diff --git a/modules/security/live-attack-monitor-v2.sh b/modules/security/live-attack-monitor-v2.sh
index 92acd9d..1a862ae 100755
--- a/modules/security/live-attack-monitor-v2.sh
+++ b/modules/security/live-attack-monitor-v2.sh
@@ -747,8 +747,8 @@ apply_reputation_decay() {
         [ -z "$timestamps" ] && continue
 
         # Get most recent attack time
-        local last_attack=$(echo "$timestamps" | tr ',' '\n' | tail -1)
-        local time_since_attack=$((now - last_attack))
+        local last_attack=$(echo "$timestamps" | tr ',' '\n' 2>/dev/null | tail -1 2>/dev/null || echo "0")
+        local time_since_attack=$((now - ${last_attack:-0}))
 
         # If no activity for 6 hours, start decay
         if [ "$time_since_attack" -gt 21600 ]; then
@@ -797,7 +797,9 @@ calculate_context_bonus() {
         fi
 
         # Residential ISP (suspicious for server attacks)
-        if echo "$isp" | grep -qiE "(comcast|verizon|att|residential|cable|dsl|fiber|broadband)"; then
+        # Bash pattern matching (faster than grep subprocess)
+        local isp_lower="${isp,,}"  # Convert to lowercase
+        if [[ "$isp_lower" =~ (comcast|verizon|att|residential|cable|dsl|fiber|broadband) ]]; then
             bonus=$((bonus + 10))
             [ -n "$reasons" ] && reasons="${reasons}+" || reasons=""
             reasons="${reasons}RESIDENTIAL_ISP"
@@ -1888,9 +1890,10 @@ monitor_apache_logs() {
                 # Show ET detection if found
                 if [ "$et_attack_score" -gt 0 ]; then
                     # Show primary attack type (cleaner than full list)
-                    local primary_type=$(echo "$et_attack_types" | grep -oE 'SQLI|XSS|CMD|TRAVERSAL|WEBSHELL|RCE|UPLOAD|CVE' | head -1)
+                    local primary_type=$(echo "$et_attack_types" | grep -oE 'SQLI|XSS|CMD|TRAVERSAL|WEBSHELL|RCE|UPLOAD|CVE' | head -1 2>/dev/null || echo "")
                     if [ -z "$primary_type" ]; then
-                        primary_type=$(echo "$et_attack_types" | cut -d',' -f1)
+                        # Bash built-in: Get first field (100x faster than cut)
+                        primary_type="${et_attack_types%%,*}"
                     fi
                     log_line+=" | 🛡️ET:$primary_type"
 
@@ -1914,7 +1917,8 @@ monitor_apache_logs() {
 
                 # Show legacy attacks if no ET detection
                 if [ -n "$attacks" ] && [ "$et_attack_score" -eq 0 ]; then
-                    local first_attack=$(echo "$attacks" | cut -d',' -f1)
+                    # Bash built-in: Get first field (100x faster than cut)
+                    local first_attack="${attacks%%,*}"
                     local icon=$(get_attack_icon "$first_attack")
                     log_line+=" | $icon$first_attack"
                 fi
@@ -2308,8 +2312,8 @@ monitor_network_attacks() {
                 if command -v ss &>/dev/null; then
                     # PERFORMANCE: Cache ss output during high-severity attacks
                     # During Tier 3+ attacks, cache for 5 seconds to reduce CPU usage by 50%
-                    local current_time=$(date +%s)
-                    local cache_age=$((current_time - ss_cache_time))
+                    local current_time=$(date +%s 2>/dev/null || echo "${ss_cache_time:-0}")
+                    local cache_age=$((${current_time:-0} - ${ss_cache_time:-0}))
 
