cqrenet/antifragile
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

One current version: replace quantum framework doc with interdiction-framework.md, rewrite Book VII + model doc in cut language, drop all rename/history notes

Browse Source
This commit is contained in:
Anikke
2026-09-20 12:20:03 +02:00
parent aa3501250d
commit b9f524caa0
8 changed files with 175 additions and 187 deletions
Download Patch File Download Diff File Expand all files Collapse all files
antifragile-consulting/README.md
+2 -2
View File
@@ -35,8 +35,8 @@ Most security and resilience frameworks optimize for **robustness**—the abilit
│ ├── executive-summary-cs.md # Czech version of board brief (Výkonné shrnutí)
│ ├── c-suite-conversation-guide.md # Persuasion scripts for top management
│ ├── t0-asset-framework.md # Tier 0 asset classification and protection
│ ├── quantum-vulnerability-management.md # Original quanta model — superseded by interdiction-model.md
│ └── interdiction-model.md # Minimum-cost cuts on a two-weight attack graph (current doctrine, Book VII companion)
│ ├── interdiction-model.md # Formal model: minimum-cost cuts on a two-weight attack graph
│ └── interdiction-framework.md # The engagement runbook: sort key, cut classes, barbell, ~90% subtraction (Book VII companion)
├── playbooks/ # Executable modernisation and response plans
│ ├── rapid-modernisation-plan.md # 30-60-90-180 day transformation roadmap
│ ├── endpoint-management-entry-vector.md # Intune/device management as engagement entry point
antifragile-consulting/books/06-vulnerability-management.md
+23 -23
View File
@@ -6,10 +6,6 @@
---
> **Terminology note (September 2026).** This book's doctrine has been sharpened into the **[Interdiction Model](../core/interdiction-model.md)**: the "quantum" is now the **cut** — every remediation priced as the removal of an edge in the attack graph, the planning object the minimum-cost cut that severs every mapped path to a crown jewel. The four lanes survive as cut classes (hour / day / sprint / dark), joined by a fifth, *declined*; the programme metric is cut depth (κ). The text below retains the original "quantum" wording; read them as the same discipline.
---
## The governing question
The first six books were written for a world in which the dominant way into an estate was a person — phished, tricked, talked past the controls. That assumption is now wrong. As of the 2026 Verizon DBIR, **exploitation of vulnerabilities is the leading initial-access vector in confirmed breaches — roughly twice phishing, for the first time in the report's history.** The front door changed. This book changes the lens to match.
@@ -43,7 +39,7 @@ One piece of good news hides in the data, and the whole framework leans on it: *
### CVSS as the prioritisation engine
The original sin. CVSS scores *severity in the abstract* — it knows nothing about whether the vulnerable asset is internet-reachable, whether it sits on the kill chain, whether an exploit exists, or whether an existing control already neutralises it. A 9.8 on a segmented, non-privileged, unreachable host is noise; a 7.5 on an internet-facing box one hop from a domain controller is a P0. Sorting 40,000 findings by CVSS produces a list that is precisely uncorrelated with where the attacker will actually go. It feels like prioritisation. It is sorting by the wrong key.
The original sin. CVSS scores *severity in the abstract* — it knows nothing about whether the vulnerable asset is internet-reachable, whether it sits on the kill chain, whether an exploit exists, or whether an existing control already neutralises it. A 9.8 on a segmented, non-privileged, unreachable host is noise; a 7.5 on an internet-facing box one hop from a domain controller is an hour-cut. Sorting 40,000 findings by CVSS produces a list that is precisely uncorrelated with where the attacker will actually go. It feels like prioritisation. It is sorting by the wrong key.
### The infinite, undifferentiated backlog
@@ -59,7 +55,7 @@ Book I's ghost-policy corollary, applied to vulnerabilities. A patch deployed to
### The unscanned and the unscannable
You cannot prioritise what you cannot see. The fleet you don't scan (Book IV's shadow and dark device populations), the appliance whose firmware no scanner reads, the SaaS you don't own, the dependency buried three layers into a container image — these are the dangerous quanta precisely because they carry no score at all. An estate that congratulates itself on draining the *known* backlog while the unknown surface grows is optimising the lit area under the streetlight.
You cannot prioritise what you cannot see. The fleet you don't scan (Book IV's shadow and dark device populations), the appliance whose firmware no scanner reads, the SaaS you don't own, the dependency buried three layers into a container image — these are the dark cuts precisely because they carry no score at all. An estate that congratulates itself on draining the *known* backlog while the unknown surface grows is optimising the lit area under the streetlight.
### Reachability and compensating controls left unmapped
@@ -81,44 +77,48 @@ The defining act of antifragile vulnerability management is **subtraction before
1. **Remove CVSS as the sort key.** It does not go away — it stays as one input — but it stops being the thing that orders the queue. The queue is ordered by kill-chain position and exploitability in *this* environment.
2. **Remove the ~90% of criticals that aren't exploitable here.** Map reachability and compensating controls and *delete the false urgency* on everything segmented, unreachable, or already neutralised. This is the single highest-leverage move in the entire programme: it turns "40,000 criticals" into "400 that are real and 40 that are on fire," and it is pure subtraction.
3. **Remove the undifferentiated backlog.** A backlog with no structure is itself a fragility. Replace it with quanta (Section 3) — time-budgeted, atomic, completable units. An item that cannot be placed in a quantum is either not real (delete it) or not yet understood (route it to discovery).
3. **Remove the undifferentiated backlog.** A backlog with no structure is itself a fragility. Replace it with cuts (Section 3) — time-budgeted, atomic, completable units. An item that cannot be sized into a cut is either not real (delete it) or not yet understood (route it to discovery).
4. **Remove "patch faster" as the headline strategy.** Demote velocity to what it is — a lever for the long tail — and stop letting it consume the budget that belongs to reachability, blast radius, and containment.
5. **Remove the half-done remediation from the "done" column.** A fix is not done until it is *verified to enforce* against a real test, not until the ticket is closed. Every quantum closes with a signal or it does not close. (Book I: validate by observation, never by inspection.)
