Category: martial arts

First Principles of Performance Part IV

The Volume Spectrum

Understanding Maintenance Volume (MV), Minimum Effective Volume (MEV), Maximum Adaptive Volume (MAV), Maximum Recoverable Volume (MRV), and Everything Between

Growth is determined not by how much work you perform, but by how much productive work you can recover from.

Introduction

Walk into almost any Olympic Weightlifting or power lifting gym, CrossFit affiliate, or even the standard Globo gym and you’ll eventually encounter two seemingly opposite philosophies.

One athlete believes progress comes from doing more: more sets, more repetitions, more accessory work, more conditioning, more training days. If some novel amount of work produces results, even more work should produce even better results.

Another takes almost the opposite approach: do as little as necessary to stimulate improvement, then get out and recover.

Curiously, both can point to successful athletes who appear to prove them right.

One can point to the CrossFit athlete training multiple sessions a day, the weightlifter accumulating hundreds of technically demanding repetitions each week, or the bodybuilder thriving on German high volume training. Then another points to an elite powerlifter progressing on surprisingly few max-effort lifts, or an experienced weightlifter whose training becomes more productive after unnecessary volume is removed.

So which approach is correct? Both and neither. Why? Because the question itself is flawed.

The body does not respond to volume in absolute terms. It responds to recoverable stress.

That distinction changes everything.

The objective of training is not to perform the greatest amount of work possible. It is to perform the greatest amount of productive work possible: enough to create the desired adaptation without accumulating so much fatigue that additional work stops contributing meaningfully to it.

There is a difference between training that challenges your capacity and training that simply consumes it.

Understanding where that line exists, and recognizing that it shifts according to the athlete, the adaptation being pursued, the type of training being performed, and where the athlete is in their development, is one of the most valuable skills an athlete or coach can develop.

This is where the Volume Spectrum begins.

More Is Better, Until It Isn’t

One of the oldest assumptions in strength training is beautifully simple: if ten sets build muscle, twenty must build even more. And if twenty works, why not thirty?

The problem is that biological markers rarely, like life, move in straight lines.

The human body is governed by diminishing returns. Initially, increasing training volume can produce greater adaptation. Strength improves, muscle grows, work capacity increases, and technique becomes more refined. But eventually those returns begin to diminish. Progress slows, then plateaus, and if volume continues increasing without sufficient recovery, performance can begin moving backward.

More work has become less productive.

The irony is that many dedicated athletes interpret this decline exactly backward. Feeling stalled, they assume they simply need to work harder, so they add another exercise, another set, another conditioning session, another “finisher.”

Instead of solving the problem, they’ve increased the very stress that caused it.

The Volume Spectrum

Training volume can be understood through four useful landmarks along a continuum. These should not be treated as rigid physiological thresholds or universal numerical prescriptions, but as practical regions that help coaches think about the relationship between training stress and adaptation.

Quick Reference: Training Volume Landmarks

MV (Maintenance Volume): The minimum amount of training needed to maintain current performance and muscle mass. Used during periods of reduced training, deloads, or recovery phases.

MEV (Minimum Effective Volume): The lowest training dose that produces measurable progress or adaptation. Anything below this threshold will not drive improvement.

MAV (Maximum Adaptive Volume): The “sweet spot” where training volume is high enough to maximize gains without causing excess fatigue or risk of overtraining. This is where most productive training occurs.

MRV (Maximum Recoverable Volume): The upper limit of training volume that the body can adapt to and recover from. Exceeding this consistently leads to stagnation, regression, or injury.

In short:

  • MV: Enough to maintain, not improve.
  • MEV: The minimum to make progress.
  • MAV: The most productive range for gains.
  • MRV: The most you can recover from, not to be exceeded.

Maintenance Volume (MV)

Maintenance Volume is exactly what it sounds like: the minimum amount of work required to preserve a current level of adaptation.

Notice what it is not. Maintenance volume is not intended to produce meaningful improvement. It provides enough stimulus to prevent meaningful loss.

