Security Knowledge Intelligence

The argument

A memory problem that conventional remediation workflows do not solve.

Every year, organizations spend millions learning about their own security. Penetration tests, red-team operations, incident investigations, and architecture reviews each produce genuine knowledge — and much of it fails to remain usable. Reports are filed, teams move on, and twelve months later a new assessment rediscovers the same weaknesses.

The paper names this failure mode knowledge decay, and argues that it has persisted not because organizations don’t care, but because preserving security knowledge required sustained manual effort few teams could justify. It defines the discipline that addresses it, the architecture that discipline requires, and the trust boundaries a responsible implementation must respect.

Seven chapters

What the paper covers.

1. 01The problem: knowledge decayWhy repeated findings often signal a memory failure that remediation alone does not fix.
2. 02The discipline: Security Knowledge IntelligenceThe canonical definition — and the lexicon: Knowledge Decay, Knowledge Compounding, Institutional Memory.
3. 03The architectureCapture, Connect, Compound, Decide — how each stage produces the next.
4. 04Why now: the economics have changedAI-assisted extraction and connection, with provenance, human review, and source traceability.
5. 05Applications built on the foundationExecutive Intelligence, Detection Engineering, Incident Intelligence, and Exposure Prioritization — on one record.
6. 06Trust: provenance, auditability, and boundariesData ownership, the limits of automation, human judgment, and legal boundaries.
7. 07The result: institutional memoryWhat compounding knowledge changes about a security program.