Unified Linkage Models: Recontextualizing Cybersecurity

In cybersecurity, as well as in broader systems thinking, linkages are more than mere points of connection. Linkages are conceptual and operational threads, that bind a system’s components together, representing the channels through which information, control, accountability, and value flow.

Conceptually, a linkage is a structural and strategic connection point that enables interaction, coordination, or mutual recognition between discrete elements of a system. These elements might be devices, processes, identities, nodes, or even organizational mandates.

A linkage is distinguished from mere connectivity in its functional role. While connections have a transmission role, linkages have a role in maintaining coherence, resilience, and purpose across dynamic, often distributed systems.

All linkages are not equal. Some exist by proximity, while others are deliberately configured; some arise from mutual trust, while others depend on hierarchical delegation or inherited access. To analyze linkages effectively, three primary modalities through which linkages manifest in cyber systems can be identified: adjacency, trustworthiness, and inheritance (see figure 3).^[6][7]

Figure 4 illustrates how cybersecurity linkages—adjacency, trustworthiness, and inheritance—connect distributed systems (see figure 4). Each linkage type is represented with a distinct line style, showing how different relationships maintain coherence, resilience, and purpose across a network.

A. Adjacency: Proximity and Interaction

Adjacency refers to linkages formed through physical or logical proximity. In network terms, this could mean shared access domains, routing paths, or cloud tenancy. In operational environments, it might be co-located systems or departments with overlapping functions. Adjacency-based linkages are often the most vulnerable, as proximity does not imply intentionality or trust. For example, two unsegmented systems sharing the same network space may inadvertently expose each other to risk, despite having no shared purpose or governance. In rhizomatic systems—non-hierarchical, web-like structures—adjacency is foundational, as influence propagates through local, trust-agnostic proximities rather than centralized control, exposing systems to compliance drift and trust misalignments.^{[8] [9]} Trust-agnostic proximities refer to relationships or interactions within a system where spatial, logical, or functional closeness does not imply any verified trust or authorization. These proximities often enable lateral movement, data leakage, or privilege escalation when systems assume adjacent entities are inherently trustworthy.

B. Trustworthiness: Verified Integrity and Accountability

Trustworthiness refers to the degree to which a relationship between systems or identities has been verified, validated, and remains consistent with intended policy or behavioral expectations. In practice, low trustworthiness can allow unauthorized access or lateral movement when identities or systems are implicitly assumed to be safe without current revalidation. Trustworthiness-based linkages are formed through demonstrated reliability, integrity, and adherence to standards. These linkages imply that one system or actor is trustworthy and reliable enough to interact with or rely upon by another. This approach is a foundational element in the design of numerous cybersecurity protocols, including zero-trust architectures, digital certificates, and federated identity schemes.  Trustworthiness is not static; it must be continuously evaluated. Systems that manage identity, authorization, and behavior analytics govern trust-based linkages. Importantly, these linkages embed value and accountability—they are formed because one party agrees to be bound by the norms or expectations of another.^[10]

C. Inheritance: Delegation and Transitive Risk

Inheritance describes the residual transfer of configurations, permissions, systems, or access relationships over time without deliberate reevaluation. Inheritance-based linkages are those created through the transfer of authority, access rights, or system dependencies. This is least visible form but most strategic form of linkage. Inheritance linkage reflects historical, political, or architectural design decisions that have shaped the area’s development. In cloud environments, inheritance linkages may be seen in role-based access controls (RBAC) or trust relationships between domains. In operational technology (OT) environments, legacy systems may inherit exposure due to protocols or configurations established decades earlier. Inheritance carries with it both transitive trust and transitive risk. A single compromised linkage can cascade through an entire system if the inheritance paths are not tightly managed or constrained.^[11]

Again, all linkages are not equal. Each one has its level of security, can be attacked in different ways, and requires a unique management approach. It is important to understand these differences when it comes to analyzing risk, deciding what controls to focus on, and creating strong cybersecurity systems that can adapt to and stay secure against complex threats in the real world.

IV. Network Archetypes Evolution

As cyber systems became more interconnected and adaptive, the limitations of hierarchical models grew apparent. It has become evident that there is a need for alternatives or augmentations. To that end, resilience requires models that anticipate non-linear behaviors, accommodate distributed decision-making, and allow for rapid reconfiguration. This shift invites the integration of rhizomatic and chaos-informed network models—where systems are less reliant on command hierarchies and more on localized intelligence, adaptive trust, and emergent properties. The reality is that the cyber environment and its associated risks lies at the intersection of these three models (see figure 5). Unified linkage models can bridge traditional architectures with new structural paradigms of cybersecurity resilience.

A. Traditional Hierarchical Linkage Models

Cybersecurity architectures have traditionally relied on hierarchical models. These models establish clear authority structures, defined communication channels, and centrally governed policies. Hierarchical systems use linkages that cascade downward. They rely on authority, procedural inheritance, and layered adjacency to protect information assets. These principles underpin the established practices in the domains of network design, enterprise architecture, and compliance frameworks.^{[12] [13]}

A1. Canonical Examples of Hierarchical Models

Hierarchical linkage models are best exemplified by three canonical frameworks: defense-in-depth, the Open Systems Interconnection (OSI) model, and top-down network design.

• Defense-in-depth is a multilayered strategy that assumes that no single security control is sufficient to stop all attacks. It employs a series of layered defenses—firewalls, intrusion detection systems, endpoint protections, access controls, and monitoring—each linked vertically in a stack of preventive and reactive measures. Linkages in this model are tightly coupled with defined roles and zones of control.^[14]
• The OSI model conceptualizes network and system as a sequence of discrete layers, from physical transmission (Layer 1) up to application-level processes (Layer 7). Each layer serves a specific function and interfaces with the layer directly above and below it. The linkages here are adjacency-based (proximity between layers) and inheritance-based (where higher layers assume trust or state from lower ones).^[15]
• Top-down network design starts with business and security requirements and systematically flows downward into logical and physical configurations. The linkages are policy-driven and embedded in the system “blueprints,” reflecting command-and-control structures.

