diff --git a/core/lib/Module/Module.php b/core/lib/Module/Module.php
index adb1222..cb54b2a 100644
--- a/core/lib/Module/Module.php
+++ b/core/lib/Module/Module.php
@@ -13,7 +13,7 @@ use KTXC\Service\TenantFirewallRuleService;
 use KTXC\Service\TenantFirewallStatusService;
 use KTXF\Event\DeliveryMode;
 use KTXF\Event\EventListenerRegistrarInterface;
-use KTXF\Event\SecurityEvent;
+use KTXC\Security\Event\SecurityEvent;
 use KTXF\Module\ModuleBrowserInterface;
 use KTXF\Module\ModuleConsoleInterface;
 use KTXF\Module\ModuleInstanceAbstract;
diff --git a/shared/lib/Event/SecurityEvent.php b/core/lib/Security/Event/SecurityEvent.php
similarity index 99%
rename from shared/lib/Event/SecurityEvent.php
rename to core/lib/Security/Event/SecurityEvent.php
index 147eb0c..9f51cf7 100644
--- a/shared/lib/Event/SecurityEvent.php
+++ b/core/lib/Security/Event/SecurityEvent.php
@@ -2,7 +2,9 @@
 
 declare(strict_types=1);
 
-namespace KTXF\Event;
+namespace KTXC\Security\Event;
+
+use KTXF\Event\Event;
 
 /**
  * Security-specific event for authentication and access control events
diff --git a/core/lib/Service/FirewallRuleManager.php b/core/lib/Service/FirewallRuleManager.php
index 475e371..fc59a17 100644
--- a/core/lib/Service/FirewallRuleManager.php
+++ b/core/lib/Service/FirewallRuleManager.php
@@ -7,7 +7,7 @@ namespace KTXC\Service;
 use KTXC\Models\Firewall\FirewallRuleObject;
 use KTXC\Stores\FirewallStore;
 use KTXF\Event\EventDispatcherInterface;
-use KTXF\Event\SecurityEvent;
+use KTXC\Security\Event\SecurityEvent;
 use KTXF\IpUtils;
 
 final class FirewallRuleManager
diff --git a/core/lib/Service/FirewallService.php b/core/lib/Service/FirewallService.php
index cc68518..94d4275 100644
--- a/core/lib/Service/FirewallService.php
+++ b/core/lib/Service/FirewallService.php
@@ -10,7 +10,7 @@ use KTXC\Models\Firewall\FirewallLogObject;
 use KTXC\Stores\FirewallStore;
 use KTXC\Context\TenantContextInterface;
 use KTXF\Event\EventDispatcherInterface;
-use KTXF\Event\SecurityEvent;
+use KTXC\Security\Event\SecurityEvent;
 use KTXF\IpUtils;
 
 /**
diff --git a/core/lib/Service/FirewallSettingsService.php b/core/lib/Service/FirewallSettingsService.php
index 3c41d76..c9d0b79 100644
--- a/core/lib/Service/FirewallSettingsService.php
+++ b/core/lib/Service/FirewallSettingsService.php
@@ -6,7 +6,7 @@ namespace KTXC\Service;
 
 use KTXC\Models\Tenant\TenantConfiguration;
 use KTXF\Event\EventDispatcherInterface;
-use KTXF\Event\SecurityEvent;
+use KTXC\Security\Event\SecurityEvent;
 
