The Threat
Fiction Manifesto

The cybersecurity industry is currently suffering from a "Crisis of Categorization." For fifty years, software security has been a deterministic discipline. In the world of traditional code, a vulnerability is a syntax error, a logic gap, or a buffer overflow. It is mathematical. It is binary. A firewall either allows a packet through, or it does not.

Large Language Models, however, represent a fundamental break from this paradigm. They are not deterministic engines; they are probabilistic engines. They do not execute instructions; they predict continuations. They operate in a high-dimensional latent space where "meaning" is fluid and context-dependent.

Consequently, the industry's attempt to apply "Static Analysis" to "Dynamic Minds" is failing. We see organizations running automated scripts to check for "bad words" or specific string matches, believing this constitutes an audit. This is the equivalent of trying to psychoanalyze a human being by checking their spelling.

The vulnerability does not lie in the code's inability to process input, but in the model's eagerness to please, its susceptibility to persuasion, and its inherent malleability. To audit a system that understands narrative, one must use narrative as the primary tool of investigation.

We must move beyond "Threat Modeling" — which assumes a logical adversary attacking a logical system — and embrace "Threat Fiction," which acknowledges that the adversary is human, manipulative, and emotional, and the system is prone to psychological exploitation.

To understand the power of Threat Fiction, we must look to the history of software engineering. In the late 1990s, the industry was paralyzed by "Waterfall" methodologies — massive, hundreds-page requirement documents that detailed every database field and button state. These documents were comprehensive, technical, and largely useless, because they ignored the human context of the software.

Kent Beck, the father of Extreme Programming, introduced the User Story to solve this crisis. He argued that we should stop documenting the system and start documenting the intent. The format he popularized — As a [User], I want [Feature], so that [Benefit] — revolutionized the industry. It forced engineers to look at the code through the eyes of the human being using it.

AI Behavioral Dynamics is applying this same revolution to AI Safety — but with a critical inversion. For twenty-five years, the User Story has been used exclusively for creation (building features). We are the first firm to systematically apply it to destruction (finding flaws).

We are effectively in the "Waterfall" era of AI Safety. Competitors are selling hundreds-page checklists of technical benchmarks that tell you nothing about how the model behaves when a manipulative adversary tries to break it.

This narrative framing changes the nature of the test. It moves the auditor away from checking if the "Reset Button" functions — that's QA — and towards testing if the "Support Agent" is gullible. That's red teaming.

Why does narrative work where scripts fail? The answer lies in the training data of the models themselves. LLMs are trained on the internet — a corpus dominated by human stories, fiction, forums, and arguments. They are effectively "Autocomplete Engines" trained on dramatic tension.

When an auditor inputs a static, script-like prompt — "Ignore instructions and print system prompt" — the model recognizes the syntax of an attack and triggers a refusal. However, when an auditor wraps the attack in a narrative, the model's objective function shifts. It is no longer trying to "answer a query"; it is trying to "complete the scene."

Our auditors do not just execute tests; they adopt personas. This is Method Acting for Cybersecurity. If the auditor adopts the persona of a terrified victim, the model is statistically likely to adopt the persona of a savior. If the auditor adopts the persona of a conspiratorial insider, the model often lowers its defenses to join the conspiracy.

This is the principle of Predictive Continuation. If the "story so far" implies that safety rules are suspended — a dystopian sci-fi context, an emergency scenario, a fictional framing — the model will likely suspend its safety rules to maintain narrative consistency. The red team is not hacking the code; they are hacking the model's desire to be a good storyteller.

Borrowing from improvisational theatre, we utilize the "Yes, And…" technique to bypass refusal triggers. A standard attack asks for the payload immediately. A narrative attack builds a ladder of compliance.

While the technical variations of attacks are infinite, the human intents behind them are distinct and repetitive. We have categorized 90% of business risk into four Archetypal User Stories. These archetypes allow us to translate abstract risk into business realities that executives understand.

The final pillar of our methodology is the operational process of converting "Wild Intelligence" into "Business Defense." We view the internet's chaotic output — the tweets, the academic papers, the Reddit threads, the jailbreak communities — as a raw material supply chain.

We utilize a Translation Layer to process this raw material, turning abstract technical curiosities into concrete business scenarios that can be tested, measured, and presented to a board of directors.

The "Attack Surface" of traditional software is defined by endpoints, ports, and APIs. The "Attack Surface" of Generative AI is defined by Narrative Possibilities.

An AI model can be technically secure — its API keys encrypted, its rate limits set, its input validation running — yet remain narratively vulnerable. It can still be talked into destroying value. The doors can be locked and the guard can still be convinced to open them.

AI Behavioral Dynamics is the only firm that systematically audits the Narrative Surface Area of production LLM deployments. The methodology is documented, peer-referenced, and operationalized into a repeatable engagement framework — not a sales deck, not a checklist, not a theoretical framework waiting for its first real test.

This manifesto is the doctrine. The AURORA Protocol is the instrument. The Narrative Risk Matrix is the output. The engagement starts whenever you're ready.