Interdiction doctrine rewrite (modules 0/8, skills), stash Czech content to staging/ pending review

content/en/consulting/module-0.md

@@ -1,6 +1,6 @@
 ---
 title: "Module 0 — Brownhat Diagnostic"
-description: "The entry point for every engagement. A structured two-day NIST CSF 2.0 baseline assessment that produces a prioritised security roadmap, a mapped kill chain, and sized remediation quanta."
+description: "The entry point for every engagement. A structured two-day NIST CSF 2.0 baseline assessment that produces a prioritised security roadmap, a mapped estate graph, and remediation sized into cuts."
 eyebrow: "Consulting Module"
 lead: "Before any module recommendation, we need an honest picture of where you actually stand. The Brownhat Diagnostic is a structured two-day workshop — no tools installed, no scanning — that produces the clearest picture of your security posture and what matters most to fix."
 actions:
@@ -25,14 +25,14 @@ actions:
     <div class="feature-item-icon">🗺️</div>
     <div class="feature-item-body">
       <h4>Kill Chain Map</h4>
-      <p>Using the Kill Chain Assessment app, we model your environment as an attack graph during the diagnostic. The app computes the shortest path from an attacker's entry point to your crown jewels — the kill chain — and identifies exactly which links need breaking first.</p>
+      <p>Using the Kill Chain Assessment app, we model your environment as an attack graph during the diagnostic. The app computes the cheapest adversary paths from entry points to your crown jewels — and the minimum-cost cut: the smallest priced set of interventions that severs every mapped path. That cut, not a severity list, is what the plan is built on.</p>
     </div>
   </div>
   <div class="feature-item">
     <div class="feature-item-icon">⚡</div>
     <div class="feature-item-body">
-      <h4>Quantum-Sized Remediation Plan</h4>
-      <p>Every finding on the kill chain is sized into a remediation quantum: Critical (hours), Severe (days), Standard (sprint), or Dark (needs discovery first). You leave with a plan ordered by time-to-existential-impact, not by CVSS score.</p>
+      <h4>Cut-Sized Remediation Plan</h4>
+      <p>Every intervention is sized into a cut class: hour-cut (compensating control now, not the patch), day-cut (one change window), sprint-cut (normal engineering rhythm), or dark (needs discovery first). You leave with a plan ordered by time-to-existential-impact, not by CVSS score.</p>
     </div>
   </div>
   <div class="feature-item">
@@ -59,8 +59,8 @@ The Diagnostic is a two half-day structured workshop with your IT lead, a busine
 Everything goes to your repository. At the end of the two days you receive:
 
 - NIST CSF 2.0 gap report (strengths, gaps, severity ratings)
-- Kill chain diagram and shortest-path analysis
-- Quantum-bucketed remediation priorities (P0 / P1 / P2 with time budgets)
+- Kill chain diagram and minimum-cost cut analysis
+- Remediation priorities sized into cut classes (hour / day / sprint / dark)
 - Module roadmap with recommended sequencing and rationale
 - Findings backlog seeded and ready for the housekeeping stream
 

content/en/consulting/module-8.md

@@ -1,6 +1,6 @@
 ---
 title: "Module 8 — Threat & Vulnerability Management"
-description: "Quantum vulnerability management for the exploitation-first era. Kill-chain-based prioritisation, the ~90% subtraction, four time-budgeted quanta, and the Kill Chain Assessment app."
+description: "Network interdiction for the exploitation-first era. Minimum-cost cuts instead of CVSS lists, the ~90% subtraction, hour/day/sprint cuts, and the Kill Chain Assessment app."
 eyebrow: "Consulting Module"
 lead: "Time-to-exploit has collapsed to roughly four hours. Median remediation sits at 43 days. No amount of 'patch faster' closes a gap that runs the wrong way by two orders of magnitude. The answer is not to patch faster — it is to stop using the vulnerability list as the unit of work."
 actions:
@@ -17,6 +17,8 @@ CVSS scores severity in the abstract. It knows nothing about whether the vulnera
 
 The 2026 Verizon DBIR confirms vulnerability exploitation is now the leading initial-access vector — roughly twice phishing. This is not a maturity problem solved with more analysts. It is a model that has run out of road.
 
