website/content/en/consulting/module-8.md

---
title: "Module 8 — Threat & Vulnerability Management"
description: "Network interdiction for the exploitation-first era. Minimum-cost cuts instead of CVSS lists, the ~90% subtraction, hour/day/sprint cuts, and the Kill Chain Assessment app."
eyebrow: "Consulting Module"
lead: "Time-to-exploit has collapsed to roughly four hours. Median remediation sits at 43 days. No amount of 'patch faster' closes a gap that runs the wrong way by two orders of magnitude. The answer is not to patch faster — it is to stop using the vulnerability list as the unit of work."
actions:
  - label: "Get in Touch"
    url: "/about/#contact"
    primary: true
  - label: "View All Modules"
    url: "/consulting/skills/"
---

## The Problem with the Old Model

CVSS scores severity in the abstract. It knows nothing about whether the vulnerable asset is internet-reachable, whether it sits on the kill chain, whether an exploit exists in the wild, or whether a compensating control already neutralises it. Sorting 40,000 findings by CVSS produces a list precisely uncorrelated with where an attacker will actually go.

The 2026 Verizon DBIR confirms vulnerability exploitation is now the leading initial-access vector — roughly twice phishing. This is not a maturity problem solved with more analysts. It is a model that has run out of road.

There is a subtler failure even in kill-chain thinking. Breaking the weakest link on the shortest attack path does not sever anything — it promotes the second-shortest path. The object that actually severs an estate is a **cut**: the set of interventions after which no mapped path from entry point to crown jewel survives. A chain is something you can point at. A cut is something you can compute, price, and close.

## What It Delivers

<div class="feature-list">
  <div class="feature-item">
    <div class="feature-item-icon">🗺️</div>
    <div class="feature-item-body">
      <h4>Kill Chain Assessment</h4>
      <p>The Kill Chain Assessment app maps your environment as an attack graph — every state an attacker can hold, every move between them — and weights each move twice: what it costs the adversary, and what it costs you to remove. It then computes the minimum-cost cut: the cheapest set of interventions that severs every mapped path to the crown jewels. The cut routinely contains links the shortest-path view never surfaces, and omits links that view calls critical.</p>
    </div>
  </div>
  <div class="feature-item">
    <div class="feature-item-icon">✂️</div>
    <div class="feature-item-body">
      <h4>The ~90% Subtraction</h4>
      <p>Roughly 90% of "critical" vulnerabilities sit on no path to anything existential once compensating controls, reachability, and segmentation are mapped. For those, the remediation cost is real and the existential impact is zero — the arithmetic says net-harmful, not merely low priority. This subtraction turns "40,000 criticals" into the few interventions that actually sever mapped paths. It is the highest-leverage move in the programme and it is pure deletion.</p>
    </div>
  </div>
  <div class="feature-item">
    <div class="feature-item-icon">⚡</div>
    <div class="feature-item-body">
      <h4>Five Classes of Work</h4>
      <p><strong>Hour-cut:</strong> In the cut set, reachable, exploit live. Response is a compensating control — sever reachability, block at the edge, isolate — not the patch. No vendor patch cycle meets a four-hour window.<br><strong>Day-cut:</strong> In the cut set, material but not racing. One change window, verified before closure.<br><strong>Sprint-cut:</strong> In the cut set, no urgency. Normal engineering rhythm — this is where patch velocity is the correct tool.<br><strong>Dark:</strong> Reachability or exploitability unknown. Route to discovery — characterise before remediating.<br><strong>Declined:</strong> On no path to a jewel. A documented, owned risk acceptance with a review trigger — not a backlog item quietly aging.</p>
    </div>
  </div>
  <div class="feature-item">
    <div class="feature-item-icon">🔍</div>
    <div class="feature-item-body">
      <h4>Zero-Budget Vulnerability Discovery</h4>
      <p>osquery deployed as a sovereign discovery platform alongside scripted checks for the findings scanners miss — service account privileges, unpatched firmware, container base image CVEs, exposed management interfaces. Discovery before scanner procurement is almost always sufficient to find the cut.</p>
    </div>
  </div>
  <div class="feature-item">
    <div class="feature-item-icon">📉</div>
    <div class="feature-item-body">
      <h4>Cut Depth as the Metric</h4>
      <p>The programme does not measure MTTR. It measures <strong>cut depth (κ)</strong> — the number of independent successes an adversary needs. A κ of 1 means one compromised service account ends the business; the engagement target is 4 or better. κ is reported alongside kill-chain length and the count of unmapped edges, because a cut is only as honest as the graph beneath it. And every cut closes with a verification signal — an unverified removal is a <em>ghost cut</em>: fully traversable, and now invisible.</p>
    </div>
  </div>
</div>

## The Barbell

The antifragile TVM programme has two ends and a middle to avoid — and with costed cuts, the shape is derived rather than asserted. **Fast end:** hours-lane compensating controls — edge blocks, isolation, reachability cuts — that win the time race a patch cannot. **Structural end:** segmentation, least privilege, and T0 protection that make most vulnerabilities irrelevant before they are disclosed. **The fragile middle to avoid:** the aging critical-patch backlog that carries hours-lane urgency while moving at sprint-lane speed. It is not forbidden by doctrine — it simply never wins the arithmetic.

## Scope and Prerequisites

| | |
|---|---|
| **Duration** | 45–90 days |
| **Environment** | Any (cloud, on-premises, hybrid) |
| **Prerequisites** | Module 0 (Diagnostic) to establish the estate graph and initial cut; asset inventory from Modules 1 or 6 |
| **Natural follow-on** | Module 10 (Red Team & Validation) to validate that severed paths stay severed |

<div class="cta-strip">
  <h2>Stop racing an attacker you cannot outrun</h2>
  <p>The winning move is not to patch the long tail faster. It is to make most of it not matter — and contain the few that do in hours, not weeks.</p>
  <div class="actions">
    <a href="/about/#contact" class="btn btn-primary">Get in Touch</a>
    <a href="/consulting/skills/" class="btn btn-outline">View All Modules</a>
  </div>
</div>