Moving Target Defense

Plain-language definition

Make attack knowledge stale while preserving service.

The definition is intentionally bounded. It identifies the property or role under discussion without converting terminology into a claim of deployment, recognition, personhood, citizenship, sovereignty, or authority.

Technical definition

Within the K01 knowledge model, Moving Target Defense is represented as a stable term object with code K01-TERM-150, canonical URL, claim status, topic owner, source links, related terms, last-reviewed date, research cutoff, and correction state. Relevant implementation components for the owning topic include multi-sensor telemetry; asset and identity graph; ensemble analysis; policy-constrained actions; reversible containment; deterministic safety interlocks; human command visibility; signed audit records; recovery verification.

Legal or policy use

Internal defensive automation is bounded by ownership, contract, privacy, sector regulation, labor obligations, safety duties, and any restrictions on interception, monitoring, or external access.

When a statute, regulation, standard, or external institution uses a different definition, that source-specific meaning controls the analysis of that source. The project definition is not silently substituted into current law.

What the term implies

The term implies that the stated property should be evaluated using the evidence appropriate to defensive autonomy, agentic security operations, cyber reasoning, containment, restoration, deception, and evidence-preserving response. It supports precise reference, comparison, data exchange, and correction across public prose and machine records.

What the term does not imply

It is not random change without availability and safety controls.

It also does not convert a valid signature, credential, database record, model hash, or website into factual truth or legal authority without additional evidence and a competent decision.

Commonly confused terms

• Bounded Autonomous Response
• Progressive Response Tier
• Reversible Containment
• Autonomous Security Operations Center
• Cyber Reasoning System
• Defensive Deception Environment

Confusion is resolved by asking which property is actually at issue: technical control, continuity, evidence, authority, legal recognition, operation, or normative status.

Operational test

1. Name the subject and purpose.
2. Identify the source definition and jurisdiction or technical context.
3. Collect evidence for the specific property.
4. Record currentness and limitations.
5. Route any governance, registry, assurance, or capital decision to the proper authority.

Related questions

• What makes autonomous defense safe enough for operational technology?
• Can an autonomous cyber defender act without human approval?
• What must be tested before autonomous containment is enabled?

Sources

• Executive Order 14409 — Promoting Advanced Artificial Intelligence Innovation and Security — The White House; Executive Order 14409; Presidential Executive Order. Exact claim-support entries: 1. Revalidated 2026-08-15T16:00:00Z.
• White House Launches GOLD EAGLE Initiative for Cybersecurity Vulnerability Coordination — The White House; White House release, July 14, 2026; Official release. Exact claim-support entries: 1. Revalidated 2026-08-15T16:00:00Z.
• Cyber Warfare: The Best Offense Is a Powerful Defense — U.S. Army Acquisition Support Center; USAASC article, August 10, 2026; Official first-party article. Exact claim-support entries: 2. Revalidated 2026-08-15T16:00:00Z.
• NIST SP 800-207 — Zero Trust Architecture — National Institute of Standards and Technology; NIST SP 800-207; NIST Final Publication. Exact claim-support entries: 1. Revalidated 2026-08-15T16:00:00Z.
• NIST SP 800-82 Revision 3 — Guide to Operational Technology Security — National Institute of Standards and Technology; NIST SP 800-82 Rev. 3; NIST Final Publication. Exact claim-support entries: 1. Revalidated 2026-08-15T20:00:00Z.

Stable term code: K01-TERM-150. Last reviewed 2026-08-16.