+There is a subtler failure even in kill-chain thinking. Breaking the weakest link on the shortest attack path does not sever anything — it promotes the second-shortest path. The object that actually severs an estate is a **cut**: the set of interventions after which no mapped path from entry point to crown jewel survives. A chain is something you can point at. A cut is something you can compute, price, and close.
+
 ## What It Delivers
 
 <div class="feature-list">
@@ -24,42 +26,42 @@ The 2026 Verizon DBIR confirms vulnerability exploitation is now the leading ini
     <div class="feature-item-icon">🗺️</div>
     <div class="feature-item-body">
       <h4>Kill Chain Assessment</h4>
-      <p>The Kill Chain Assessment app maps your environment as an attack graph and runs a shortest-path computation across every entry point to every crown jewel. The result is the kill chain — the cheapest route from attacker foothold to existential impact. Every finding is classified P0 (on the shortest chain), P1 (on some path), or P2 (off-chain entirely).</p>
+      <p>The Kill Chain Assessment app maps your environment as an attack graph — every state an attacker can hold, every move between them — and weights each move twice: what it costs the adversary, and what it costs you to remove. It then computes the minimum-cost cut: the cheapest set of interventions that severs every mapped path to the crown jewels. The cut routinely contains links the shortest-path view never surfaces, and omits links that view calls critical.</p>
     </div>
   </div>
   <div class="feature-item">
     <div class="feature-item-icon">✂️</div>
     <div class="feature-item-body">
       <h4>The ~90% Subtraction</h4>
-      <p>Roughly 90% of "critical" vulnerabilities are not exploitable in a given environment once compensating controls, reachability, and segmentation are mapped. This subtraction — removing false urgency before adding any work — turns "40,000 criticals" into the few hundred that are real and the few dozen that are on fire. It is the highest-leverage move in the programme and it is pure deletion.</p>
+      <p>Roughly 90% of "critical" vulnerabilities sit on no path to anything existential once compensating controls, reachability, and segmentation are mapped. For those, the remediation cost is real and the existential impact is zero — the arithmetic says net-harmful, not merely low priority. This subtraction turns "40,000 criticals" into the few interventions that actually sever mapped paths. It is the highest-leverage move in the programme and it is pure deletion.</p>
     </div>
   </div>
   <div class="feature-item">
     <div class="feature-item-icon">⚡</div>
     <div class="feature-item-body">
-      <h4>Four Time-Budgeted Quanta</h4>
-      <p><strong>Critical (hours):</strong> On the kill chain, reachable, exploit available now. Response is a compensating control — sever reachability, block at the edge, isolate — not the patch. You cannot meet a four-hour window with a vendor patch cycle.<br><strong>Severe (days):</strong> Material risk; reachable with friction. One change window, verify enforcement.<br><strong>Standard (sprint):</strong> The real, non-urgent tail. Drain in sprint-sized batches on the normal change calendar.<br><strong>Dark (unsized):</strong> Reachability or exploitability unknown. Route to discovery — characterise before remediating.</p>
+      <h4>Five Classes of Work</h4>
+      <p><strong>Hour-cut:</strong> In the cut set, reachable, exploit live. Response is a compensating control — sever reachability, block at the edge, isolate — not the patch. No vendor patch cycle meets a four-hour window.<br><strong>Day-cut:</strong> In the cut set, material but not racing. One change window, verified before closure.<br><strong>Sprint-cut:</strong> In the cut set, no urgency. Normal engineering rhythm — this is where patch velocity is the correct tool.<br><strong>Dark:</strong> Reachability or exploitability unknown. Route to discovery — characterise before remediating.<br><strong>Declined:</strong> On no path to a jewel. A documented, owned risk acceptance with a review trigger — not a backlog item quietly aging.</p>
     </div>
   </div>
   <div class="feature-item">
     <div class="feature-item-icon">🔍</div>
     <div class="feature-item-body">
       <h4>Zero-Budget Vulnerability Discovery</h4>
-      <p>osquery deployed as a sovereign discovery platform alongside scripted checks for the findings scanners miss — service account privileges, unpatched firmware, container base image CVEs, exposed management interfaces. Discovery before scanner procurement is almost always sufficient to find the kill chain.</p>
+      <p>osquery deployed as a sovereign discovery platform alongside scripted checks for the findings scanners miss — service account privileges, unpatched firmware, container base image CVEs, exposed management interfaces. Discovery before scanner procurement is almost always sufficient to find the cut.</p>
     </div>
   </div>
   <div class="feature-item">
     <div class="feature-item-icon">📉</div>
     <div class="feature-item-body">
-      <h4>Kill Chain Length as the Metric</h4>
-      <p>The programme does not measure MTTR. It measures whether the kill chain got shorter. Ten incidents that produce ten patches leave the estate equally fragile. Ten incidents that each sever one structural path leave an estate that is genuinely harder to compromise every time it is tested. That is the only honest definition of improvement.</p>
+      <h4>Cut Depth as the Metric</h4>
+      <p>The programme does not measure MTTR. It measures <strong>cut depth (κ)</strong> — the number of independent successes an adversary needs. A κ of 1 means one compromised service account ends the business; the engagement target is 4 or better. κ is reported alongside kill-chain length and the count of unmapped edges, because a cut is only as honest as the graph beneath it. And every cut closes with a verification signal — an unverified removal is a <em>ghost cut</em>: fully traversable, and now invisible.</p>
     </div>
   </div>
 </div>
 
