An Adaptive Architecture for Cybersecurity Threat Intelligence: A Case Study on Kenyan Courts

Abstract

Current threat intelligence systems often lack scalable, adaptive AI architectures capable of delivering real-time incident detection and dynamic response, particularly in resource-constrained environments. This paper presents a novel AI-driven architectural design for operational threat intelligence, specifically tailored to enhance cybersecurity in global and Kenyan judiciaries. The proposed model integrates three foundational frameworks, which are Integrated Adaptive Cyber Defence (IACD), the Cyber Kill Chain, and Moving Target Defence (MTD), into an architecture that supports real-time data ingestion, continuous AI model retraining, and automated response orchestration. The research design for this study adopts a mixed-methods approach, combining qualitative and quantitative methods to ensure a comprehensive understanding of the AI-driven operational Cyber Threat Intelligence (CTI) model. Key features include a dynamic feedback loop for adaptive learning, AI-powered multi-stage threat detection aligned with attack lifecycle mapping, and resource-efficient dynamic defence mechanisms suitable for low-resource judicial environments. This design significantly improves incident response capabilities by enabling faster, more accurate threat detection and automated mitigation, reducing mean time to detect and respond. By providing a scalable, transparent, and explainable AI model, the architecture offers a practical blueprint for enhancing cybersecurity resilience in judicial systems worldwide, with applicability to the unique challenges faced by Kenyan courts. This work lays the foundation for future extensions involving federated learning to enable secure, multi-court deployments, further strengthening collective judicial cybersecurity defences.