretation of the USVM model, summarizing its assumptions and layered structure from an operational perspective.

The USVM model is based on a set of assumptions and a layered structure that together define a unified approach to the experimental validation of security control effectiveness.

The model assumes that the effectiveness of security controls should be validated within realistic attack scenarios, as static or compliance-based approaches do not adequately capture adversarial behavior. To ensure methodological rigor, validation is designed to be repeatable and based on controlled experiments, enabling consistent comparison of results across different configurations. A key aspect of the model is the treatment of device trust level as an experimental variable influencing the effectiveness of security controls. This reflects the observation that security mechanisms may behave differently depending on the integrity and trustworthiness of the underlying platform. Furthermore, telemetry is considered a necessary condition for reliable measurement, as it provides observable evidence of system behavior and forms the basis for detection and analysis. Finally, detection and response are evaluated in operational terms, taking into account both the time required to react and the outcome of defensive actions.

Structurally, the USVM model organizes the validation process into a sequence of interconnected layers, ranging from the attack scenario to the measurement of effectiveness. The model distinguishes five main layers: the attack scenario layer, the security controls layer, the device trust layer, the telemetry and observability layer, and the detection and response layer.

Attack scenarios are defined as sequences of techniques mapped to MITRE ATT&CK (e.g., initial access, execution, persistence, credential access, lateral movement, and impact). Adversary emulation enables the generation of controlled ground truth, which serves as a reference point for measuring the effectiveness of security controls and detection mechanisms.

These layers are connected through causal and measurement relationships. An attack scenario triggers specific adversary techniques that interact with security controls and the device trust state. As a result of these interactions, system telemetry is generated, which serves as the basis for data processing, detection mechanisms and event correlation. This process ultimately leads to an operational response whose effectiveness can be evaluated using appropriate metrics.

The relationships between layers imply that changes in one layer may influence the behavior of subsequent layers as well as the outcomes of security measurements. For example, a change in the device trust level (e.g., absence of TPM or disabled Secure Boot) may affect the effectiveness of preventive controls, the artifacts generated in telemetry, the quality of detection, and the time and outcome of the operational response.

The model distinguishes between the concept of coverage, understood as the declarative mapping of a security mechanism to an attack technique and effectiveness, understood as the empirical result observed during a controlled experiment. This distinction is consistent with the NIST approach to control assessment as a mechanism for verifying whether security objectives are actually achieved, rather than merely documenting compliance.

Unified Security Validation Model (USVM): layered structure and measurement flow.

Unified Security Validation Model (USVM): layered structure and measurement flow.

The USVM model scheme is presented in Figure 1. The diagram illustrates the end-to-end flow of the security validation process, linking attack scenarios, control behavior, device trust, telemetry, detection and response within a unified measurement perspective.

5. Methodology and Metrics for Experimental Evaluation

The USVM methodology is based on principles of security test design and technical assessments, in which the test scenario is defined in advance, the environment is controlled, and results are recorded and analyzed in a repeatable manner. NIST provides practical frameworks for planning and conducting security assessments, which serve as a reference point for operationalizing USVM experiments (test planning, scope definition, techniques, analysis, and recommendations).

Within USVM, experiments should be designed as comparisons of variants differing in a controlled variable (or a set of variables). In particular, device trust level is treated as a primary variable: results of scenarios $S$ are compared for different classes of $T(d)$, for example:

(A) managed devices with TPM 2.0 and Secure Boot enabled,

(B) managed devices without a complete root of trust,

(C) unmanaged devices.

The rationale for this approach derives from the role of TPM as a foundation for platform trust functions and the role of Secure Boot in enforcing boot policy, as well as from recommendations regarding firmware and platform resilience against destructive attacks.

The attack scenario layer should be mapped to adversary techniques structured within the ATT&CK framework, which facilitates replication and comparability (e.g., selecting chains of techniques representing typical attacker objectives:

initial access $\rightarrow$ execution $\rightarrow$ persistence $\rightarrow$ credential access $\rightarrow$ lateral movement $\rightarrow$ exfiltration / impact

Implementation of the scenarios may use adversary emulation platforms (e.g., Caldera) and atomic testing libraries (Atomic Red Team), which are explicitly designed for rapid and repeatable testing of environments against techniques mapped to ATT&CK.

Telemetry and measurement constitute a necessary condition for the experiment. Recommendations related to logging and detection highlight four key pillars: logging policy, centralized collection and correlation, integrity and secure storage of logs, and detection strategies for significant threats. These elements can be used as the minimum standard for the $L$ layer in USVM. In the $X$ layer (detection/correlation), XDR-class solutions may be placed, understood as the integration of multiple telemetry sources with analytics and response capabilities. However, it is important in the experiment to distinguish between “no detection because no telemetry events were generated” and “no detection despite available telemetry,” which requires telemetry quality metrics [xdr].

