Doradus Labs Submits Research to ESORICS 2026 on Casino Management System Security Assurance
We are pleased to announce that Doradus Labs has submitted a research paper to the 5th International Workshop on System Security Assurance (SecAssure), held in conjunction with the 31st European Symposium on Research in Computer Security (ESORICS 2026). The paper, titled Security Assurance for Casino Management Systems: A Threat Modeling and Architectural Vulnerability Assessment Framework, formalizes years of field experience securing casino environments and presents that work to the international academic security community.
Why this submission matters
The gaming sector operates under some of the most demanding constraints in critical infrastructure. Uptime is non-negotiable. Regulatory oversight is continuous. Cash, credit, and patron data flow through the same systems that drive the floor experience. And yet, when compared to energy, water, healthcare, or finance, the gaming industry receives a fraction of the academic security research attention. Operators are often left to retrofit assurance frameworks designed for other industries, frameworks that do not capture the unique trust boundaries of a casino floor, the constraints of long lived gaming devices, or the operational reality of a venue that never closes.
Our submission is intended to begin closing that gap.
What the paper proposes
The paper presents a security assurance framework specifically designed for casino management system (CMS) deployments. It is built around four contributions.
First, a threat model that adapts well established methodologies to gaming specific trust boundaries, including the floor network, the cage and count environment, vendor remote support channels, and the regulator interface.
Second, an architectural vulnerability taxonomy organized into five practical categories: network segmentation, cryptographic posture, authentication and authorization, diagnostic and management interface exposure, and integration trust.
Third, a non-disruptive assessment methodology that respects the realities of a live floor. Active scanning of gaming devices is not acceptable in production, so the methodology relies on documentation review, passive observation, controlled maintenance window probing, and benchmark validation.
Fourth, a compact set of assurance metrics that can be tracked over time at a single venue and aggregated across an operator portfolio, giving leadership a comparable view of their security posture rather than a one off audit snapshot.
The framework was validated retrospectively against four regional casino deployments across three regulatory jurisdictions. Following remediation engagements, every metric in every venue improved measurably, demonstrating that the framework is not only descriptive but actionable.
Why Doradus Labs is doing this work
Doradus Labs was founded on the belief that critical environments deserve more than reactive support. They deserve intelligent, integrated, and resilient infrastructure built for the realities of their industry. Our work with casino operators across the United States has surfaced patterns that no single venue could identify on its own. Bringing those patterns into a peer reviewed academic forum is a natural extension of our mission. It gives operators, regulators, and researchers a shared vocabulary for assurance, and it positions the gaming industry as a serious participant in the broader critical infrastructure conversation.
What comes next
The paper is now under review. Whether or not it is selected for the workshop, the framework it describes is already informing engagements with our clients. We intend to publish the assurance metrics in greater operational detail and to extend the work into adjacent areas, including insider risk modeling in coordination with surveillance and internal audit, and continuous instrumentation of the metrics for runtime assurance.
We invite operators, regulators, and fellow researchers to reach out. Our objective is a gaming industry where security assurance is measurable, comparable, and improving over time. We would welcome partners on that journey.
For more information about Doradus Labs and our work in managed IT, cybersecurity, and video analytics for the gaming industry, please visit our services page or contact us directly.