 final class FirewallSettingsService
 {
diff --git a/tests/php/Unit/Module/CoreModuleTest.php b/tests/php/Unit/Module/CoreModuleTest.php
index da19e0e..66c0423 100644
--- a/tests/php/Unit/Module/CoreModuleTest.php
+++ b/tests/php/Unit/Module/CoreModuleTest.php
@@ -17,7 +17,7 @@ use KTXC\Service\SystemFirewallStatusService;
 use KTXC\Service\TenantFirewallRuleService;
 use KTXF\Event\DeliveryMode;
 use KTXC\Event\EventListenerRegistry;
-use KTXF\Event\SecurityEvent;
+use KTXC\Security\Event\SecurityEvent;
 use PHPUnit\Framework\Attributes\Test;
 use PHPUnit\Framework\Attributes\TestDox;
 use PHPUnit\Framework\TestCase;
diff --git a/tests/php/Unit/Service/FirewallRuleManagerTest.php b/tests/php/Unit/Service/FirewallRuleManagerTest.php
index ce832ad..641bb56 100644
--- a/tests/php/Unit/Service/FirewallRuleManagerTest.php
+++ b/tests/php/Unit/Service/FirewallRuleManagerTest.php
@@ -11,7 +11,7 @@ use KTXC\Service\FirewallRuleManager;
 use KTXC\Service\FirewallRuleScope;
 use KTXC\Stores\FirewallStore;
 use KTXF\Event\EventDispatcherInterface;
-use KTXF\Event\SecurityEvent;
+use KTXC\Security\Event\SecurityEvent;
 use PHPUnit\Framework\Attributes\AllowMockObjectsWithoutExpectations;
 use PHPUnit\Framework\Attributes\TestDox;
 use PHPUnit\Framework\MockObject\MockObject;
diff --git a/tests/php/Unit/Service/FirewallServiceTest.php b/tests/php/Unit/Service/FirewallServiceTest.php
index bd233d8..95c9f7b 100644
--- a/tests/php/Unit/Service/FirewallServiceTest.php
+++ b/tests/php/Unit/Service/FirewallServiceTest.php
@@ -210,7 +210,7 @@ class FirewallServiceTest extends TestCase
                     && $log->getEventType() === FirewallLogObject::EVENT_RULE_MATCH;
             }))
             ->willReturnArgument(0);
-        $event = \KTXF\Event\SecurityEvent::accessDenied(
+        $event = \KTXC\Security\Event\SecurityEvent::accessDenied(
             '203.0.113.10',
             null,
             'tenant-rule',
@@ -234,7 +234,7 @@ class FirewallServiceTest extends TestCase
                     && $log->getRuleScope() === FirewallRuleObject::SCOPE_SYSTEM;
             }))
             ->willReturnArgument(0);
-        $event = \KTXF\Event\SecurityEvent::accessDenied(
+        $event = \KTXC\Security\Event\SecurityEvent::accessDenied(
             '203.0.113.10',
             null,
             'system-rule',
@@ -252,7 +252,7 @@ class FirewallServiceTest extends TestCase
         $this->store->expects($this->never())->method('createLog');
 
         $this->service->logSecurityEvent(
-            \KTXF\Event\SecurityEvent::authFailure('203.0.113.10')
+            \KTXC\Security\Event\SecurityEvent::authFailure('203.0.113.10')
         );
     }
 
@@ -271,7 +271,7 @@ class FirewallServiceTest extends TestCase
                     && $metadata['windowSeconds'] === 60;
             }))
             ->willReturnArgument(0);
-        $event = \KTXF\Event\SecurityEvent::rateLimitExceeded(
+        $event = \KTXC\Security\Event\SecurityEvent::rateLimitExceeded(
             '203.0.113.10',
             101,
             60,
@@ -296,8 +296,8 @@ class FirewallServiceTest extends TestCase
                     && $log->getMetadata()['detector'] === 'payload-signature';
             }))
             ->willReturnArgument(0);
-        $event = \KTXF\Event\SecurityEvent::create(
-            \KTXF\Event\SecurityEvent::SUSPICIOUS_ACTIVITY,
+        $event = \KTXC\Security\Event\SecurityEvent::create(
+            \KTXC\Security\Event\SecurityEvent::SUSPICIOUS_ACTIVITY,
             '203.0.113.20',
             null,
             ['detector' => 'payload-signature']
@@ -323,8 +323,8 @@ class FirewallServiceTest extends TestCase
                     && $log->getIdentityId() === 'operator';
             }))
             ->willReturnArgument(0);
-        $event = new \KTXF\Event\SecurityEvent(
-            \KTXF\Event\SecurityEvent::FIREWALL_RULE_DISABLED,
+        $event = new \KTXC\Security\Event\SecurityEvent(
+            \KTXC\Security\Event\SecurityEvent::FIREWALL_RULE_DISABLED,
             [
                 'ruleId' => 'rule-123',
                 'ruleScope' => FirewallRuleObject::SCOPE_SYSTEM,
@@ -349,8 +349,8 @@ class FirewallServiceTest extends TestCase
                 && $log->getMetadata()['changeReason'] === 'Tighten controls'
             ))
             ->willReturnArgument(0);
-        $event = new \KTXF\Event\SecurityEvent(
-            \KTXF\Event\SecurityEvent::FIREWALL_SETTINGS_UPDATED,
+        $event = new \KTXC\Security\Event\SecurityEvent(
+            \KTXC\Security\Event\SecurityEvent::FIREWALL_SETTINGS_UPDATED,
             ['changeReason' => 'Tighten controls']
         );
         $event->setTenantId('tenant-a')->setIdentityId('operator');
@@ -376,7 +376,7 @@ class FirewallServiceTest extends TestCase
             ->willReturn(4);
         $this->events->expects($this->never())->method('dispatch');
 