6. **Remove human handoffs from the hours-lane.** The steps in the critical-quantum pipeline that require no judgement — detection, reachability assessment, work-item generation, routing — get automated within policy guardrails so the scarce human judgement is spent only where judgement is actually required. You are not removing the human; you are removing the human from the steps that were only ever latency.
5. **Remove the half-done remediation from the "done" column.** A fix is not done until it is *verified to enforce* against a real test, not until the ticket is closed. Every cut closes with a signal or it does not close. (Book I: validate by observation, never by inspection.)
6. **Remove human handoffs from the hours-lane.** The steps in the hour-cut pipeline that require no judgement — detection, reachability assessment, work-item generation, routing — get automated within policy guardrails so the scarce human judgement is spent only where judgement is actually required. You are not removing the human; you are removing the human from the steps that were only ever latency.
---
## 3. Quantum vulnerability management — the core model
## 3. Cuts — the core model
Here is the model the rest of the book turns on, and the direct answer to "how do we size remediation to a world that moves in hours."
A **quantum** is the smallest unit of remediation that (a) fully closes a specific exploitable path, (b) is sized to a time budget it can *actually be completed within*, and (c) ends in a verifiable signal. The word is deliberate. A quantum is *atomic* — you cannot ship half of it and claim half the protection (that is the ghost patch). And it is *discrete* — work is packetised into units that fit the time you have, not smeared across an infinite backlog.
A **cut** is the smallest unit of remediation that (a) fully removes a specific exploitable path — an edge the adversary could actually walk, (b) is sized to a time budget it can *actually be completed within*, and (c) ends in a verifiable signal. The word is deliberate. A cut is *atomic* — you cannot sever half an edge and claim half the protection (that is the ghost patch). And it is *discrete* — work is packetised into units that fit the time you have, not smeared across an infinite backlog.
The sort key is not severity. It is **time-to-existential-impact**, which is a function of three things the estate actually determines:
> **kill-chain position × reachability × exploit availability**
A vulnerability that sits on the path to existential compromise, is reachable by the adversary, and has a working exploit in the wild has a time-to-impact measured in hours. The same vulnerability, segmented away and unreachable, has a time-to-impact measured in months — or never. **The vulnerability is identical; its quantum is different, because its position is different.** This is the Book I principle (kill-chain position changes priority, not the CVE) made operational.
A vulnerability that sits on the path to existential compromise, is reachable by the adversary, and has a working exploit in the wild has a time-to-impact measured in hours. The same vulnerability, segmented away and unreachable, has a time-to-impact measured in months — or never. **The vulnerability is identical; its cut class is different, because its position is different.** This is the Book I principle (kill-chain position changes priority, not the CVE) made operational.
That sort produces three live quanta and one that is more dangerous than all of them:
That sort produces three live cut classes, a fourth you document and walk away from, and one that is more dangerous than all of them:
### Critical quantum — the hours lane
### Hour-cut — the hours lane
On the kill chain, reachable, exploitable now. The time budget is **hours**, and that fact dictates the response: **you cannot wait for a patch cycle, so the critical quantum is closed by a compensating control, not necessarily the patch.** Block it at the edge, sever the reachability, disable the vulnerable feature, isolate the host, pull it behind the WAF. The patch follows later in the standard lane on the normal change calendar. The critical quantum's job is to **move the asset out of the hours-window** — to convert a 4-hour time-to-impact into a non-urgent one — by the cheapest fast control available. This is the lane that must be partly autonomous (Section 6), because human-paced execution cannot meet an hours budget.
On the kill chain, reachable, exploitable now. The time budget is **hours**, and that fact dictates the response: **you cannot wait for a patch cycle, so the hour-cut is closed by a compensating control, not necessarily the patch.** Block it at the edge, sever the reachability, disable the vulnerable feature, isolate the host, pull it behind the WAF. The patch follows later in the standard lane on the normal change calendar. The hour-cut's job is to **move the asset out of the hours-window** — to convert a 4-hour time-to-impact into a non-urgent one — by the cheapest fast control available. This is the lane that must be partly autonomous (Section 6), because human-paced execution cannot meet an hours budget.
### Severe quantum — the days lane
### Day-cut — the days lane
Material risk, reachable with friction, or where a compensating control already buys partial cover. The time budget is **days**. These are batched into a days-sized packet of work that can be fully completed and verified inside a single short change window — not started and left at 80%.
### Standard quantum — the sprint lane
### Sprint-cut — the sprint lane
The long, real, non-urgent tail. The time budget is a **sprint**. The discipline here is batching: the long tail is drained in sprint-sized quanta of work that *can actually be finished*, each one atomic and verified, rather than as an ever-growing list nobody ever reaches the bottom of. This is the only lane where "patch velocity" is the right tool, and it is fine for it to be slow, because by definition nothing in it is on fire.
The long, real, non-urgent tail. The time budget is a **sprint**. The discipline here is batching: the long tail is drained in sprint-sized cuts of work that *can actually be finished*, each one atomic and verified, rather than as an ever-growing list nobody ever reaches the bottom of. This is the only lane where "patch velocity" is the right tool, and it is fine for it to be slow, because by definition nothing in it is on fire.
### Dark quantum — the unsized unknown
### Declined — the documented no
The most dangerous quantum is the one you cannot size, because you cannot yet see the asset, cannot establish reachability, or cannot determine exploitability. An unsized quantum is not a low priority — it is an *uncharacterised* one, and uncharacterised risk on an unknown asset is exactly how estates die. The antifragile response is not to ignore it (it has no score, so the old model does) but to **route it to discovery and to the Kill Chain Assessment** — to spend effort turning a dark quantum into a sized one, because a known severe is safer than an unknown nothing. This lane is why discovery (Book IV, the zero-budget discovery playbooks, the Kill Chain Assessment app) is part of vulnerability management and not separate from it.