USVM metrics should be embedded within a measurement program aligned with good practices in security metrics. NIST provides approaches for building measurement programs and selecting appropriate metrics, emphasizing their usefulness for managerial decision-making and the need for a consistent process for defining and implementing measures [nist80055]. In USVM, the following minimal set of metrics is proposed (with the possibility of extension in subsequent research stages).

First, attack effectiveness metrics (layer $S$) serve to assess whether the scenario actually executed the intended steps (which is necessary for reliable validation of controls and detection). For example: ASR (Attack Step Realization) – the percentage of steps $t_i \in S$ in the scenario executed according to the ground truth (e.g., execution artifacts on the host, successful credential usage, achievement of the step objective). This approach is consistent with the logic of adversary emulation and ATT&CK-based testing, where each test corresponds to a specific technique and should leave measurable traces.

Second, control effectiveness metrics (layer $C$) measure whether security mechanisms actually prevented or limited the execution of a technique. These may be expressed as: PR (Prevention Rate) – the proportion of steps blocked (or degraded to significantly reduced impact) by preventive controls, analyzed across classes of $T(d)$. The rationale for this metric is based on the practice of control assessments as verification of objective fulfillment as well as established security testing methodologies.

Third, telemetry quality metrics (layer $L$) distinguish detection effectiveness from event observability. These include:

TC (Telemetry Completeness): the percentage of expected sources/events available in the log collection system for a given scenario according to the logging policy,

TL (Telemetry Latency): the delay between event occurrence and its availability within the correlation/analytics layer.

These metrics support the recommendation to establish baseline logging policies and centralized correlation mechanisms highlighted in logging and detection guidance.

Fourth, detection and response metrics (layers $X$ and $R$) measure the operational capability to detect and contain an incident:

DC (Detection Coverage): the proportion of scenario steps for which an alert or detection of useful quality was generated (e.g., including classification and contextual information), consistent with MITRE’s approach to detection categorization in ATT&CK Evaluations,

TTD (Time to Detect): the time between execution of a step (ground truth) and the generation of a detection,

TTR (Time to Respond/Contain): the time from detection to execution of a containment action (e.g., endpoint isolation, account blocking, C2 communication blocking), consistent with recommendations to integrate incident response into risk management and to improve detection–response–recovery capabilities [nist80061].

4.1 USVM Score

To provide a synthetic evaluation of experiment results, an aggregated indicator, the USVM Score, can be defined as a weighted function of selected metrics:

The USVM Score is defined as an aggregated metric that combines multiple dimensions of security effectiveness into a single interpretable value. The construction of this metric is inspired by established approaches to security measurement and performance evaluation, in particular the NIST SP 800-55 guidelines, which emphasize the use of composite indicators for supporting decision-making processes [nist80055].

From a methodological perspective, the USVM Score follows a weighted aggregation approach, commonly used in multi-criteria decision-making (MCDM) problems, where different aspects of system performance are combined into a single evaluation function. In this context, metrics representing positive security outcomes (e.g., prevention, detection, telemetry completeness) are treated as benefit components, while time-based metrics (e.g., detection and response delays) are modeled as cost components.

To ensure comparability across metrics with different units, time-based metrics (TTD, TTR, TL) are normalized as follows:

where $TTD_{norm}$, $TTR_{norm}$, and $TL_{norm}$ denote normalized values of time-based metrics, obtained by scaling raw values relative to predefined maximum thresholds.

where weights $w_i$ are parameterized according to risk priorities (e.g., higher weight for response time in critical systems).

The weights $w_i$ represent the relative importance of different dimensions of security effectiveness and should be defined according to organizational risk priorities. In practice, weight selection may follow a risk-based approach, where higher importance is assigned to metrics that have a greater impact on business continuity or risk exposure. Alternatively, formal methods such as expert-driven weighting or multi-criteria decision analysis (MCDA) techniques may be applied. In this work, example weights are provided for demonstration purposes only.

However, the construction of the aggregate should maintain transparency that is auditable.

The resulting USVM Score provides a relative measure of security effectiveness for a given experiment. Higher values indicate better overall performance, reflecting higher prevention and detection rates, improved telemetry quality, and lower detection and response times. The interpretation of the score is context-dependent and should be performed comparatively (e.g., across different configurations of $T(d)$ or different security architectures), rather than as an absolute measure of security.

NIST measurement guidelines emphasize the importance of interpretability of metrics and their alignment with organizational objectives.

To illustrate the practical application of the proposed framework, consider a validation scenario conducted in a controlled enterprise environment. The scenario is based on a hypothetical adversary emulation exercise mapped to MITRE ATT&CK techniques and executed against a managed endpoint equipped with TPM 2.0 and Secure Boot. Telemetry is collected through centralized monitoring infrastructure and evaluated using the metrics defined within the USVM model. The following values represent a hypothetical outcome of the validation process and are used to demonstrate the practical application of the proposed measurement approach.

