Skip to content
← Grupo Aprecisa · Connecting those who know with those who need
Gaspar do Amaral

Cybersecurity and digital sovereignty · Article published on LinkedIn on 3 May 2026

The Architecture of Cyber-Physical Survival: From the Bureaucratic Paradox to Mathematical Resilience

A cyber-physical governance architecture for the hybrid threat, aligned with NIS 2, DORA and NATO doctrine

Gaspar do Amaral · 3 May 2026

Translated from the Portuguese original. This version was issued on 27 October 2026.

PDF (16 pages)Discussion on LinkedIn (in Portuguese)

Original cover of the article, with its texts in Portuguese: “A Arquitetura da Sobrevivência Ciberfísica: do Paradoxo Burocrático à Resiliência Matemática” (The architecture of cyber-physical survival: from the bureaucratic paradox to mathematical resilience) and “Autor: Gaspar do Amaral” (Author: Gaspar do Amaral). © Aprecisa.com
Original cover of the article, with its texts in Portuguese: “A Arquitetura da Sobrevivência Ciberfísica: do Paradoxo Burocrático à Resiliência Matemática” (The architecture of cyber-physical survival: from the bureaucratic paradox to mathematical resilience) and “Autor: Gaspar do Amaral” (Author: Gaspar do Amaral). © Aprecisa.com

Executive preamble

By armouring the governance of critical infrastructure against the hybrid threat, this document goes beyond the strictly technical dimension. What is established here is a multi-domain cyber-physical governance architecture. It is an operational script designed so that Ministers of Defence, Ministers of Infrastructure and European Regulators can read it and conclude: “This is exactly what we need to meet the resilience targets of the European Union (NIS 2, DORA) and NATO’s operational doctrine (Article 3, Assume Breach) — without destroying innovation and the economy in the process.”

The Architecture of Cyber-Physical Survival: From the Bureaucratic Paradox to Mathematical Resilience

The synthesis between the mathematics of risk and sovereign active defence

Summary: In the engineering of complex systems, rhetoric gives way to the thermodynamics of networks and to information theory. The planning of infrastructure on a national and European scale has swung between two chronic errors: bureaucratic State centralisation (which creates vulnerable Honeypots) and the excessive delegation of risk to algorithms and private reinsurers (which fail in the face of acts of war). In a multi-domain ecosystem of extreme criticality (dynamic interaction of land, sea and air), descending into the “Abismo do Rigor” (the Abyss of Rigour) requires recognising that mathematical automation does not govern kinetic chaos; it only filters it. To overcome this structural failure, a hybrid architecture of Two-Speed Responsibility is imperative: cryptographic mathematics guarantees basic systemic hygiene, while the State recovers its sovereign authority through hyper-specialised human resources, operating in an Assume Breach paradigm (the assumption that an intrusion has already happened) and with continuous Threat Hunting on the ground.

The technological genesis and the paradox of invention

The contemporary debate on European technological sovereignty runs into a structural paradox. Europe conceived the foundational architecture of mobile communications (GSM, UMTS, LTE, 5G), but lost governance over the cybersecurity of its flows. The debate often runs into a false dilemma: either the State centralises and collects the code of the whole network (exposing itself to espionage), or it abdicates and hands the destiny of the nation over to actuarial spreadsheets. True sovereignty demands a third way. Recognising the postulate of Richard A. Clarke that “telecommunications infrastructure is the backbone of National Defence”, the State cannot lead by proxy. Technological sovereignty is built by delegating standardised validations to cryptography, and reserving kinetic, human and military capability to intervene actively in the code when the enemy attacks.

Figure No. 2. Original illustration, with its texts in Portuguese: “The paradox of technological sovereignty: physical invention vs. loss of logical flows”. On a map of Europe, innovation hubs (Stockholm, Munich, Lisbon) and the radio network architecture (nodes) send flows of data towards “logical black holes (external destinations)”; other labels: “failure in data governance (logical level)” and “loss of data control”. Concept by Eng. Gaspar do Amaral. © Aprecisa.com
Figure No. 2. Original illustration, with its texts in Portuguese: “The paradox of technological sovereignty: physical invention vs. loss of logical flows”. On a map of Europe, innovation hubs (Stockholm, Munich, Lisbon) and the radio network architecture (nodes) send flows of data towards “logical black holes (external destinations)”; other labels: “failure in data governance (logical level)” and “loss of data control”. Concept by Eng. Gaspar do Amaral. © Aprecisa.com

Introductory note

From bureaucratic blindness to active hunting (Threat Hunting)

Traditional auditing requires topologies and code to be handed over to a regulator, creating a massive Honeypot — a centralised target ready to be decapitated. However, if the solution were simply to automate validation through Zero-Knowledge Proofs (ZKP), we would fall into another trap: mathematics only audits the flaws the State already knows. It is blind to dormant traps (Zero-Days). The new paradigm of National Defence requires that the State does not keep the code in static government sandboxes. On the contrary, the State infiltrates its own “Threat Hunters” into the decentralised network of the operators, actively auditing behavioural anomalies on the ground and assuming, by default, that the perimeter defences have already fallen (Assume Breach).