Some real vulnerabilities sit on no mapped path to a crown jewel. The arithmetic says: do not spend judgement here. So don't — but say so. A declined finding is not backlog; it is a documented risk acceptance with a review trigger, recorded with the reachability and position reasoning that justified it. When the estate changes — a new bridge, a flattened segment, a jewel that moves — the trigger fires and the finding is re-sorted. The discipline is not doing less work; it is making *not doing* a decision instead of an accident.
**The quantum discipline in one line:** size every remediation to the time you actually have, make each unit atomic and verifiable, and spend your scarce judgement converting dark quanta into sized ones — not re-sorting the known list by the wrong key.
### The dark cut — the unsized unknown
The most dangerous cut is the one you cannot size, because you cannot yet see the asset, cannot establish reachability, or cannot determine exploitability. An unsized cut is not a low priority — it is an *uncharacterised* one, and uncharacterised risk on an unknown asset is exactly how estates die. The antifragile response is not to ignore it (it has no score, so the old model does) but to **route it to discovery and to the Kill Chain Assessment** — to spend effort turning a dark cut into a sized one, because a known day-cut is safer than an unknown nothing. This lane is why discovery (Book IV, the zero-budget discovery playbooks, the Kill Chain Assessment app) is part of vulnerability management and not separate from it.
**The cut discipline in one line:** size every remediation to the time you actually have, make each unit atomic and verifiable, and spend your scarce judgement converting dark cuts into sized ones — not re-sorting the known list by the wrong key.
---
@@ -152,7 +152,7 @@ Two stressors run this book, and the second is the one that makes it antifragile
### Autonomy in the hours-lane — matching machine speed with machine speed
The article that prompted this book is right about the core asymmetry: **attackers are executing at machine speed and defenders are still running remediation through human-paced processes designed for a world with weeks of lead time.** The hours-lane cannot be served by a pipeline with five human handoffs. So the critical quantum's execution — detect the new exposure, cross-reference the asset inventory, assess reachability and compensating controls, generate the work item with context, route it, and in the clear cases *apply the compensating control* — runs autonomously **within human-defined guardrails.**
The article that prompted this book is right about the core asymmetry: **attackers are executing at machine speed and defenders are still running remediation through human-paced processes designed for a world with weeks of lead time.** The hours-lane cannot be served by a pipeline with five human handoffs. So the hour-cut's execution — detect the new exposure, cross-reference the asset inventory, assess reachability and compensating controls, generate the work item with context, route it, and in the clear cases *apply the compensating control* — runs autonomously **within human-defined guardrails.**
The repo's standing scepticism applies and sharpens the point rather than contradicting it: **AI on a broken foundation is expensive noise.** Autonomy without environmental context just generates tickets faster — "faster noise," the exact toil that makes developers dread security. The autonomy only works *because* the foundation is in place: the compensating-control map, the reachability model, the known-good baseline, the segmented architecture. Autonomy is the accelerator on the hours-lane; architecture is still the durable bet. The human role moves up a level — from doing the remediation to **governing the policy**: which classes of action the system may take, which severity thresholds trigger automated containment, which changes still require a human. That is a better use of scarce security talent and the only operating model that survives the volume. The concrete blueprint for this lane is in [AI-Assisted TVM](../playbooks/ai-assisted-tvm.md); this book is the principle, that playbook is the build.
@@ -191,7 +191,7 @@ If a prioritisation decision hinges on a current specific, verify it and test it
- Is anything in the "done" column a ghost patch — closed but never verified to enforce?
- What is sitting in the fragile middle — the aging critical-patch backlog that is neither contained fast nor architected away?
- How many human handoffs are in our hours-lane, and which of them require actual judgement versus just adding latency?
- What's in the dark quantum — the unscanned, the unscannable, the unowned — and what are we doing to size it?
- What sits dark — the unscanned, the unscannable, the unowned — and what are we doing to size it?
- For the last ten vulnerability incidents: how many produced a severed path versus just a patch? Is the kill chain getting shorter?
---
antifragile-consulting/books/README.md
+1 -1
View File
@@ -76,7 +76,7 @@ Read this once you've built something worth protecting — it closes the origina
*The patch cycle was built for a world where you had weeks. That world is gone. Stop racing the attacker to the patch — change the race.*
The first six books assume the dominant way into an estate is a phished human. As of the 2026 Verizon DBIR that assumption is wrong: **exploitation of vulnerabilities is now the leading initial-access vector, roughly twice phishing.** This book changes the lens to match. It refuses the two losing moves — sorting 40,000 findings by CVSS, and trying to "patch faster" against a 4-hour exploitation window — and replaces them with the antifragile alternative: subtract the ~90% of criticals that aren't actually reachable, size the rest into **cuts** by time-to-existential-impact (hour / day / sprint, plus the dangerous *dark* node you can't yet size), contain the few that matter with compensating controls rather than waiting for a patch, and feed every exploited path back into a shorter kill chain. *(Written when the discipline was called quantum vulnerability management; the current framework is the Interdiction Model — the book's quanta are today's cut classes.)*
The first six books assume the dominant way into an estate is a phished human. As of the 2026 Verizon DBIR that assumption is wrong: **exploitation of vulnerabilities is now the leading initial-access vector, roughly twice phishing.** This book changes the lens to match. It refuses the two losing moves — sorting 40,000 findings by CVSS, and trying to "patch faster" against a 4-hour exploitation window — and replaces them with the antifragile alternative: subtract the ~90% of criticals that aren't actually reachable, size the rest into **cuts** by time-to-existential-impact (hour / day / sprint, plus the dangerous *dark* node you can't yet size), contain the few that matter with compensating controls rather than waiting for a patch, and feed every exploited path back into a shorter kill chain.
