Delper Guard: Threat Registry

OT & Network Perimeter Threats

Industrial technology and network edge

Advanced Persistent ThreatLong-dwell authentication anomalies or unusual administrative tool use.
Data ExfiltrationOutbound volume spikes directed toward unknown destinations.
Zero-Day ExploitAbnormal process execution, unexpected privilege changes, or non-standard network behavior.
Distributed Denial-of-ServiceNetwork traffic volume spiking sharply beyond established baselines.
DNS SpoofingResolver answers that do not match authoritative domain records.
IoT BotnetsOutbound traffic from an IoT device to a known command-and-control server or active network scanning.
Protocol TunnelingUnexpected tunnel protocols or inner payload traffic anomalies.
Rogue Access Points and Evil Twin Wi-FiUnknown BSSID/SSID broadcasts or an unauthorized device connected to a secure port.
Malware Command-and-ControlAutomated beaconing patterns to rare domains or external IP addresses.

IT endpoints and host systems

Malicious Process InjectionUnexpected memory writes or abnormal parent-child process execution chains.
Pass-the-HashNTLM logons originating from unusual hosts or off-baseline administrator logons.
Bring Your Own Vulnerable DriverAttempted loading of a blocklisted or known vulnerable kernel driver.
Disabling Security ToolsSecurity protection status modifications or direct tamper-protection alert events.
InfostealersAutomated credential exfiltration attempts to an unknown destination.
Living Off the LandBuilt-in system administrative tools used in highly unusual or malicious sequences.
Polymorphic MalwareA behavioral system match to malicious activity without a matching static signature.
Ransomware / RaaSMass file modification patterns or attempts to delete volume shadow copies.

Cloud workloads, APIs, and web applications

Resource HijackingUnapproved jobs running or GPU/CPU utilization spiking off baseline.
Cloud MisconfigurationPublic storage exposure or IAM policy drift from the established baseline.
Data Exfiltration (Cloud)Unusual cloud API sequences or storage egress spikes.
Insecure APIsCloud API calls executing outside of assigned scope or unauthenticated requests.
Cryptojacking (Cloud)Sudden CPU spikes or outbound connections to cryptocurrency mining pools.
Misconfigured Systems / Exposed DatabasesOpen internet ports or public storage/database endpoints.
Shadow ITUnsanctioned applications/workloads detected or OAuth grants given to unknown applications.
API ExploitationMalformed or out-of-scope API requests.
Cross-Site Request ForgeryState-changing web requests executing without a valid origin.
Cross-Site ScriptingScript injection patterns detected in web input or output fields.
Drive-By DownloadsAn unexpected or automated download triggered from a visited webpage.
SQL InjectionSQL query anomalies or database error patterns.
Web Application ThreatsApplication-layer attack signatures identified.

Model integrity and generative output

Backdoor InjectionTrigger-like output patterns or core model integrity mismatches.
Content AbuseOutput classifier flags an event or a sudden spike in generated content.
JailbreakingPrompt injection patterns detected or repeated user prompt guardrail hits.
Model Extraction AttacksHigh-volume, systematic query patterns originating from a single API key.
Model PoisoningPerformance drift, anomalous AI outputs, or dataset provenance gaps.

Accounts, sessions, and login behavior

Session HijackingToken reuse detected across physically impossible devices or locations.
SaaS Authentication ExploitsImpossible travel alerts, MFA bypass patterns, or active orphan accounts.
Brute Force AttackHigh authentication failure rates concentrated on a single account.
MFA Fatigue AttacksRepeated push notifications followed closely by an approval.
Password SprayingA low number of login failures per account spread systematically across a large number of accounts.
Suspicious Cloud AuthenticationAnomalous login behavior or connection from an unusual device or geography.

People, partners, and vendors

Insider ThreatCredential misuse or data access patterns falling outside an assigned user role.
Insider Misuse / Privilege EscalationUnexpected role grants or off-hours administrative actions.
Watering Hole AttackRedirection scripts or source code changes detected on a trusted, external site.
Supply-Chain AttacksUnsigned or modified vendor software packages and updates detected.
Business Email CompromiseDirect payment modification requests or lookalike sender addresses.
Deepfake-Enabled Scams (Vishing)Unverified voice or video corporate instructions.
PhishingHigh-risk malicious links or attachment reports.
SIM HijackingMobile carrier port-out or sudden SIM card change events.
SmishingMalicious SMS links reported to the gateway.
Social EngineeringHelp-desk password resets or requests to bypass access policies.
Spear PhishingTargeted communications directed specifically to privileged users.

Physical hardware production only

Total hardware cost

$94.13 B

Across 2,902,963,334 chips

Silicon engineering (excluded)

$531.5 M

Upfront core development, not included above

Tier	Process node	Units	Cost per unit	Total cost
Home & Student	65/180 nm	2,901,000,000	$32.00	$92.83 B
SME	28 nm	1,000,000	$185.00	$185.00 M
Enterprise	5 nm	963,334	$1,150.00	$1.11 B
Total		2,902,963,334		$94.13 B

Two parallel tracks: a 5-year industrial plan and a 25-year consumer plan

1,963,334 industrial chips, built to order or in upfront blocks, with a maximum footprint of 80,000 factories.

Year	Total units	Breakdown
Year 1	1,048,000	48,000 Enterprise deployed + 1,000,000 SME conduit units produced
Year 2	144,000	Enterprise production lines
Year 3	243,334	240,000 Enterprise production lines + 3,334 vault emergency spares
Year 4	288,000	Enterprise production lines
Year 5	240,000	Enterprise production lines, reaching full capacity
Total	1,963,334

2.901 billion consumer units scaling into a mass-market operation over 25 years.

Phase	Years	Total units	Units per year
Pilot	1 to 3	1,000,000	~333,333
Mass-scale	4 to 25	2,900,000,000	131.82 M
Total		2,901,000,000

Consumer phase totals reflect the stated plan. The mass-scale figure is 2,900,000,000 divided across 22 years.