Axis I: Cryptographic auditing (ZKP) and “Confidential Computing”

The detailed analysis: Centralising code at a regulator is tactical suicide. But depending blindly on cryptographic Hashes issued by the operator is sovereign negligence. The cryptographer Bruce Schneier, in his book Click Here to Kill Everybody, warns that static compliance regulation fails miserably; security is measured by continuous resilience.

The proof concept: the synthesis of active auditing

Statement: The State filters known vulnerability through mathematics (ZKP), but guarantees the discovery of the unknown (Zero-Days) through precision telemetry and local auditing in secure environments (Trusted Execution Environments).

Proof: For mapped threats, the regulator issues the “Catastrophe Vector”, and the operator returns the Hash validated through ZKP (based on Goldwasser/Micali). However, for silent threats, the State requires Confidential Computing architectures to be implemented in the operator’s Core servers. The State does not take the code to the ministries; instead, hyper-specialised detachments of the National Cybersecurity Centre inject audit algorithms directly into the operator’s enclave processor. The State watches memory and behaviour in real time, without violating civil intellectual property, exercising sovereign authority at the heart of the traffic.

Figure No. 3. Original illustration, with its texts in Portuguese: “Zero-knowledge proof (ZKP) infographic — validating the robustness of critical infrastructure without exposing source code”. On the left, the State/regulator and its issuing console send the “catastrophe vector (simulated attack scenario)” into the “operator’s isolated perimeter”, surrounded by a “source-code invisibility barrier”, where an “internal chaotic simulation of the operating system (invisible from outside)” runs and the “ZKP proof” is generated. The “cryptographic hash of irreducible entropy (the proof)” returns to the “government validator (ZKP-based)”, with a console analysing the hash, which gives a “binary verdict”: “licence granted — robustness mathematically confirmed” or “licence refused — robustness not confirmed”. Author: Eng. Gaspar do Amaral. © Aprecisa.com
Figure No. 3. Original illustration, with its texts in Portuguese: “Zero-knowledge proof (ZKP) infographic — validating the robustness of critical infrastructure without exposing source code”. On the left, the State/regulator and its issuing console send the “catastrophe vector (simulated attack scenario)” into the “operator’s isolated perimeter”, surrounded by a “source-code invisibility barrier”, where an “internal chaotic simulation of the operating system (invisible from outside)” runs and the “ZKP proof” is generated. The “cryptographic hash of irreducible entropy (the proof)” returns to the “government validator (ZKP-based)”, with a console analysing the hash, which gives a “binary verdict”: “licence granted — robustness mathematically confirmed” or “licence refused — robustness not confirmed”. Author: Eng. Gaspar do Amaral. © Aprecisa.com

Validation mechanics: The operator runs the simulation of the “Catastrophe Vector” in its isolated perimeter and returns a cryptographic key (Hash). By Information Theory, the irreducible entropy of this Hash certifies the invulnerability of the node to mapped threats. At the same time, to fight silent threats (Zero-Days), Confidential Computing comes into action: the regulator injects its audit algorithms directly into the operator’s enclave processor, monitoring the memory and behaviour of the network in real time. The State thus exercises its sovereign authority at the heart of cyber-physical traffic, without ever extracting or violating civil intellectual property.

Figure No. 4. Original illustration, with its texts in Portuguese: on a circuit board, a “confidential computing enclave” receives the “intellectual property (code and data) of the operator” and the “State audit algorithms”, and delivers an “audit completed and validated (without exposure)”. Eng. Gaspar do Amaral. © Aprecisa.com
Figure No. 4. Original illustration, with its texts in Portuguese: on a circuit board, a “confidential computing enclave” receives the “intellectual property (code and data) of the operator” and the “State audit algorithms”, and delivers an “audit completed and validated (without exposure)”. Eng. Gaspar do Amaral. © Aprecisa.com

Axis II: “Skin in the Game” and the War Clause (the Core network)

The detailed analysis: The tight coupling of networks and the absence of financial responsibility create catastrophes. The reinsurance market (AA Policies) imposes network hygiene (Air-Gapping) better than any bureaucrat. However, in the event of hybrid war sponsored by hostile States, insurers invoke Force Majeure clauses and abandon the front line, leaving the infrastructure to collapse financially.

The proof concept: the sovereign shield of last resort

Statement: Resilience requires the transfer of negligent risk to the market (insurers), but survival in the face of war risk requires a Backstop from the General Staff.