It pairs with the [Interdiction Model](../core/interdiction-model.md) and the [Kill Chain Assessment app](../playbooks/kill-chain-assessment-app.md). Read it when the threat landscape — not the maturity model — forces the question.
antifragile-consulting/core/interdiction-framework.md
+139
View File
@@ -0,0 +1,139 @@
# The Interdiction Framework
> *"You do not have 40,000 critical vulnerabilities. You have ~400 that are real, ~40 that are on fire, and a process that cannot tell them apart. Interdiction is the discipline of cutting the paths that matter in the time you actually have — and of admitting that the unit of work was never the vulnerability. It was the path."*
This is the operating framework behind [Book VII — Vulnerability Management](../books/06-vulnerability-management.md). Book VII is the philosophy; this is what a consultant runs in an engagement. The formal model — two-weight attack graphs, minimum-cost cuts, cut depth κ — is the [Interdiction Model](interdiction-model.md); this page is the practice. It pairs with the [Kill Chain Assessment app](../playbooks/kill-chain-assessment-app.md) (which computes the chain and the cut classes) and the [AI-Assisted TVM Blueprint](../playbooks/ai-assisted-tvm.md) (which automates the hours-lane).
---
## The problem in one paragraph
Time-to-exploit has collapsed to roughly **4 hours** while median remediation sits at **43 days**; CVE volume has gone past **59,000/year** and the public enrichment data (NVD) is degrading; and as of the **2026 Verizon DBIR, vulnerability exploitation is the #1 initial-access vector, roughly twice phishing.** A human-paced, CVSS-sorted patch programme cannot close a gap that runs the wrong way by two orders of magnitude. The answer is not "patch faster." It is to **stop using the vulnerability list as the unit of work**, cut the few paths that matter in hours, make the rest not matter through architecture, and feed every exploited path back into a shorter kill chain.
---
## What a cut is
A **cut** is the smallest unit of remediation that:
1. **Fully removes a specific exploitable path** — an edge the adversary could actually walk, not a CVE in the abstract.
2. **Is sized to a time budget it can actually be completed within** — hours, days, or a sprint.
3. **Ends in a verifiable signal** — a test that proves the path is gone, not a ticket marked done.
The word is chosen deliberately:
- **Atomic.** You cannot sever half an edge and claim half the protection. A patch on 80% of the fleet, or a rule applied but never verified to block, is a *ghost patch* — fully exploitable and now invisible. A cut is all-or-nothing.
- **Discrete.** Work is packetised into units that fit the time available, not smeared across an infinite backlog. An undifferentiated backlog has no front; cuts give it one.
---
## The sort key: time-to-existential-impact
Cuts are ordered not by severity but by **time-to-existential-impact**, a function of three things the *environment* determines — not the CVE:
> **time-to-existential-impact = f( graph position, reachability, exploit availability )**
| Factor | Question | Where it comes from |
|--------|----------|---------------------|
| **Graph position** | Does this sit on a path to existential compromise? | [Kill Chain Assessment app](../playbooks/kill-chain-assessment-app.md), BloodHound, the diagnostic |
| **Reachability** | Can the adversary actually get to it (internet-facing, one hop from T0, behind segmentation)? | Network topology, external scan, [Perimeter Scanning](../playbooks/perimeter-scanning-capability.md) |
| **Exploit availability** | Is there a working exploit in the wild now? | CISA KEV, exploit databases, threat intel |
The same CVE earns a different cut class on different assets, because position, not severity, sets the clock. **A 9.8 on a segmented, unreachable, non-privileged host is a sprint-cut. A 7.5 on an internet-facing box one hop from a domain controller is an hour-cut.** Position changes the priority, not the score.
---
## The five cut classes
| Class | Time budget | What's in it | The response | Lane character |
|-------|-------------|--------------|--------------|----------------|
| **Hour-cut** | **Hours** | On the kill chain, reachable, exploit available now | **Compensating control, not the patch** — sever reachability, edge-block, isolate, disable feature. Patch follows later. | Must be partly **autonomous**; human at policy boundary |
| **Day-cut** | **Days** | Material risk; reachable with friction, or partial compensating cover | Batched, completed and verified inside one short change window | Human-run, tightly scheduled |
| **Sprint-cut** | **Sprint** | The long, real, non-urgent tail | Drained in sprint-sized batches that can actually be finished; this is where patch velocity is the right tool | Routine engineering rhythm |
| **Dark** | **Unsized** | Can't see the asset, can't establish reachability, can't determine exploitability | **Route to discovery** — turn an uncharacterised risk into a sized cut | Discovery, not remediation |
| **Declined** | **None** | On no mapped path to a crown jewel | **Documented risk acceptance** with a review trigger — not backlog | Governance, not engineering |
### Why "compensating control, not the patch" for the hour-cut
You cannot meet an hours budget with a vendor patch cycle, and often the patch does not exist yet. So the hour-cut's job is **not to fix the vulnerability — it is to move the asset out of the hours-window** by the cheapest fast control available: cut the reachability, block at the edge, isolate the host, disable the vulnerable feature, pull it behind the WAF. A 4-hour time-to-impact becomes a non-urgent one, and the actual patch drops into the sprint lane on the normal change calendar. Reachability is almost always faster to change than a patch is to ship — which makes **reachability the fastest remediation you own.**
### Why the dark class is the most dangerous
An uncharacterised risk on an unknown asset is how estates die. A *known* day-cut is safer than an *unknown* nothing, because you can plan around the known one. The antifragile move is to spend judgement converting dark nodes into sized ones — which is why discovery (the [Kill Chain Assessment app](../playbooks/kill-chain-assessment-app.md), [zero-budget discovery](../playbooks/zero-budget-vulnerability-discovery.md), osquery) is part of vulnerability management, not separate from it.
### Why "declined" is a class, not a shrug
Work the arithmetic says not to do is still a decision, and undocumented decisions are how estates rot. A declined finding is recorded with the reachability and position reasoning that justified it, plus the trigger that re-sorts it — a new bridge, a flattened segment, a jewel that moves. The discipline is not doing less work; it is making *not doing* a choice instead of an accident.
---
## The barbell: contain fast or architect away — never the fragile middle
```
CHEAP / FAST / REVERSIBLE SLOW / STRUCTURAL / DURABLE
Hours-lane compensating controls Segmentation, least privilege,
(edge block, isolate, cut reachability) T0 protection, assume-breach
── wins the time race the patch can't ── ── makes ~90% of vulns not matter ──
◄────────────── THE FRAGILE MIDDLE TO AVOID ──────────────►
The aging "critical patch backlog": carries hours-lane urgency,
moves at sprint-lane speed. Max anxiety, min protection,
and the attacker clears it for you one exploited host at a time.