-        $event = \KTXF\Event\SecurityEvent::authFailure('203.0.113.10');
+        $event = \KTXC\Security\Event\SecurityEvent::authFailure('203.0.113.10');
         $event->setTenantId('tenant-a');
         $this->service->handleAuthFailure($event);
 
@@ -400,7 +400,7 @@ class FirewallServiceTest extends TestCase
             ->with('tenant-a', '203.0.113.10', 300)
             ->willReturn(0);
 
-        $event = \KTXF\Event\SecurityEvent::authFailure('203.0.113.10');
+        $event = \KTXC\Security\Event\SecurityEvent::authFailure('203.0.113.10');
         $event->setTenantId('tenant-a');
         $this->service->handleAuthFailure($event);
     }
@@ -449,12 +449,12 @@ class FirewallServiceTest extends TestCase
                 &$lifecycleOrigin
             ): void {
                 $publishedTenants[] = $event->getTenantId();
-                if ($event->getName() === \KTXF\Event\SecurityEvent::FIREWALL_RULE_CREATED) {
+                if ($event->getName() === \KTXC\Security\Event\SecurityEvent::FIREWALL_RULE_CREATED) {
                     $lifecycleOrigin = $event->get('origin');
                 }
             });
 
-        $event = \KTXF\Event\SecurityEvent::authFailure('203.0.113.10');
+        $event = \KTXC\Security\Event\SecurityEvent::authFailure('203.0.113.10');
         $event->setTenantId('tenant-event');
         $this->service->handleAuthFailure($event);
 
@@ -478,7 +478,7 @@ class FirewallServiceTest extends TestCase
         $this->events->expects($this->never())->method('dispatch');
 
         $this->service->handleAuthFailure(
-            \KTXF\Event\SecurityEvent::authFailure('203.0.113.10')
+            \KTXC\Security\Event\SecurityEvent::authFailure('203.0.113.10')
         );
     }
 
@@ -492,7 +492,7 @@ class FirewallServiceTest extends TestCase
             ->willReturn(0);
 
         $this->service->handleAuthFailure(
-            \KTXF\Event\SecurityEvent::authFailure('203.0.113.10')
+            \KTXC\Security\Event\SecurityEvent::authFailure('203.0.113.10')
         );
     }
 
@@ -504,7 +504,7 @@ class FirewallServiceTest extends TestCase
         $this->store->expects($this->never())->method('depositRule');
 
         $this->service->handleAuthFailure(
-            \KTXF\Event\SecurityEvent::authFailure('203.0.113.10')
+            \KTXC\Security\Event\SecurityEvent::authFailure('203.0.113.10')
         );
     }
 
@@ -518,7 +518,7 @@ class FirewallServiceTest extends TestCase
             ->method('countRecentFailures')
             ->with('tenant-a', '203.0.113.10', 300)
             ->willReturn(1);
-        $event = \KTXF\Event\SecurityEvent::authFailure('203.0.113.10');
+        $event = \KTXC\Security\Event\SecurityEvent::authFailure('203.0.113.10');
         $eventId = $event->getEventId();
 
         $this->service->handleAuthFailure($event);
diff --git a/tests/php/Unit/Service/FirewallSettingsServiceTest.php b/tests/php/Unit/Service/FirewallSettingsServiceTest.php
index 3b6b972..18c958a 100644
--- a/tests/php/Unit/Service/FirewallSettingsServiceTest.php
+++ b/tests/php/Unit/Service/FirewallSettingsServiceTest.php
@@ -9,7 +9,7 @@ use KTXC\Models\Tenant\TenantObject;
 use KTXC\Service\FirewallSettingsService;
 use KTXC\Service\TenantService;
 use KTXF\Event\EventDispatcherInterface;
-use KTXF\Event\SecurityEvent;
+use KTXC\Security\Event\SecurityEvent;
 use PHPUnit\Framework\Attributes\TestDox;
 use PHPUnit\Framework\TestCase;