
Modern digital infrastructure is defended by systems that are fundamentally reactive. Telemetry is collected after actions occur, detections trigger after damage begins, and response is gated by human triage operating under time pressure. This architecture fails against AI-speed adversaries whose attack loops operate orders of magnitude faster than human decision cycles. We introduce Autonomous Defense Transformers (ADT), a security-native model class designed to reason continuously over live infrastructure state, interpret threats under uncertainty, validate defensive actions against explicit constraints, and generate audit-grade evidence as a first-class output. ADT is defined by five core design principles: defense-first pretraining, continuous model-level reasoning, integrated actuation under constraints, zero-trust alignment, and guardrailed learning. We present a complete system architecture separating context ingestion, threat interpretation, action validation, actuation, and audit trail generation. We provide a technical comparison with SIEM, SOAR, rule engines, and LLM-wrapper approaches, and define an evaluation framework focused on containment correctness, evidence completeness, and cost-weighted false positives. Deployment results from the PulseADT production system demonstrate 359x faster detection (0.8 min MTTD vs. 287 min industry average), 200x faster response (2.1 min MTTR vs. 420 min industry average), and 95% false positive reduction (1.2% vs. 23.5% industry average) across 680,000 protected assets. We conclude by discussing implications for enterprise resilience, regulatory enforcement, and national infrastructure security, with particular attention to African computing contexts.
transformer reasoning, safety gating, Server security, autonomous defense, auditability, African cybersecurity, infrastructure security, compliance enforcement, cloud security
transformer reasoning, safety gating, Server security, autonomous defense, auditability, African cybersecurity, infrastructure security, compliance enforcement, cloud security
| selected citations These citations are derived from selected sources. This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically). | 0 | |
| popularity This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network. | Average | |
| influence This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically). | Average | |
| impulse This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network. | Average |