```
Both ends of the barbell are convex (small cost, large payoff — Pillar 5). The fragile middle is concave (maximum cost, minimum return). The rule: **contain it fast, or architect it away. Never let it age in the middle.**
---
## The ~90% subtraction — via negativa applied to the list
The single highest-leverage move, and it is pure subtraction. Industry data suggests **roughly 90% of "critical" vulnerabilities are not exploitable in a given environment** once compensating controls, reachability, and segmentation are mapped. So before adding any work:
1. Map, per asset: internet reachability, EDR coverage, WAF rules, segmentation distance from T0.
2. Delete the false urgency on everything segmented, unreachable, or already neutralised.
3. What remains — the genuinely reachable, genuinely exploitable ~10% — is the only thing the hours- and days-lanes ever touch.
This turns "40,000 criticals" into a few hundred real findings and a few dozen on fire. The compensating-control map that makes it possible is **the single most valuable artefact in the programme** — build it before the incident, because during a zero-day it answers "are we actually exposed?" in minutes instead of days. The caveat: a mapped control that has rotted is a false negative. **Test the controls you are counting on; do not trust the map.**
---
## The feedback loop — the antifragile difference
A vulnerability that was exploited or nearly exploited is the cheapest penetration test you will ever get. Patching the CVE wastes the data. The antifragile move is to **sever the path** the attacker used — boundary the flat segment, collapse the over-privileged service account, pull the reachable management interface behind the bastion — so the *next* vulnerability that lands there is a non-event before it is even disclosed.
**The metric is not MTTR. It is cut depth (κ): did the estate get harder to walk?** Ten incidents that produce ten patches and zero severed paths mean you are merely fast. Ten incidents that produce six severed paths mean the estate is getting harder to compromise every time it is tested — the only honest definition of antifragile.
---
## Running it in an engagement — the sequence
1. **Discover** — run the [Kill Chain Assessment app](../playbooks/kill-chain-assessment-app.md) to map assets, reachability, and the cheapest existential path. Anything you cannot characterise is dark; route it to deeper discovery.
2. **Subtract** — apply the ~90% reduction using the compensating-control and reachability map. Delete false urgency.
3. **Decline** — mark what sits on no mapped path, with the reasoning and a review trigger. Do not carry it as backlog.
4. **Class** — place every remaining real finding into its cut class by time-to-existential-impact.
5. **Contain the hours-lane** — apply compensating controls to the hour-cuts *today*, autonomously where guardrails allow ([AI-Assisted TVM](../playbooks/ai-assisted-tvm.md)). Verify each closes with a signal.
6. **Batch the rest** — day-cuts in the next change window, sprint-cuts in the engineering rhythm.
7. **Architect away the middle** — feed the recurring paths into segmentation and least-privilege work (Books II–V) so the same class of vulnerability stops mattering.
8. **Close the loop** — after every exploited-or-near finding, ask what path got severed, and track cut depth over time.
---
## What to measure
| Metric | Why it matters | Antifragile target |
|--------|----------------|--------------------|
| Hour-cut containment time | The hours-lane is the race you must not lose | Hours, trending down |
| % of "criticals" confirmed reachable | Proves the ~90% subtraction is real, not assumed | Known, not "unknown" |
| Ghost-patch rate (closed-but-unverified) | Half-done remediation is hidden full exposure | Zero — every cut closes with a signal |
| Dark count | Uncharacterised risk is the dangerous kind | Shrinking; each one converted to sized |
| **Cut depth (κ) after incidents** | The only measure of getting *stronger* | Deeper after each exploited-or-near event |
| Items aging in the fragile middle | The concave zone the barbell forbids | Zero — contained or architected, never aging |
---
## Honest uncertainty
The headline statistics (the 4-hour, 43-day, ~59,000-CVE, ~90%-not-exploitable, and "#1, ~2× phishing" figures) are point-in-time and churn annually — re-check them against the current DBIR, M-Trends, and FIRST/CVE data before putting them on a slide. The *direction* is the stable signal; the numbers move. The autonomous-execution tooling for the hours-lane is real but immature and fast-moving — verify current capability and failure modes, and start with reversible compensating controls, never irreversible change. What does not churn: graph position beats CVSS, most criticals aren't reachable, a half-done remediation is a hidden full vulnerability, and every exploited path should end severed.
---
*See [Book VII — Vulnerability Management](../books/06-vulnerability-management.md) for the philosophy, the [Interdiction Model](interdiction-model.md) for the formal model, the [Kill Chain Assessment app](../playbooks/kill-chain-assessment-app.md) for computing the chain in unknown territory, and [AI-Assisted TVM Blueprint](../playbooks/ai-assisted-tvm.md) for automating the hours-lane.*
antifragile-consulting/core/interdiction-model.md
+5 -20
View File
@@ -2,22 +2,7 @@
> *"A kill chain is not broken by patching the worst thing on it. It is broken by cutting it. Those are different sets, they are usually different sizes, and only one of them is computable. Interdiction is the discipline of finding the cut, pricing it, and declining the work that is not in it."*
This supersedes the operating model in [Quantum Vulnerability Management](quantum-vulnerability-management.md). The philosophy in [Book VII](../books/06-vulnerability-management.md) is unchanged and the four time budgets survive; what changes is the object being budgeted, the way it is selected, and the metric that says whether any of it is working. It is consumed by the [Kill Chain Assessment app](../playbooks/kill-chain-assessment-app.md) and by ORION.