                     # Refresh cache if: (1) no cache, (2) cache > 5s old, (3) not in attack (always fresh)
                     local prev_severity="${ATTACK_SEVERITY:-0}"
@@ -2492,7 +2496,7 @@ monitor_network_attacks() {
                                         # ASN clustering detection
                                         if [ -n "$isp" ]; then
                                             # Extract ASN number from ISP string
-                                            local asn=$(echo "$isp" | grep -oP 'AS\K\d+' | head -1)
+                                            local asn=$(echo "$isp" | grep -oP 'AS\K\d+' 2>/dev/null | head -1 2>/dev/null || echo "")
                                             if [ -n "$asn" ]; then
                                                 echo "$asn" >> "$TEMP_DIR/attack_asns"
                                                 local asn_count=$(grep -c "^${asn}$" "$TEMP_DIR/attack_asns" 2>/dev/null || echo "0")
@@ -2667,9 +2671,9 @@ monitor_network_attacks() {
                                 # Geographic clustering bonus
                                 local geo_bonus=0
                                 if [ -f "$TEMP_DIR/threat_enrich_${ip//\./_}" ]; then
-                                    local threat_data=$(cat "$TEMP_DIR/threat_enrich_${ip//\./_}")
-                                    local ip_geo=$(echo "$threat_data" | cut -d'|' -f5)
-                                    local ip_isp=$(echo "$threat_data" | cut -d'|' -f4)
+                                    local threat_data=$(cat "$TEMP_DIR/threat_enrich_${ip//\./_}" 2>/dev/null || echo "")
+                                    # Bash IFS field splitting (100x faster than cut)
+                                    IFS='|' read -r _ _ _ ip_isp ip_geo _ <<< "$threat_data"
 
                                     # Check if from hostile country (5+ attackers)
                                     if [ -n "$ip_geo" ] && grep -q "^${ip_geo}$" "$TEMP_DIR/hostile_countries" 2>/dev/null; then
@@ -2678,7 +2682,7 @@ monitor_network_attacks() {
 
                                     # Check if from hostile ASN (3+ attackers)
                                     if [ -n "$ip_isp" ]; then
-                                        local ip_asn=$(echo "$ip_isp" | grep -oP 'AS\K\d+' | head -1)
+                                        local ip_asn=$(echo "$ip_isp" | grep -oP 'AS\K\d+' 2>/dev/null | head -1 2>/dev/null || echo "")
                                         if [ -n "$ip_asn" ] && grep -q "^${ip_asn}$" "$TEMP_DIR/hostile_asns" 2>/dev/null; then
                                             geo_bonus=$((geo_bonus + 15))  # Same botnet infrastructure
                                         fi
diff --git a/modules/security/live-attack-monitor.sh b/modules/security/live-attack-monitor.sh
index 92acd9d..1a862ae 100755
--- a/modules/security/live-attack-monitor.sh
+++ b/modules/security/live-attack-monitor.sh
@@ -747,8 +747,8 @@ apply_reputation_decay() {
         [ -z "$timestamps" ] && continue
 
         # Get most recent attack time
-        local last_attack=$(echo "$timestamps" | tr ',' '\n' | tail -1)
-        local time_since_attack=$((now - last_attack))
+        local last_attack=$(echo "$timestamps" | tr ',' '\n' 2>/dev/null | tail -1 2>/dev/null || echo "0")
+        local time_since_attack=$((now - ${last_attack:-0}))
 
         # If no activity for 6 hours, start decay
         if [ "$time_since_attack" -gt 21600 ]; then
@@ -797,7 +797,9 @@ calculate_context_bonus() {
         fi
 
         # Residential ISP (suspicious for server attacks)
-        if echo "$isp" | grep -qiE "(comcast|verizon|att|residential|cable|dsl|fiber|broadband)"; then
+        # Bash pattern matching (faster than grep subprocess)
+        local isp_lower="${isp,,}"  # Convert to lowercase
+        if [[ "$isp_lower" =~ (comcast|verizon|att|residential|cable|dsl|fiber|broadband) ]]; then
             bonus=$((bonus + 10))
             [ -n "$reasons" ] && reasons="${reasons}+" || reasons=""
             reasons="${reasons}RESIDENTIAL_ISP"
@@ -1888,9 +1890,10 @@ monitor_apache_logs() {
                 # Show ET detection if found
                 if [ "$et_attack_score" -gt 0 ]; then
                     # Show primary attack type (cleaner than full list)
-                    local primary_type=$(echo "$et_attack_types" | grep -oE 'SQLI|XSS|CMD|TRAVERSAL|WEBSHELL|RCE|UPLOAD|CVE' | head -1)
+                    local primary_type=$(echo "$et_attack_types" | grep -oE 'SQLI|XSS|CMD|TRAVERSAL|WEBSHELL|RCE|UPLOAD|CVE' | head -1 2>/dev/null || echo "")
                     if [ -z "$primary_type" ]; then
-                        primary_type=$(echo "$et_attack_types" | cut -d',' -f1)
+                        # Bash built-in: Get first field (100x faster than cut)
+                        primary_type="${et_attack_types%%,*}"
                     fi
                     log_line+=" | 🛡️ET:$primary_type"
 
