Coherence-Based Enterprise Security: Beyond Signature Detection

This paper presents Coherence-Based Enterprise Security 2.0, an initialization‑anchored behavioral‑fidelity framework for organizational and network defense. Building on the σ₀ → B(σ₀) → K architecture introduced in Coherence-Based Defense 2.0 (LLM adversarial monitoring), the work defines a versioned initialization record, a stratified behavioral envelope, and a bounded fidelity score for runtime monitoring of enterprise entities. The framework distinguishes two attack families — pressure‑disruptive attacks and coherence‑preserving drift attacks — and provides preregistered falsification criteria for each. The contribution is a testable, falsifiable monitoring hypothesis designed to complement existing SIEM, EDR, and UEBA systems rather than replace them. Evaluation requirements, operational thresholds, and limitations are stated explicitly to support reproducible research and deployment‑specific validation.