Threat Intelligence Program

Effective: March 17, 2026 · DCF-185

1. Purpose

This document defines H33.ai's threat intelligence program in accordance with ISO 27001:2022 control A.5.7 and SOC 2 Common Criteria CC7.1. The program establishes systematic processes for collecting, analyzing, and acting upon threat intelligence to protect H33.ai's post-quantum cryptographic infrastructure, customer data, and authentication services from current and emerging cyber threats.

2. Scope

This program covers all threat intelligence activities related to H33.ai's technology stack, including:

• BFV fully homomorphic encryption engine and Montgomery NTT implementation
• CRYSTALS-Dilithium (ML-DSA) digital signature operations
• CRYSTALS-Kyber key exchange mechanisms
• STARK zero-knowledge proof system with SHA3-256
• Auth1 authentication service infrastructure
• AWS cloud infrastructure (Graviton4, RDS, ElastiCache, Elastic Beanstalk)
• Rust supply chain and crate dependencies

3. Threat Intelligence Sources

H33.ai collects threat intelligence from the following sources, categorized by type:

3.1 Government and Standards Bodies

3.2 Vendor and Platform Sources

3.3 Inline ML Threat Agents

H33.ai operates three native Rust AI agents that provide real-time threat intelligence from within the authentication pipeline, running at a combined latency of approximately 2.35 microseconds:

4. Collection Methodology

Threat intelligence is collected through the following mechanisms:

• Automated feeds: NVD, RustSec, AWS Health Dashboard, and DataDog alerts are ingested automatically and triaged by severity
• Inline monitoring: ML threat agents operate within the production pipeline, generating real-time telemetry on every authentication batch
• Manual review: CISO reviews IACR ePrint archive, CISA advisories, and MITRE ATT&CK updates on a weekly cycle
• Community engagement: Intelligence shared through special interest groups per the Contact with Special Interest Groups policy (DCF-188)
• Vendor notifications: Direct communications from AWS, Microsoft, GitLab, and other vendors regarding security incidents affecting their platforms

5. Analysis and Assessment Procedures

Collected threat intelligence is analyzed using the following process:

1. Triage: Incoming intelligence is classified by severity (Critical, High, Medium, Low) and relevance to H33.ai's technology stack
2. Contextualization: Threats are mapped to H33.ai's specific implementations (e.g., does a lattice attack affect BFV with N=4096 and our specific modulus parameters?)
3. Impact assessment: Potential business impact is evaluated against the Business Impact Analysis (DCF-167)
4. Correlation: New intelligence is cross-referenced with existing threat data to identify patterns and campaigns
5. Prioritization: Response actions are prioritized based on exploitability, exposure, and business impact

6. Threat Categories Relevant to H33.ai

The following threat categories receive heightened monitoring due to their specific relevance to H33.ai's operations:

6.1 Quantum Computing Threats

Harvest-now-decrypt-later (HNDL) attacks represent the primary strategic threat to cryptographic systems. While H33.ai's post-quantum algorithms (Dilithium, Kyber) are designed to resist quantum attacks, the evolution of quantum computing capabilities is monitored continuously. The Harvest Detection ML agent provides inline detection of HNDL collection patterns.

6.2 Lattice Cryptanalysis

Advances in lattice reduction algorithms (BKZ, sieving) could affect the security margins of both FHE (BFV lattice assumptions) and PQC (Dilithium/Kyber Module-LWE/SIS assumptions). IACR publications and NIST PQC project updates are monitored for any cryptanalytic breakthroughs that would require parameter adjustments.

6.3 Side-Channel Attacks on FHE

Timing attacks, cache-timing attacks, and power analysis attacks targeting NTT implementations, Montgomery reduction, and key-switching operations. H33.ai's Side-Channel Analysis ML agent monitors for statistical anomalies indicative of these attacks in the production pipeline.

6.4 Supply Chain Attacks on Rust Crates

Typosquatting, dependency confusion, and compromised maintainer attacks targeting Rust crate dependencies. Mitigated through cargo-audit in CI/CD, dependency pinning, and RustSec Advisory Database monitoring.

7. Response Procedures

When actionable threat intelligence is identified:

1. Immediate (Critical/High): CISO notified within 1 hour. Emergency Change Advisory Board convened if system changes are required. Incident response plan activated if active exploitation is detected.
2. Short-term (Medium): Logged in Drata with assigned owner. Remediation plan developed within 72 hours. Changes implemented through standard change management process.
3. Long-term (Low/Informational): Documented for trend analysis. Incorporated into quarterly risk assessment review. Used to inform security awareness training.

8. Sharing with Authorities

Threat intelligence is shared with relevant authorities in accordance with the Contact with Authorities policy. H33.ai will:

• Report confirmed cyber incidents to CISA per applicable requirements
• Share non-proprietary threat indicators with US-CERT when relevant
• Contribute to NIST PQC discussions when H33.ai discovers implementation-relevant findings
• Coordinate with law enforcement when criminal activity is detected

9. Integration with Risk Assessment

Threat intelligence feeds directly into H33.ai's risk assessment process:

• Quarterly risk assessments incorporate the latest threat landscape data
• New threat categories trigger ad-hoc risk assessment updates
• ML agent telemetry data informs residual risk calculations
• Threat trends inform investment priorities for security controls

10. Review Schedule

This threat intelligence program is reviewed quarterly, or sooner if:

• A significant new threat category emerges relevant to post-quantum cryptography or FHE
• A major security incident occurs affecting H33.ai or its industry peers
• NIST publishes updated PQC standards or parameter recommendations
• H33.ai's technology stack changes significantly

The next scheduled review is June 2026.