The following values are presented as an illustrative example intended to demonstrate the behavior of the proposed metric and its sensitivity to different dimensions of security effectiveness. The values are not derived from a specific dataset, but are selected to reflect realistic ranges observed in enterprise security operations, including typical detection rates, response times and telemetry availability.

PR = 0.6 (60% of attack steps were prevented),

DC = 0.7 (70% of steps generated meaningful detections),

TTD = 120 seconds,

TTR = 300 seconds,

TC = 0.8 (80% telemetry completeness),

TL = 10 seconds.

For normalization purposes, the following maximum values are assumed: $TTD_{max} = 300$, $TTR_{max} = 600$, $TL_{max} = 60$.

The selection of maximum threshold values for normalization is based on expected operational boundaries within enterprise environments. These thresholds may vary depending on the organization, system criticality, and security maturity level. Therefore, the normalization approach is designed to be adaptable.

Therefore:

Assuming weights reflecting balanced priorities, e.g., $w_1 = w_2 = 0.3$, $w_3 = w_4 = 0.1$, $w_5 = 0.15$, $w_6 = 0.05$, the resulting USVM Score can be calculated as:

This example illustrates how different dimensions of security effectiveness contribute to the overall evaluation. After normalization, the score becomes interpretable and remains within a consistent range, while still reflecting the negative impact of time-based metrics on overall performance.

6. Discussion

The primary contribution of USVM lies in its ability to integrate previously fragmented practices into a single experimental framework: adversary emulation mapped to attack techniques, validation of controls in operational conditions, telemetry as a prerequisite for observability, and detection and response measured using operational metrics. This approach is consistent with the NIST perspective on continuous monitoring of control effectiveness as well as with the view of control assessments as mechanisms for verifying the achievement of security objectives rather than merely documenting compliance.

The most distinctive - and at the same time methodologically challenging - element of the model is the inclusion of hardware trust as an experimental variable. On the one hand, this choice is strongly justified: NIST highlights the critical importance of firmware and platform resilience, TPM represents a standard component of platform trust functions, and Secure Boot enforces trusted boot policies [nist800193]. On the other hand, the impact of this layer on experimental outcomes may depend strongly on specific device implementations, boot chain configurations, management policies, and endpoint security tools. This requires careful documentation of the experimental environment and control of potential confounding variables, such as configuration differences, software updates, or variations in telemetry agents [nist800115].

Another important practical limitation concerns the dependence of results on telemetry quality. Logging recommendations emphasize that without proper logging policies and log integrity, the ability to defend against living-off-the-land and fileless techniques is significantly reduced. In the context of USVM, this means that the absence of detection may result from missing data rather than weak analytics [logging_guide]. For this reason, the model requires parallel reporting of telemetry metrics (TC, TL) together with detection (DC, TTD) and response (TTR) metrics.

The proposed model is intentionally technology-agnostic and can therefore be applied to modern hybrid and cloud-native environments. In particular, the telemetry, detection and response layers may incorporate cloud security controls, Kubernetes audit logs, container runtime telemetry, DevSecOps validation pipelines and identity-centric security mechanisms. As organizations increasingly adopt distributed architectures, the ability to validate security effectiveness across heterogeneous environments becomes an important practical application of the USVM framework.

Furthermore, the growing adoption of AI-assisted analytics within XDR, SIEM and security operations platforms creates new opportunities for experimental validation. The metrics proposed within USVM, particularly Detection Coverage (DC), Time to Detect (TTD) and Time to Respond (TTR), may be used to assess the operational effectiveness of AI-supported detection and response capabilities. Future research may therefore investigate the impact of AI-driven security analytics on prevention, detection and response outcomes within controlled attack scenarios.

Finally, it is important to distinguish the objective of USVM from comparative testing of security tools. USVM does not aim to function as a vendor comparison framework but rather as a research model and methodological approach for evaluating security effectiveness within a specific organizational environment in a repeatable and auditable manner. Similar to MITRE ATT&CK Evaluations, which emphasize detection quality and operational context, USVM focuses on aspects that are operationally useful in SOC practice (time, context, and response outcome), extending this perspective by incorporating the device trust layer as an experimental variable.

7. Conclusions

This paper proposes the Unified Security Validation Model (USVM) as a layered model for the experimental validation of security control effectiveness in enterprise environments. The motivation for the model stems from the discrepancy between compliance-based assessments and real operational resilience, as well as the increasing regulatory requirements to demonstrate the effectiveness of cybersecurity risk management measures, as highlighted for example in the NIS2 Directive.