These architectures prioritize bounded control. The linkages are both traceable and enforceable. Access rights, information flows, and device relationships are explicitly defined, allowing security teams to implement policy-driven monitoring and audits. Bounded controls are cybersecurity or governance mechanisms that are confined in scope, effectiveness, or applicability due to organizational, technical, or contextual constraints. These controls often fail to address emergent risks or inherited weaknesses that fall outside their predefined operational boundaries.^[16]

A2. Strengths of Hierarchical Linkage Models

Hierarchical models have a clarity of authority and a structural rigidity. Roles and responsibilities are known and well-defined. Administrators control the infrastructure. Users operate within permission boundaries. Firewalls and VLANs constrain data flows. This architecture:

• Enables regulation and compliance: Hierarchical systems map cleanly to auditing standards (e.g., NIST, ISO 27001, HIPAA) because responsibilities and data paths are explicitly assigned.
• Simplifies access control and identity management: Central directories (e.g., Active Directory) enforce group policies across assets.
• Allows for consistent monitoring: Network traffic and system logs can be reliably collected and correlated due to predictable linkage patterns.

In environments with stable threat models and well-understood operational processes—such as traditional enterprise IT or regulated sectors—hierarchical linkage models provide robust, enforceable security postures.

A3. Weaknesses and Emerging Limitations

However, hierarchical systems suffer critical limitations in dynamic, distributed, or adversarial environments. Their rigidity, once a strength, becomes a liability when confronted with emergent or non-linear threats.

• Vulnerability to insider threats: Since authority and access rights cascade downward, a single compromised user or credential can bypass multiple layers of defense. This makes hierarchical linkages brittle when insider risk is not continuously assessed and managed.
• Lateral movement blind spots: Once attackers gain a foothold, they often exploit adjacent systems horizontally—an attack vector that hierarchical systems struggle to contain. The linkages within a layer (e.g., peer-to-peer server trust) often lack scrutiny.
• Poor adaptability to novel attacks: Hierarchical architectures struggle with polymorphic malware, supply chain attacks, and AI-based exploits that do not follow predictable attack paths. These threats evolve faster than the policy and configuration updates typical of top-down designs.

Moreover, inherent trust assumptions pose systemic risks. Linkages often depend on bounded adjacency (e.g., trust everything on the same subnet) or explicit inheritance (e.g., a child process inherits the parent’s privileges). If those boundaries or assumptions are breached, cascading failure can result.

B. Rhizomatic Networks and Linkage Decentralization

Deleuze and Guattari’s philosophical notion of the rhizome, developed in A Thousand Plateaus, offers a compelling theoretical framework for understanding decentralized, non-hierarchical systems. Unlike the traditional arboreal or tree-like model of knowledge and power (which is centralized and bounded), but to similar to the bad actor group Anonymous, rhizomes operate through multiplicity, emergence, and connection without a central point of control. In cyber systems, rhizomatic structures provide a conceptual model for analyzing complex, adaptive networks such as botnets, disinformation campaigns, or decentralized identity fraud rings (see figure 6).^[17]

In cybersecurity, rhizomatic networks pose a particularly challenging threat due to their flat topology, persistence, and self-replicating nature. These systems feature a distributed and decentralized architecture. Instead of relying on one source of authority or access, they disseminate information through a network of interconnected nodes, driven by recursive logic. Disinformation networks, for instance, operate without central coordination yet achieve coherence through mutual reinforcement, virality, and algorithmic amplification. Similarly, modern identity fraud rings—enabled by synthetic identity creation, token reuse, and credential stuffing—mimic a rhizomatic spread: they persist by exploiting and mutating through weak linkages, rather than by compromising a central authority.^[18]

One of the most significant dangers posed by rhizomatic structures is their ability to obfuscate centerlines—the directional pathways of influence, control, or value that traditional cyber defense models assume exist. Rhizomatic systems exploit this by hiding their root systems, blending into legitimate traffic, or fracturing themselves across jurisdictions and digital platforms. In so doing, they evade perimeter-based defenses and exploit the fragile trust assumptions embedded in hierarchical architectures.^[19]

Within these environments, emergent linkages arise organically rather than through prescribed architectures. These linkages include influence pathways—how one compromised or persuasive node can shift sentiment or behavior across a wider system—as well as identity fraud propagation networks, in which compromised credentials or behavioral data are used to spawn synthetic identities that further expand the web.

These emergent patterns are not evident through traditional asset-based or topology-based mapping. Patterns are only apparent through an understanding of behavior, timing, and probabilistic connections.

The ULM addresses this complexity by enabling cyber defenders to identify and respond to latent and nonlinear linkages within rhizomatic systems. Rather than mapping only explicit hierarchies or network architectures, ULM overlays behavioral linkage graphs—structures that detect linkages based on co-occurrence, temporal correlation, or behavioral similarity. This shift allows defenders to identify the presence of rhizomatic behaviors such as repeated identity spoofing across platforms, shared language and timing in disinformation narratives, or token inheritance anomalies in federated access systems.

The rhizomatic framework is designed to model decentralized, adaptive networks. Its strength is in providing an understanding of dynamic environments such as Internet-of-Things (IoT) ecosystems or countering bad actor groups such as Anonymous. However, rhizomatic systems often have a lack of clear lines of authority or accountability, which makes governance and enforcement challenging. The unpredictability and opacity can also obscure risk propagation paths, which makes monitoring and incident response more difficult.