---
## Why "quantum" retires
The word was doing two jobs at once — naming the *time budget* (hours / days / sprint) and naming the *unit of work* (atomic, all-or-nothing, closes a path). Those are orthogonal. It also collides with quantum computing, which is not a hypothetical problem: the collision costs a reader a wrong turn through QAOA literature before they arrive at a framework that has nothing to do with it.
| Was | Is | Why |
|---|---|---|
| quantum | **cut** | The unit is a *cut* in the graph-theoretic sense — the object that actually severs a path. Mathematically exact, one syllable, verbs. |
| critical / severe / standard quantum | **hour-cut / day-cut / sprint-cut** | Time budget becomes an adjective on the unit rather than a competing name for it. |
| dark quantum | **dark** | Unchanged in meaning: cannot be placed inside or outside the cut. |
| — | **declined** | New. Not in any cut, and the intervention is net-negative. |
| "did the kill chain get shorter?" | **cut depth (κ)** | A number, not a question. |
| the framework | **interdiction** | Names an existing body of operations research this is an instance of, rather than inventing a private vocabulary. |
This is the operating model for vulnerability management in the exploitation-first era. The philosophy in [Book VII](../books/06-vulnerability-management.md) is the why; this is the how — the object being budgeted (the cut), the way it is selected (minimum cost), and the metric that says whether any of it is working (cut depth κ). It is consumed by the [Kill Chain Assessment app](../playbooks/kill-chain-assessment-app.md) and by ORION.
---
@@ -142,7 +127,7 @@ A **cut** (the unit) is one atomic remediation that:
2. **Fits a declared time budget** — hours, days, or a sprint.
3. **Ends in a verifiable signal** — a test proving the edge is gone. An unverified removal is a *ghost cut*: fully traversable and now invisible.
The properties that made "quantum" a good word survive intact. A cut is **atomic** — a control applied to 80% of the fleet has not removed the edge, it has removed it from the part of the graph you were looking at. A cut is **discrete** — work is packetised into units that fit the time available rather than smeared across a backlog with no front.
A cut is **atomic** — a control applied to 80% of the fleet has not removed the edge, it has removed it from the part of the graph you were looking at. A cut is **discrete** — work is packetised into units that fit the time available rather than smeared across a backlog with no front.
### The five classes
@@ -158,7 +143,7 @@ The properties that made "quantum" a good word survive intact. A cut is **atomic
> **Membership is a property of the selected cut, not of the vulnerability.**
Two criticals on the same path need one intervention between them, not two. Under the old rule ("on the kill chain → do it now") both were hour-quanta. Under the cut rule the cheaper one is selected and the other is deferred or declined. At client scale this is the difference between a remediation plan that gets executed and one that gets filed.
Two criticals on the same path need one intervention between them, not two. Under a naive rule ("on the kill chain → do it now") both demand an hours response. Under the cut rule the cheaper one is selected and the other is deferred or declined. At client scale this is the difference between a remediation plan that gets executed and one that gets filed.
---
@@ -174,7 +159,7 @@ That is less of a problem than it sounds and more of an opportunity than it look
- **A greedy heuristic is serviceable** — repeatedly take the label with the best *edges-severed-per-unit-cost*, recompute, stop when disconnected. Treat this as a heuristic with no approximation guarantee, and verify the result by recomputing the cut on the reduced graph rather than trusting the greedy trace.
- **Label multiplicity is convexity.** A label sitting on six cut edges is a small, bounded cost against a large, structural payoff — [Pillar 5](antifragile-manifest.md) made arithmetic. Ranking candidate labels by multiplicity is the single cheapest piece of analysis in the model.
> No quantum computer is required, or useful, anywhere in this. Min-cut is polynomial; label cut yields to an ILP at the sizes that occur. The word "quantum" in the previous model never referred to quantum computing, which is part of why it had to go.
> No quantum computer is required, or useful, anywhere in this. Min-cut is polynomial; label cut yields to an ILP at the sizes that occur.
---
@@ -253,7 +238,7 @@ This also satisfies the process-liveness rule: the κ̂ slope goes bad the momen
## 8. The barbell, derived rather than asserted
The [barbell](quantum-vulnerability-management.md) was previously a doctrine. It is in fact the shape a cost-minimising cut takes, which is a much stronger position to argue from.
The [barbell](interdiction-framework.md) is the shape a cost-minimising cut takes — derived, not asserted, which is a much stronger position to argue from.
```
CHEAP / FAST / REVERSIBLE SLOW / STRUCTURAL / DURABLE
antifragile-consulting/core/quantum-vulnerability-management.md
-137
View File
@@ -1,137 +0,0 @@
# Quantum Vulnerability Management
> *"You do not have 40,000 critical vulnerabilities. You have ~400 that are real, ~40 that are on fire, and a process that cannot tell them apart. Quantum vulnerability management is the discipline of sizing remediation to the time you actually have — and of admitting that the unit of work was never the vulnerability. It was the path."*
This is the operating framework behind [Book VII — Vulnerability Management](../books/06-vulnerability-management.md). Book VII is the philosophy; this is the model a consultant runs in an engagement. It pairs with the [Kill Chain Assessment app](../playbooks/kill-chain-assessment-app.md) (which sizes the quanta) and the [AI-Assisted TVM Blueprint](../playbooks/ai-assisted-tvm.md) (which automates the hours-lane).
---
> **Doctrine note (September 2026).** This framework has been generalised into the **[Interdiction Model](interdiction-model.md)**: the *quantum* is now the **cut** — every remediation is priced as the removal of an edge in a two-weight attack graph, and the planning object is the minimum-cost set of removals that severs every mapped path to a crown jewel. The four quanta survive as cut classes (hour / day / sprint / dark), joined by a fifth — *declined*, for work the arithmetic says not to do — and the programme metric is cut depth (κ). What follows is the original formulation, kept because its operational detail (the barbell, the ~90% subtraction, ghost patches, the engagement sequence) is unchanged; read "quantum" as "cut."
---
## The problem in one paragraph
Time-to-exploit has collapsed to roughly **4 hours** while median remediation sits at **43 days**; CVE volume has gone past **59,000/year** and the public enrichment data (NVD) is degrading; and as of the **2026 Verizon DBIR, vulnerability exploitation is the #1 initial-access vector, roughly twice phishing.** A human-paced, CVSS-sorted patch programme cannot close a gap that runs the wrong way by two orders of magnitude. The answer is not "patch faster." It is to **stop using the vulnerability list as the unit of work**, size remediation into time-budgeted quanta, contain the few that matter in hours, make the rest not matter through architecture, and feed every exploited path back into a shorter kill chain.
