DTSEC Threat Matrix
A defensive taxonomy for analyzing how trust can fail across the physical/digital relationship.
Status
Open research taxonomy maintained by DigitalTwinSecurity.com. It is not an industry standard, certification, or complete catalog of every threat.
01
Physical Layer
- physical sensor tampering
- device substitution
- actuator manipulation
- environmental manipulation
02
Acquisition Layer
- telemetry spoofing
- replay attacks
- sensor impersonation
- measurement manipulation
03
Edge Layer
- edge-device compromise
- firmware compromise
- gateway compromise
- insecure local interfaces
04
Transport Layer
- interception
- man-in-the-middle attacks
- replay
- routing manipulation
- protocol abuse
05
Identity Layer
- twin impersonation
- service impersonation
- stolen credentials
- machine-identity compromise
06
Data Layer
- data poisoning
- historical-data manipulation
- provenance loss
- unauthorized modification
07
Model Layer
- model poisoning
- model substitution
- parameter manipulation
- unauthorized model modification
- model extraction
08
Simulation Layer
- scenario manipulation
- parameter tampering
- initialization manipulation
- simulation-result falsification
09
Synchronization Layer
- state desynchronization
- time manipulation
- stale-state injection
- update suppression
- conflicting state
10
API Layer
- unauthorized API access
- injection
- excessive privilege
- insecure integrations
- exposed service interfaces
11
Control Layer
- command injection
- control-policy manipulation
- unsafe recommendation generation
- unauthorized physical control
12
AI Layer
- adversarial input
- training-data poisoning
- inference manipulation
- model drift exploitation
- unsafe autonomous decision support
13
Federation Layer
- compromised twin federation
- trust propagation
- cross-organizational identity failure
- shared-model compromise
14
Supply Chain
- compromised dependencies
- firmware backdoors
- vendor compromise
- malicious updates
- component provenance failure
15
Human Layer
- insider misuse
- operator deception
- privilege abuse
- social engineering
16
Lifecycle Layer
- abandoned twins
- stale credentials
- forgotten integrations
- insecure decommissioning
- unsupported firmware/software
How to use the matrix
01 · SCOPE
Select the layers and transitions actually present in the architecture.
02 · CONNECT
Link each credible technique to assets, prerequisites, consequences, indicators, and controls.
03 · EVIDENCE
Record assumptions, uncertainty, references, review dates, and residual risk.