Offensive cyber capability documentation

Identifies documents containing references to offensive cyber capability documentation in Australian contexts. This information type is classified as personally identifiable information under the Privacy Act 1988.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: structural regex with domain-specific anchors and constrained context replaces phrase-only marker.
Jurisdictions: global
Regulations: Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), Privacy Act 1988 (Cth)
Frameworks: ISO 27001
Data categories: government-id, pii
Scope: wide
Risk rating: 8
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:offensive\s+cyber|exploit\s+framework|capability\s+development)\b

Corroborative evidence keywords

offensive cyber capability documentation, offensive, cyber, capability, documentation, defense, intelligence, government, agency, department, ministry, public sector, civil service, welfare, social services, public administration, statutory authority, regulatory body, public servant, government program (+2 more)

Proximity: 300 characters

Should match

Offensive cyber — Topic phrase present
offensive cyber — Topic phrase, lowercase
this record references the offensive cyber held on file — Topic phrase within surrounding text
Offensive cyber Hostname: app-prd-01.corp.local username: svc_deploy Source 10.20.30.40 tcp/443 — Populated technical artefact reaching the 75/85 structure gate

Should not match

unrelated generic text — No relevant phrase context
placeholder value 12345 — Random text should not match phrase marker
generic policy prose without anchors — Should reject generic mentions without structural anchor terms
Offensive cyber: Hostname: username: — Empty form: the heading and field labels without values must not corroborate themselves (discovery only)
Policy guidance: this procedure explains how records about offensive cyber are handled, who may access them and how long they are kept. It contains no records about any person or system. — Policy guidance naming the topic without any record (discovery only)

Known false positives

Common words and phrases related to offensive cyber capability documentation appearing in policy documents, training materials, HR templates, or compliance guidelines without actual personal data. Mitigation: Require corroborative evidence keywords within the proximity window to confirm sensitive data context rather than general discussion.
In Australian English, similar terminology used in formal or administrative contexts (education, professional documentation) that does not constitute sensitive data collection. Mitigation: Layer with additional contextual signals such as structured identifiers, form fields, or database column headers to distinguish sensitive records from general references.
High-frequency pattern matches in large document corpora due to broad regex anchors. Expected match rate is significantly higher than specific identifier patterns. Mitigation: Tune confidence thresholds for bulk scanning. Consider using this pattern primarily as a pre-filter with secondary validation.