---
## What a quantum is
A **quantum** is the smallest unit of remediation that:
1. **Fully closes a specific exploitable path** — not a CVE in the abstract, a path an adversary could actually walk.
2. **Is sized to a time budget it can actually be completed within** — hours, days, or a sprint.
3. **Ends in a verifiable signal** — a test that proves the path is closed, not a ticket marked done.
The word is chosen deliberately:
- **Atomic.** You cannot ship half a quantum and claim half the protection. A patch on 80% of the fleet, or a rule applied but never verified to block, is a *ghost patch* — fully exploitable and now invisible. A quantum is all-or-nothing.
- **Discrete.** Work is packetised into units that fit the time available, not smeared across an infinite backlog. An undifferentiated backlog has no front; quanta give it one.
---
## The sort key: time-to-existential-impact
Quanta are ordered not by severity but by **time-to-existential-impact**, a function of three things the *environment* determines — not the CVE:
> **time-to-existential-impact = f( kill-chain position, reachability, exploit availability )**
| Factor | Question | Where it comes from |
|--------|----------|---------------------|
| **Kill-chain position** | Does this sit on a path to existential compromise? | [Kill Chain Assessment app](../playbooks/kill-chain-assessment-app.md), BloodHound, the diagnostic |
| **Reachability** | Can the adversary actually get to it (internet-facing, one hop from T0, behind segmentation)? | Network topology, external scan, [Perimeter Scanning](../playbooks/perimeter-scanning-capability.md) |
| **Exploit availability** | Is there a working exploit in the wild now? | CISA KEV, exploit databases, threat intel |
The same CVE has a different quantum on different assets, because position, not severity, sets the clock. **A 9.8 on a segmented, unreachable, non-privileged host is a sprint quantum. A 7.5 on an internet-facing box one hop from a domain controller is an hours quantum.** This is the Book I principle — kill-chain position changes the priority, not the score — made operational.
---
## The four quanta
| Quantum | Time budget | What's in it | The response | Lane character |
|---------|-------------|--------------|--------------|----------------|
| **Critical** | **Hours** | On the kill chain, reachable, exploit available now | **Compensating control, not the patch** — sever reachability, edge-block, isolate, disable feature. Patch follows later. | Must be partly **autonomous**; human at policy boundary |
| **Severe** | **Days** | Material risk; reachable with friction, or partial compensating cover | Batched, completed and verified inside one short change window | Human-run, tightly scheduled |
| **Standard** | **Sprint** | The long, real, non-urgent tail | Drained in sprint-sized batches that can actually be finished; this is where patch velocity is the right tool | Routine engineering rhythm |
| **Dark** | **Unsized** | Can't see the asset, can't establish reachability, can't determine exploitability | **Route to discovery** — turn an uncharacterised risk into a sized quantum | Discovery, not remediation |
### Why "compensating control, not the patch" for the critical quantum
You cannot meet an hours budget with a vendor patch cycle, and often the patch does not exist yet. So the critical quantum's job is **not to fix the vulnerability — it is to move the asset out of the hours-window** by the cheapest fast control available: cut the reachability, block at the edge, isolate the host, disable the vulnerable feature, pull it behind the WAF. A 4-hour time-to-impact becomes a non-urgent one, and the actual patch drops into the standard lane on the normal change calendar. Reachability is almost always faster to change than a patch is to ship — which makes **reachability the fastest remediation you own.**
### Why the dark quantum is the most dangerous
The old model ignores the dark quantum because it has no score. That is exactly backwards: an uncharacterised risk on an unknown asset is how estates die. A *known* severe is safer than an *unknown* nothing, because you can plan around the known one. The antifragile move is to spend judgement converting dark quanta into sized ones — which is why discovery (the [Kill Chain Assessment app](../playbooks/kill-chain-assessment-app.md), [zero-budget discovery](../playbooks/zero-budget-vulnerability-discovery.md), osquery) is part of vulnerability management, not separate from it.
---
## The barbell: contain fast or architect away — never the fragile middle
```
CHEAP / FAST / REVERSIBLE SLOW / STRUCTURAL / DURABLE
Hours-lane compensating controls Segmentation, least privilege,
(edge block, isolate, cut reachability) T0 protection, assume-breach
── wins the time race the patch can't ── ── makes ~90% of vulns not matter ──
◄────────────── THE FRAGILE MIDDLE TO AVOID ──────────────►
The aging "critical patch backlog": carries hours-lane urgency,
moves at sprint-lane speed. Max anxiety, min protection,
and the attacker clears it for you one exploited host at a time.
```
Both ends of the barbell are convex (small cost, large payoff — Pillar 5). The fragile middle is concave (maximum cost, minimum return). The rule: **contain it fast, or architect it away. Never let it age in the middle.**
---
## The ~90% subtraction — via negativa applied to the list
The single highest-leverage move, and it is pure subtraction. Industry data suggests **roughly 90% of "critical" vulnerabilities are not exploitable in a given environment** once compensating controls, reachability, and segmentation are mapped. So before adding any work:
1. Map, per asset: internet reachability, EDR coverage, WAF rules, segmentation distance from T0.
2. Delete the false urgency on everything segmented, unreachable, or already neutralised.
3. What remains — the genuinely reachable, genuinely exploitable ~10% — is the only thing the hours- and days-lanes ever touch.
This turns "40,000 criticals" into a few hundred real findings and a few dozen on fire. The compensating-control map that makes it possible is **the single most valuable artefact in the programme** — build it before the incident, because during a zero-day it answers "are we actually exposed?" in minutes instead of days. The caveat (Book I): a mapped control that has rotted into a ghost is a false negative. **Test the controls you are counting on; do not trust the map.**
---
## The feedback loop — the antifragile difference
A vulnerability that was exploited or nearly exploited is the cheapest penetration test you will ever get. Patching the CVE wastes the data. The antifragile move is to **sever the path** the attacker used — boundary the flat segment, collapse the over-privileged service account, pull the reachable management interface behind the bastion — so the *next* vulnerability that lands there is a non-event before it is even disclosed.