The conceptual and methodological contribution includes:

• The formalization of a validation experiment as a tuple encompassing attack scenarios, controls, device trust level, telemetry, detection, response, and metrics,

• The introduction of hardware trust (TPM, Secure Boot and firmware resilience) as an experimental variable, justified by platform resilience recommendations,

• A set of metrics separating control effectiveness, observability, detection quality, and response efficiency.

Future research will include pilot experiments in a reference environment, validation of the stability of the proposed metrics across different classes of attack scenarios, and the development of procedures aimed at reducing the dependence of results on the specific characteristics of security tools used in the environment. These studies will enable experimental verification of the hypothesis that device trust level significantly influences the effectiveness of security controls and detection mechanisms in realistic chains of attack techniques.

8. References

European Union Agency for Cybersecurity (ENISA), ENISA Threat Landscape 2024. Dostępne online: https://securitydelta.nl/media/com_hsd/report/690/document/ENISA-Threat-Landscape-2024.pdf

Microsoft, Microsoft Digital Defense Report 2025. Dostępne online: https://www.microsoft.com/en-us/corporate-responsibility/cybersecurity/microsoft-digital-defense-report-2025/

Verizon, 2024 Data Breach Investigations Report (DBIR). Available online: https://www.verizon.com/business/resources/reports/2024-dbir-data-breach-investigations-report.pdf?msockid=19bd3de880e6605b1e6a2af581ae6123

NIST, Special Publication 800-137: Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations. Available online: https://csrc.nist.gov/pubs/sp/800/137/final [dostęp: 30.04.2025].

European Union, Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2 Directive). Dostępne online: https://eur-lex.europa.eu/eli/dir/2022/2555/oj

Y. Zhang et al., A Survey on Cyber Security Evaluation Methods. IEEE Access, 2020. Available online: https://ieeexplore.ieee.org/document/9140463

J. Pěčarina et al., Security Control Effectiveness Measurement: A Systematic Literature Review. Computers & Security, 2021. Available online: https://www.sciencedirect.com/science/article/pii/S0167404821001530

MITRE Corporation, MITRE ATT&CK® Enterprise Matrix. Dostępne online: https://attack.mitre.org/matrices/enterprise/ [dostęp: 30.04.2025].

MITRE Corporation, MITRE Caldera Documentation. Dostępne online: https://caldera.readthedocs.io/en/latest/ [dostęp: 30.04.2025].

MITRE Corporation, ATT&CK® Evaluations – Enterprise 2025. Dostępne online: https://evals.mitre.org/enterprise/er7 [dostęp: 30.04.2025].

NIST, Special Publication 800-207: Zero Trust Architecture. Dostępne online: https://nvlpubs.nist.gov/nistpubs/specialpublications/NIST.SP.800-207.pdf [dostęp: 30.04.2025].

Cybersecurity and Infrastructure Security Agency (CISA), Best Practices for Event Logging and Threat Detection. Dostępne online: https://www.cisa.gov/resources-tools/resources/best-practices-event-logging-and-threat-detection [dostęp: 30.04.2025].

Trusted Computing Group, Trusted Platform Module Library, Part 0: Introduction. Dostępne online: https://trustedcomputinggroup.org/wp-content/uploads/Trusted-Platform-Module-2.0-Library-Part-0-Version-184_pub.pdf [dostęp: 30.04.2025].

Microsoft, Windows Secure Boot Key Creation and Management Guidance. Dostępne online: https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/windows-secure-boot-key-creation-and-management-guidance [dostęp: 30.04.2025].

S&P Global Market Intelligence, The Rise of Extended Detection and Response. Dostępne online: https://www.spglobal.com/content/dam/spglobal/mi/en/documents/general/the-rise-of-extended-detection-and-response.pdf [dostęp: 30.04.2025].

NIST, Special Publication 800-55 Revision 1: Performance Measurement Guide for Information Security. Dostępne online: https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-55r1.pdf [dostęp: 30.04.2025].

NIST, Special Publication 800-61 Revision 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management. Dostępne online: https://csrc.nist.gov/pubs/sp/800/61/r3/final [dostęp: 30.04.2025].

NIST, Special Publication 800-193: Platform Firmware Resiliency Guidelines. Dostępne online: https://csrc.nist.gov/pubs/sp/800/193/final [dostęp: 30.04.2025].

NIST, Special Publication 800-115: Technical Guide to Information Security Testing and Assessment. Dostępne online: https://csrc.nist.gov/pubs/sp/800/115/final [dostęp: 30.04.2025].

Australian Cyber Security Centre, Best Practices for Event Logging and Threat Detection. Dostępne online: https://www.cyber.gov.au/sites/default/files/2024-08/best-practices-for-event-logging-and-threat-detection.pdf [dostęp: 30.04.2025].

NIST, Special Publication 800-53A: Assessing Security and Privacy Controls in Information Systems and Organizations. Available online: https://csrc.nist.gov/pubs/sp/800/53/a/rev5/final