Recent cyber security solutions for wireless networks during internet open access have become critically important for personal data security. The newest WPA3 network security protocol has been used to maximize this protection; however, attackers can use an Evil Twin attack to replace a legitimate access point. The article is devoted to solving the problem of intrusion detection at the OSI model’s physical layers. To solve this, a hardware–software complex has been developed to collect information about the signal strength from Wi-Fi access points using wireless sensor networks. The collected data were supplemented with a generative algorithm considering all possible combinations of signal strength. The k-nearest neighbor model was trained on the obtained data to distinguish the signal strength of legitimate from illegitimate access points. To verify the authenticity of the data, an Evil Twin attack was physically simulated, and a machine learning model analyzed the data from the sensors. As a result, the Evil Twin attack was successfully identified based on the signal strength in the radio spectrum. The proposed model can be used in open access points as well as in large corporate and home Wi-Fi networks to detect intrusions aimed at substituting devices in the radio spectrum where IEEE 802.11 networking equipment operates.

The article examines the ways artificial intelligence is influencing the penetration testing procedure. As technology advances and cyber threats grow more common, conventional testing methods are insufficient. Artificial intelligence aids in automating processes like vulnerability detection and real-world attack simulation, leading to quicker, more precise results with reduced dependence on human input. Machine learning is a game-changer in identifying hidden security flaws by analyzing past attacks and abnormal patterns. Tools mentioned in the article are revolutionizing vulnerability detection, traffic monitoring, and attack simulations. These tools have better key performance metrics, such as scan time, false positive rate, detection accuracy, mean time to detect, zero-day threats/month, compared to traditional penetration testing tools.

This paper examines the Cyber Essentials requirements for ensuring basic security controls, which need to be implemented to protect against the most common cyber threats. Cyber Essentials is a foundational cybersecurity certification scheme developed by the UK government, which has been in operation since 2014 and under which more than 100,000 organizations have been certified. Unlike the international standard ISO 27001:2022, which implements a comprehensive approach to building an information security management system, Cyber Essentials is a basic level of protection against cyber threats, which is built based on five core controls. This work analyzes the use of Cyber Essentials controls such as firewalls, secure system configuration, patch management, user access control, and malware protection. Implementation of these controls can significantly reduce the risk of cyberattacks and maintain data confidentiality. This paper compares the two levels of Cyber Essentials certification: Cyber Essentials, which is based on an organization's self-assessment, and Cyber Essentials Plus, which includes a technical audit of the IT infrastructure to verify compliance with security requirements. Both certification levels require an independent assessment to ensure objectivity and impartiality in the certification process, as well as to increase confidence in the obtained certificate. Keywords: audit, certification, requirements, compliance, cybersecurity, cyber threats, Cyber Essentials, Cyber Essentials Plus.

The article explores a hybrid framework for autonomous penetration testing that integrates Large Language Models (LLMs) with Markov decision processes (MDP/POMDP) and reinforcement learning (RL). Conventional penetration testing is increasingly insufficient for modern, complex cyber threats. LLMs are utilized for high-level strategic planning, generating potential attack paths, while MDP/POMDP models combined with RL execute low-level actions under uncertainty. A feedback loop allows outcomes to refine strategies in dynamic and partially observable environments. A conceptual hybrid architecture has been proposed, accompanied by a workflow diagram and an illustrative table showing potential decision outcomes. This paradigm enhances automation, adaptability, efficiency, and scalability, providing a pathway toward next-generation AI-driven cybersecurity assessment tools.