antifragile/antifragile-consulting

Antifragile Enterprise Consulting Repository

"Wind extinguishes a candle and energizes fire. You want to be the fire and wish for the wind." — Nassim Nicholas Taleb

This repository contains reusable frameworks, playbooks, and assessment resources for consulting engagements focused on building antifragile organizations—enterprises that do not merely survive disruption but grow stronger from it.

What Is Antifragile?

Most security and resilience frameworks optimize for robustness—the ability to withstand shocks. Antifragility goes further. An antifragile system:

• Benefits from volatility and stressors
• Learns faster from failures than from successes
• Decentralizes critical functions to avoid single points of failure
• Treats optionality as a strategic asset, not overhead

Repository Structure

├── core/                           # Foundational frameworks and principles
│   ├── move-fast-and-fix-things.md # Company philosophy: speed, repair, existing tools
│   ├── antifragile-manifest.md     # The five pillars of antifragile enterprise
│   ├── modular-engagements.md      # Menu of independent, self-contained modules
│   ├── ai-sovereignty-framework.md # AI sovereignty as a strategic mandate
│   ├── ai-operations-inevitability.md # Why defensive AI is inevitable (business AI is optional)
│   ├── azure-openai-sovereignty-bridge.md # Azure OpenAI/Foundry as sovereignty stepping stone
│   ├── organizational-resilience.md  # Dev/Sec/Ops merger and shift-left arguments
│   ├── quality-management-engagement.md   # Embedded process assurance for teams feeling "not in control"
│   ├── blue-purple-team-foundation.md     # Building defensive capability from existing tools
│   ├── retained-capability.md             # What to keep in-house when outsourcing security (MSSP, pentest, compliance)
│   ├── executive-summary.md          # One-page board brief
│   ├── c-suite-conversation-guide.md # Persuasion scripts for top management
│   └── t0-asset-framework.md       # Tier 0 asset classification and protection
├── playbooks/                      # Executable modernisation and response plans
│   ├── rapid-modernisation-plan.md # 30-60-90-180 day transformation roadmap
│   ├── endpoint-management-entry-vector.md # Intune/device management as engagement entry point
│   ├── ai-assisted-tvm.md          # AI-powered vulnerability management blueprint
│   ├── zero-budget-vulnerability-discovery.md # Script-based vuln discovery without commercial scanners
│   ├── perimeter-scanning-capability.md # External attack surface scanning strategy
│   ├── osquery-custom-platform.md    # Build a sovereign vuln/asset discovery platform on osquery
│   ├── m365-antifragile-project.md # M365 greenfield/modernisation with antifragile design
│   ├── m365-e3-hardening.md        # M365 E3-specific tactical hardening
│   ├── ad-endpoint-hardening.md    # On-prem AD, Windows endpoint, hybrid identity
│   ├── zero-budget-hardening.md    # Maximize existing tool investment
│   ├── implementation-playbook.md  # Step-by-step operational guide
│   └── business-case-template.md   # Financial justification and ROI framework
│   ├── sovereign-tool-stack.md       # Open-source arsenal and capability map
├── assessment-templates/           # Diagnostic tools and maturity models
│   ├── README.md                   # Assessment roadmap and development plan
│   ├── antifragile-risk-register.md # Antifragile risk taxonomy and register template
│   └── m365-project-risk-register.md # M365 project-specific risk register
├── reference/                      # External standards, mappings, and citations
│   ├── cis-controls-mapping.md     # CIS Controls v8 alignment
│   ├── nist-csf-mapping.md         # NIST CSF 2.0 alignment
│   ├── vertical-power-utilities.md # Power generation, transmission, water utilities
│   ├── vertical-telco.md           # Telecommunications and mobile operators
│   └── vertical-banking.md         # Financial services regulatory alignment
└── assets/                         # Diagrams, visuals, and presentation materials

Our Posture: Move Fast and Fix Things

This practice is built on a simple, actionable stance: move fast and fix things. We do not wait for perfect plans. We identify the kill chain, extract value from existing investments, and close existential gaps before they become incidents.

• Speed is a security control. A 90% solution deployed today outperforms a 100% solution that ships in six months.
• Work beats purchases. Most organizations own 60-80% of the capabilities they need. We configure and operationalize before we shop.
• Every fix must produce a signal. A remediation without telemetry is a remediation that will rot.

Read the full Move Fast and Fix Things philosophy.

Core Pillars

1. Structural Decoupling — Remove hidden dependencies before they become fatal ones
2. Optionality Preservation — Maintain strategic exits and alternatives at every layer
3. Stress-to-Signal Conversion — Turn failures, attacks, and outages into intelligence
4. Sovereign Intelligence — Own your cognitive infrastructure; never rent your ability to think
5. Asymmetric Payoff Design — Engineer outcomes where small investments yield disproportionate protection

Standards Alignment

Our approach is not an alternative to established frameworks. It is the fastest path to meeting them while building real resilience:

• CIS Controls v8 — IG1 as a non-negotiable 90-day floor, achieved primarily through existing tool configuration
• NIST CSF 2.0 — All six functions addressed with emphasis on GOVERN as the missing keystone

Quick Start for Executives and Board Members

1. Read Executive Summary — one page, five minutes, the full case
2. Review Business Case Template — financial justification, ROI, and risk quantification
3. Browse C-Suite Conversation Guide — how your advisors should frame the conversation

Quick Start for Consultants

1. Open core/move-fast-and-fix-things.md — understand the engagement posture
2. Read core/antifragile-manifest.md — understand the philosophy
3. Study playbooks/m365-e3-hardening.md — master the primary client environment (most clients are E3)
4. Study playbooks/ad-endpoint-hardening.md — cover on-premises AD and endpoint gaps
5. Study playbooks/zero-budget-hardening.md — extract value from existing tools in 30 days
6. Deploy playbooks/rapid-modernisation-plan.md — run the 30-60-90-180 day roadmap
7. Reference core/t0-asset-framework.md and core/ai-sovereignty-framework.md — classify assets and own intelligence
8. Map reference/cis-controls-mapping.md and reference/nist-csf-mapping.md — align to standards
9. Adapt reference/vertical-power-utilities.md, reference/vertical-telco.md, or reference/vertical-banking.md — tailor for regulated critical infrastructure clients

Usage and Licensing

These documents are designed for reuse across client engagements. Adapt, remix, and extend. Credit the framework when presenting externally.

---

Built for practitioners who defend the future, not just the perimeter.