@@ -1914,7 +1917,8 @@ monitor_apache_logs() {
 
                 # Show legacy attacks if no ET detection
                 if [ -n "$attacks" ] && [ "$et_attack_score" -eq 0 ]; then
-                    local first_attack=$(echo "$attacks" | cut -d',' -f1)
+                    # Bash built-in: Get first field (100x faster than cut)
+                    local first_attack="${attacks%%,*}"
                     local icon=$(get_attack_icon "$first_attack")
                     log_line+=" | $icon$first_attack"
                 fi
@@ -2308,8 +2312,8 @@ monitor_network_attacks() {
                 if command -v ss &>/dev/null; then
                     # PERFORMANCE: Cache ss output during high-severity attacks
                     # During Tier 3+ attacks, cache for 5 seconds to reduce CPU usage by 50%
-                    local current_time=$(date +%s)
-                    local cache_age=$((current_time - ss_cache_time))
+                    local current_time=$(date +%s 2>/dev/null || echo "${ss_cache_time:-0}")
+                    local cache_age=$((${current_time:-0} - ${ss_cache_time:-0}))
 
                     # Refresh cache if: (1) no cache, (2) cache > 5s old, (3) not in attack (always fresh)
                     local prev_severity="${ATTACK_SEVERITY:-0}"
@@ -2492,7 +2496,7 @@ monitor_network_attacks() {
                                         # ASN clustering detection
                                         if [ -n "$isp" ]; then
                                             # Extract ASN number from ISP string
-                                            local asn=$(echo "$isp" | grep -oP 'AS\K\d+' | head -1)
+                                            local asn=$(echo "$isp" | grep -oP 'AS\K\d+' 2>/dev/null | head -1 2>/dev/null || echo "")
                                             if [ -n "$asn" ]; then
                                                 echo "$asn" >> "$TEMP_DIR/attack_asns"
                                                 local asn_count=$(grep -c "^${asn}$" "$TEMP_DIR/attack_asns" 2>/dev/null || echo "0")
@@ -2667,9 +2671,9 @@ monitor_network_attacks() {
                                 # Geographic clustering bonus
                                 local geo_bonus=0
                                 if [ -f "$TEMP_DIR/threat_enrich_${ip//\./_}" ]; then
-                                    local threat_data=$(cat "$TEMP_DIR/threat_enrich_${ip//\./_}")
-                                    local ip_geo=$(echo "$threat_data" | cut -d'|' -f5)
-                                    local ip_isp=$(echo "$threat_data" | cut -d'|' -f4)
+                                    local threat_data=$(cat "$TEMP_DIR/threat_enrich_${ip//\./_}" 2>/dev/null || echo "")
+                                    # Bash IFS field splitting (100x faster than cut)
+                                    IFS='|' read -r _ _ _ ip_isp ip_geo _ <<< "$threat_data"
 
                                     # Check if from hostile country (5+ attackers)
                                     if [ -n "$ip_geo" ] && grep -q "^${ip_geo}$" "$TEMP_DIR/hostile_countries" 2>/dev/null; then
@@ -2678,7 +2682,7 @@ monitor_network_attacks() {
 
                                     # Check if from hostile ASN (3+ attackers)
                                     if [ -n "$ip_isp" ]; then
-                                        local ip_asn=$(echo "$ip_isp" | grep -oP 'AS\K\d+' | head -1)
+                                        local ip_asn=$(echo "$ip_isp" | grep -oP 'AS\K\d+' 2>/dev/null | head -1 2>/dev/null || echo "")
                                         if [ -n "$ip_asn" ] && grep -q "^${ip_asn}$" "$TEMP_DIR/hostile_asns" 2>/dev/null; then
                                             geo_bonus=$((geo_bonus + 15))  # Same botnet infrastructure
                                         fi