Proof: The State approves the operating licence only on presentation of an AA cyber-risk Policy, forcing the operator to isolate networks and fragment services. However, the law establishes that, in the face of a Declaration of a State Cyberattack, the actuarial logic ceases and the Defence Doctrine comes in: the military take over the logical jurisdiction of the vital infrastructure. The market manages criminal risk in peacetime; the State takes kinetic control in wartime.

Axis III: Asynchronous survival and situational awareness (the Edge network)

The detailed analysis: Depending on continuous telemetry to operate peripheral infrastructure is fatal. However, configuring critical equipment to perform pure “Galvanic Isolation” when there is no signal is allowing the enemy to use Jamming to make us amputate ourselves. “Island Mode” cannot be a “Blind Mode”.

The proof concept: graceful degradation with sensor fusion

Statement: Systemic stability is preserved by cutting logical vectors of contamination, while keeping functional inertia through distributed intelligence (Edge AI) and the fusion of local sensors.

Figure No. 5. Original illustration, with its texts in Portuguese: “Visualisation of logistical inertia (Axis III)”. In a port, the “compromised system (central network invaded)” and the “central network subverted (enemy intrusion)” glow red; a gantry crane, enclosed in a protective cube, works on its own beside a ship, with “local sensors (lidar, radar)”, “Edge AI”, a “backup energy bank (active)” and “safe autonomous operation”: the “Island Mode”. Eng. Gaspar do Amaral. © Aprecisa.com
Figure No. 5. Original illustration, with its texts in Portuguese: “Visualisation of logistical inertia (Axis III)”. In a port, the “compromised system (central network invaded)” and the “central network subverted (enemy intrusion)” glow red; a gantry crane, enclosed in a protective cube, works on its own beside a ship, with “local sensors (lidar, radar)”, “Edge AI”, a “backup energy bank (active)” and “safe autonomous operation”: the “Island Mode”. Eng. Gaspar do Amaral. © Aprecisa.com

Proof: When telemetry fails, the critical equipment at the Edge (e.g. ERTMS signalling or a port gantry crane) trips its circuit breaker and isolates itself from the main network. However, it immediately couples itself to its “Local Situational Awareness”: AI models processed locally, cross-checking data from redundant sensors (Lidar, solid-state radar, short-range Mesh radio). The node moves into an “Intelligent Island Mode”. It survives by performing its basic function through mechanical instinct and independent energy, guaranteeing the inertia of the continent.

Conclusions and proposal for action

Technological sovereignty rises from the recognition that no bureaucratic parameterisation or cryptographic automation does away with the tactical instinct of human intelligence. The State only achieves true resilience when it orchestrates mathematics, the financial market and military doctrine in a single flow.

Integrated regulatory action proposal (immediate implementation):

Bibliographic index and practical applicability (reference matrix)

This conceptual matrix draws inspiration from, is grounded in and develops the article A Governação de Infraestruturas Críticas e a Responsabilidade a Duas Velocidades (Critical infrastructure governance and two-speed responsibility; in Portuguese) (Gaspar do Amaral, 2026).

A. Organisational structure and the mathematics of risk

1. Donella Meadows (Thinking in Systems)

Contribution: Establishes that intervening in infrastructure requires redesigning the feedback loops. Proves that centralising control in a single node guarantees systemic collapse.
Examples of practical applicability:

2. Shafi Goldwasser and Silvio Micali (Zero-Knowledge Proofs)

Contribution: Provide the mathematical basis (ZKP) that allows the State to audit vital systems without accessing the code, eliminating the vulnerability of Honeypots.
Examples of practical applicability:

3. Mário Figueiredo (Information Theory)

Contribution: Sustains mathematically that the entropy of a Hash resulting from a simulation guarantees the invulnerability of the system, operating with zero uncertainty.
Examples of practical applicability:

4. Nassim Nicholas Taleb (Skin in the Game)

Contribution: Postulates that operators only invest rigorously in peripheral security when their own capital answers for systemic failures.
Examples of practical applicability:

B. Security engineering and economics

5. Ross Anderson (Security Engineering)

Contribution: Shows that systems fail when the auditor (the State) is not aligned with whoever suffers the damage (the Economy). Underpins the use of reinsurers.
Examples of practical applicability:

6. Charles Perrow (Normal Accidents)

Contribution: The theory of “Tight Coupling” justifies the outright rejection of centralised State Gateways, as these accelerate irreversible cascading damage.
Examples of practical applicability:

7. Rosário Macário (Transport Economics)

Contribution: Sustains that excessive central procedural regulation at the Edge (the periphery) generates operational inefficiencies and stifling transaction costs.
Examples of practical applicability:

