Research

I study why known risks go unprioritized in complex systems, and how security practice keeps up as those systems take on AI.

Publications

Beyond the Pipe: A System-of-Systems Profile of NIST CSF 2.0 for Resilient Urban Lifelines, Diagnosed Through ISO 31000to appear
T. Imanian. 2026 IEEE International Smart Cities Conference (ISC2).

Reads the 2025 Richmond water crisis and the 2021 Texas grid-to-water cascade through ISO 31000, and finds that in both cases the risks were known but prioritized wrong. The failure sits upstream, in how context is set and risks are identified and analyzed. The paper proposes a lifeline system-of-systems profile of NIST CSF 2.0 to address it.

City lifelines fail together. In Texas in 2021, the break that mattered was between power and water.

Research interests

Emergent risk in systems of systems and critical infrastructure
Risk management frameworks, including NIST CSF 2.0 and ISO 31000
AI threat modeling and adversarial machine learning
The handoff between vulnerability management and security operations