Editing Chapter 6: Edge Security and Privacy (section)

==='''Attack Detection, Incident Response, and Autonomy'''===

Edge systems often function autonomously with limited supervision, making attack detection and mitigation more difficult.

'''Key Risk''': AI-driven anomaly detection systems require historical data and ongoing telemetry, which may not be available in disconnected or low-bandwidth deployments.

'''Operational Limitation''': Many edge devices lack secure logging or rollback mechanisms, making it difficult to verify the root cause of incidents or recover quickly.

'''Case Study''': At the University of Twente, a testbed for Industrial IoT systems showed that edge devices exposed to physical tampering could not escalate alerts promptly due to weak local intelligence and intermittent connectivity.