 ## The Barbell
 
-The antifragile TVM programme has two ends and a middle to avoid. **Fast end:** hours-lane compensating controls — edge blocks, isolation, reachability cuts — that win the time race a patch cannot. **Structural end:** segmentation, least privilege, and T0 protection that make most vulnerabilities irrelevant before they are disclosed. **The fragile middle to avoid:** the aging critical-patch backlog that carries hours-lane urgency while moving at sprint-lane speed. Maximum anxiety, minimum protection.
+The antifragile TVM programme has two ends and a middle to avoid — and with costed cuts, the shape is derived rather than asserted. **Fast end:** hours-lane compensating controls — edge blocks, isolation, reachability cuts — that win the time race a patch cannot. **Structural end:** segmentation, least privilege, and T0 protection that make most vulnerabilities irrelevant before they are disclosed. **The fragile middle to avoid:** the aging critical-patch backlog that carries hours-lane urgency while moving at sprint-lane speed. It is not forbidden by doctrine — it simply never wins the arithmetic.
 
 ## Scope and Prerequisites
 
@@ -67,7 +69,7 @@ The antifragile TVM programme has two ends and a middle to avoid. **Fast end:**
 |---|---|
 | **Duration** | 45–90 days |
 | **Environment** | Any (cloud, on-premises, hybrid) |
-| **Prerequisites** | Module 0 (Diagnostic) to establish the initial kill chain; asset inventory from Modules 1 or 6 |
+| **Prerequisites** | Module 0 (Diagnostic) to establish the estate graph and initial cut; asset inventory from Modules 1 or 6 |
 | **Natural follow-on** | Module 10 (Red Team & Validation) to validate that severed paths stay severed |
 
 <div class="cta-strip">

content/en/consulting/skills.md

@@ -12,7 +12,7 @@ Every engagement begins with the **Brownhat Diagnostic** (Module 0): a structure
 <div class="module-card">
   <div class="module-num">Module 0</div>
   <h3><a href="/consulting/module-0/">Brownhat Diagnostic</a></h3>
-  <p>Structured two-day NIST CSF 2.0 baseline assessment. Honest picture of your security posture, prioritised gap list, and recommended module sequence. Kill chain synthesis using the Kill Chain Assessment app — maps the unknown estate into an attack graph, computes the shortest path to existential impact, and sizes every finding into a remediation quantum. Entry point for every new client.</p>
+  <p>Structured two-day NIST CSF 2.0 baseline assessment. Honest picture of your security posture, prioritised gap list, and recommended module sequence. Kill chain synthesis using the Kill Chain Assessment app — maps the unknown estate into an attack graph, computes the cheapest paths to existential impact, and sizes the remediation into hour, day, and sprint cuts. Entry point for every new client.</p>
   <div class="module-meta">
     <span class="badge badge-blue">2 days</span>
     <span class="badge badge-blue">All clients</span>
@@ -92,7 +92,7 @@ Every engagement begins with the **Brownhat Diagnostic** (Module 0): a structure
 <div class="module-card">
   <div class="module-num">Module 8</div>
   <h3><a href="/consulting/module-8/">Threat &amp; Vulnerability Management</a></h3>
-  <p>Quantum vulnerability management for the exploitation-first era. Kill-chain position, reachability, and exploit availability replace CVSS as the sort key. The ~90% subtraction removes false urgency — leaving the 10% genuinely exploitable in your environment. Four time-budgeted quanta: Critical (hours — compensating control, not the patch), Severe (days), Standard (sprint), Dark (unsized — routed to discovery). Zero-budget discovery with osquery and scripts. The Kill Chain Assessment app maps the attack graph and sizes every node automatically.</p>
+  <p>Network interdiction for the exploitation-first era. Graph position, reachability, and exploit availability replace CVSS as the sort key. The ~90% subtraction removes net-negative work — leaving the few interventions that actually sever mapped paths. Five classes of work: hour-cuts (compensating control, not the patch), day-cuts, sprint-cuts, dark (routed to discovery), and an explicitly declined class. Zero-budget discovery with osquery and scripts. The Kill Chain Assessment app maps the attack graph and computes the minimum-cost cut; cut depth (κ) is the programme metric.</p>
   <div class="module-meta">
     <span class="badge badge-blue">45–90 days</span>
     <span class="badge badge-green">Open-source first</span>