**The metric is not MTTR. It is: did the kill chain get shorter?** Ten incidents that produce ten patches and zero severed paths mean you are merely fast. Ten incidents that produce six structurally shortened kill chains mean the estate is getting harder to compromise every time it is tested — the only honest definition of antifragile.
---
## Running it in an engagement — the sequence
1. **Discover** — run the [Kill Chain Assessment app](../playbooks/kill-chain-assessment-app.md) to map assets, reachability, and the shortest existential path. Anything you cannot characterise is a dark quantum; route it to deeper discovery.
2. **Subtract** — apply the ~90% reduction using the compensating-control and reachability map. Delete false urgency.
3. **Size** — place every remaining real finding into a quantum (critical / severe / standard) by time-to-existential-impact.
4. **Contain the hours-lane** — apply compensating controls to the critical quantum *today*, autonomously where guardrails allow ([AI-Assisted TVM](../playbooks/ai-assisted-tvm.md)). Verify each closes with a signal.
5. **Batch the rest** — days-lane in the next change window, sprint-lane in the engineering rhythm.
6. **Architect away the middle** — feed the recurring paths into segmentation and least-privilege work (Books II–V) so the same class of vulnerability stops mattering.
7. **Close the loop** — after every exploited-or-near finding, ask what path got shorter, and track that number over time.
---
## What to measure
| Metric | Why it matters | Antifragile target |
|--------|----------------|--------------------|
| Critical-quantum containment time | The hours-lane is the race you must not lose | Hours, trending down |
| % of "criticals" confirmed reachable | Proves the ~90% subtraction is real, not assumed | Known, not "unknown" |
| Ghost-patch rate (closed-but-unverified) | Half-done remediation is hidden full exposure | Zero — every quantum closes with a signal |
| Dark-quantum count | Uncharacterised risk is the dangerous kind | Shrinking; each one converted to sized |
| **Kill-chain length after incidents** | The only measure of getting *stronger* | Shorter after each exploited-or-near event |
| Items aging in the fragile middle | The concave zone the barbell forbids | Zero — contained or architected, never aging |
---
## Honest uncertainty
The headline statistics (the 4-hour, 43-day, ~59,000-CVE, ~90%-not-exploitable, and "#1, ~2× phishing" figures) are point-in-time and churn annually — re-check them against the current DBIR, M-Trends, and FIRST/CVE data before putting them on a slide. The *direction* is the stable signal; the numbers move. The autonomous-execution tooling for the hours-lane is real but immature and fast-moving — verify current capability and failure modes, and start with reversible compensating controls, never irreversible change. What does not churn: kill-chain position beats CVSS, most criticals aren't reachable, a half-done remediation is a hidden full vulnerability, and every exploited path should shorten the chain.
---
*See [Book VII — Vulnerability Management](../books/06-vulnerability-management.md) for the full philosophy, [Kill Chain Assessment app](../playbooks/kill-chain-assessment-app.md) for sizing the quanta in unknown territory, and [AI-Assisted TVM Blueprint](../playbooks/ai-assisted-tvm.md) for automating the hours-lane.*
antifragile-consulting/index.md
+2 -1
View File
@@ -42,7 +42,8 @@ Operational and persuasion documents used in engagements. **Start every new clie
| [Antifragile Manifest](core/antifragile-manifest.md) | Five pillars of antifragile enterprise | Executives, Architects, Consultants |
| [AI Sovereignty Framework](core/ai-sovereignty-framework.md) | Strategic arguments and implementation for local AI | CISOs, CTOs, Security Architects |
| [T0 Asset Framework](core/t0-asset-framework.md) | Tier 0 classification and protection for critical assets | Security Architects, Infrastructure Leads |
| [Interdiction Model](core/interdiction-model.md) | Minimum-cost cuts on a two-weight attack graph — the current vulnerability-management doctrine (supersedes the quanta framework); companion to Book VII | CISOs, Vulnerability Management, Consultants |
| [Interdiction Model](core/interdiction-model.md) | The formal model: minimum-cost cuts on a two-weight attack graph, cut depth κ | Security Architects, Consultants |
| [Interdiction Framework](core/interdiction-framework.md) | The engagement runbook: sort key, five cut classes, the barbell, the ~90% subtraction; companion to Book VII | CISOs, Vulnerability Management, Consultants |
| [Spontaneous Order Principles](core/spontaneous-order-principles.md) | Philosophical foundation for the five pillars | Executives, Architects, Strategists |
## Playbooks
antifragile-consulting/playbooks/kill-chain-assessment-app.md
+3 -3
View File
@@ -54,9 +54,9 @@ Each node on a chain is sized into a cut class by the logic the [Interdiction Mo
| Class | Condition | Budget / action |
|-------|-----------|-----------------|
| **Hour-cut** (Critical) | On cheapest chain, reachable **yes**, exploit **yes**, not compensated | **Hours** — sever reachability / compensating control now |
| **Day-cut** (Severe) | On a chain, reachable **or** exploit = yes | **Days** — one change window, verify enforcement |
| **Sprint-cut** (Standard) | On a chain, neither reachable nor exploitable yet | **Sprint** — batch; patch velocity fits here |
| **Hour-cut** | On cheapest chain, reachable **yes**, exploit **yes**, not compensated | **Hours** — sever reachability / compensating control now |
| **Day-cut** | On a chain, reachable **or** exploit = yes | **Days** — one change window, verify enforcement |
| **Sprint-cut** | On a chain, neither reachable nor exploitable yet | **Sprint** — batch; patch velocity fits here |
| **Dark** | On a chain but reachability **or** exploit = unknown | **Unsized** — route to discovery; characterise first |
| **Declined** | Off-chain (P2): on no mapped path to a crown jewel | Documented risk acceptance with a review trigger — *not* backlog |