C. Cyber-physical systems and Island Mode

8. Nancy Leveson (STAMP Engineering)

Contribution: Replaces the analysis of isolated components with the analysis of interactions, underpinning the containment architecture by “Graceful Degradation”.
Examples of practical applicability:

9. Paulo Veríssimo (Intrusion Tolerance)

Contribution: Demands architectures that guarantee continuous operational survival even under active cyber infiltration by the enemy.
Examples of practical applicability:

10. João Peças Lopes (Smart Grids)

Contribution: Proves electrotechnically the effectiveness of “Island Mode”, a parameter to be required in the licensing of peripheral intermodal equipment.
Examples of practical applicability:

11. Amory Lovins (Brittle Power)

Contribution: Shows that national resilience dictates that critical infrastructure Hubs operate physically distributed, mitigating collapse through “structural brittleness”.
Examples of practical applicability:

12. Nuno Neves (Security and Fault Tolerance)

Contribution: Rigorous physical separation and Air-Gapping form the only inviolable frontier when the regulatory software itself is irremediably infected.
Examples of practical applicability:

D. Strategic and cyber framework

13. Richard Bejtlich (Assume Breach & Threat Hunting)

Contribution: Underpins the paradigm shift from static perimeter defence to the posture of “Assume Breach”. Sustains that modern security does not lie in building impassable walls (which create false feelings of security), but in assuming infiltration and orchestrating active human detection and the hunting of threats (Threat Hunting) inside the network.
Examples of practical applicability:

14. Mark Russinovich (Confidential Computing)

Contribution: Architect of the technical infrastructure that makes it possible to audit code, memory and data flows “in use” without violating confidentiality or intellectual property. In essence, it resolves the paradox of the State needing to inspect the network without creating centralised Honeypots that collect source code.
Examples of practical applicability:

15. Bruce Schneier (Click Here to Kill Everybody)

Contribution: Rejects the scripts of bureaucratic licensing (mere compliance on paper), advocating the adoption of native defences in integrated IoT systems.
Examples of practical applicability:

16. Vint Cerf (TCP/IP Architecture)

Contribution: Postulates a return to the original philosophy of the Internet, based on strictly autonomous nodes capable of dynamic rerouting when a route is suppressed.
Examples of practical applicability:

17. José Tribolet (Organisational Engineering)

Contribution: Unequivocally places the State in its role as ontological architect of risk, forbidding it to act as builder or as auditor of operational micromanagement.
Examples of practical applicability:

18. Swiss Re (Cyber Risk Research)

Contribution: Provides the actuarial grounding for the “AA Policy”, proving that transnational complexity demands financial assessment, and not only governmental technical assessment.
Examples of practical applicability:

19. Richard A. Clarke (Cyber War)

Contribution: Frames, legally and operationally, transport and telecommunications infrastructure as front-line military assets of National Defence:
Examples of practical applicability:

Methodological note

What this page is. A translation of the article the author published on LinkedIn on 3 May 2026; the full Portuguese version is on this site. Nothing has been summarised or added: the preamble, the three axes, the proposal for action and the bibliographic index (19 authors, 3 examples each, with their usefulness and their result metric) are translated in full.

Changes of form, not of content. The decorative symbols (emoji) and the separators of the LinkedIn version were left out. The section headings, which the original sets at a single level, are shown as headings and sub-headings; the four groups of the bibliographic index (A to D) are shown as sections. The labels of each example (“Usefulness…”, “Result metric”) are in bold. The web addresses of the examples are written out in full, as in the original. The original cover and the four illustrations are reproduced with their texts in Portuguese; their numbering (Figure No. 2 to No. 5) is that of the original, and each translated caption describes what the illustration shows. The links to sources are those of the original.

Corrections made only in the translation. (1) In the original, the title of Bruce Schneier’s book Click Here to Kill Everybody carried a link that did not lead to the book; the link was removed and the title kept. (2) In the third example for Vint Cerf, the original reads “1 bilião” of nodes, which in European Portuguese would mean a million million; the context (devices counted worldwide) indicates the sense of a thousand million, which is the figure given here (1 billion).

Numbers. All numbers, dates, percentages and units are those of the original; only the decimal separator follows English use (the original sometimes writes the decimal point, as in “2.4 milhões”). Q1 and Q4 mean the first and fourth quarters of the year. The concept “Abismo do Rigor” keeps its Portuguese name, with its translation in brackets.

The discussion is on LinkedIn (in Portuguese)

Comments on this text are made on LinkedIn, where the article was shared in Portuguese. You are welcome to write in English. Agree, disagree or add data: every well-founded objection receives a reply.

Comment on LinkedIn (in Portuguese) Download the PDF (16 pages)

Gaspar do Amaral · Original in Portuguese of 3 May 2026, published on this site; translation issued on 27 October 2026 · Figures and tables © Aprecisa.com · AI-assisted