This matters more than many athletes realize because maintenance allows training resources to be reallocated. A competitive CrossFit athlete may temporarily reduce upper-body hypertrophy work while emphasizing Olympic lifting. A tactical professional preparing for selection may maintain maximal strength while substantially increasing endurance. An older adult may temporarily reduce overall workload while attempting to preserve existing strength and muscle mass.

Maintaining an adaptation generally requires less training than developing it in the first place. That principle becomes one of the coach’s most valuable tools because no athlete can emphasize everything simultaneously.

Sometimes maintaining one quality is precisely what allows another to improve.

Minimum Effective Volume (MEV)

MEV represents the lowest amount of training necessary to produce measurable improvement. Think of it as crossing the threshold where training moves beyond maintenance and begins providing enough stimulus for further adaptation.

Importantly, MEV is highly individual.

A novice lifter may stimulate meaningful progress with relatively little training. An experienced athlete may require substantially more work simply to continue improving. Training age changes the equation because the stronger, more conditioned, and more experienced you become, the greater the stimulus may need to be before the body has sufficient reason to adapt further.

Success changes the rules.

Maximum Adaptive Volume (MAV)

Maximum Adaptive Volume describes the region where training produces the greatest return relative to the fatigue it creates.

Not necessarily the most work. The best work you can do, achieving the intended stimulus, and recover from.

Most productive training should occur somewhere in this range. Performance improves, strength or work capacity develops, recovery remains manageable, technique stays relatively sharp, and the athlete remains capable of continuing to perform quality training.

That distinction matters. MAV is not defined by exhaustion, it’s defined by adaptation.

Maximum Recoverable Volume (MRV)

Eventually every athlete reaches a point where additional work creates more fatigue than useful adaptation. That upper boundary is Maximum Recoverable Volume.

MRV should not be treated as a target. It’s the ceiling.

Experienced athletes may intentionally approach that ceiling during concentrated training blocks before reducing workload and allowing accumulated fatigue to dissipate. Used carefully, periods of functional overreaching can have a place within training.

Living near or above MRV is another matter.

When training chronically exceeds the athlete’s ability to recover, familiar warning signs can begin appearing: declining performance, slower bar speed, persistent soreness or joint discomfort, deteriorating sleep, reduced motivation, worsening session quality, and increased susceptibility to minor illness.

The dedicated athlete may again interpret these symptoms as evidence that more work is required. Often the opposite is true.

Why These Landmarks Move

One of the biggest mistakes coaches make is treating volume landmarks as fixed numbers.

They aren’t.

Your MEV this year may not resemble your MEV five years from now. Your MRV during a period of low life stress may differ considerably from your MRV during a demanding work cycle, caloric deficit, competition season, or period of poor sleep. The amount of volume you can recover from for one physical quality may also differ substantially from what you can tolerate for another.

These landmarks move because the athlete moves. As the old saying goes, “You can’t be in fight shape all the time.”

Training Age

Beginners often require surprisingly little work to improve. Advanced athletes generally require a greater stimulus to continue adapting, while simultaneously becoming capable of creating considerably more stress during each hard working set.

Five sets of squats performed by an athlete squatting 135 pounds do not represent the same physiological event as five sets performed by an athlete squatting 500.

The volume may look identical on paper. The affect on the body is not.

Exercise Selection and Recovery Cost

Not all training stress is created equally.

Three sets of leg extensions, three sets of heavy back squats, three rounds of ring muscle-ups, ten minutes of EMOM barbell cycling, and a 5k row for time all qualify as training volume, but they do not impose the same demand.

Heavy compound lifting can create substantial mechanical and systemic fatigue. High-repetition gymnastics challenge local muscular endurance, connective tissue, grip, coordination, and the ability to maintain movement quality as fatigue (neurological and physical) accumulates.

Repeated cleans or snatches performed under metabolic fatigue combine muscular endurance with technical proficiency, strength, power, timing, and repeated force production. Longer aerobic work may create relatively little mechanical damage while still imposing substantial cardiorespiratory and metabolic demand.

This is why simply counting sets, repetitions, minutes, or meters can become misleading.

Programming volume requires understanding what quality the work is developing, how much useful stimulus it provides, and what it costs the athlete to recover from it.

The body doesn’t count reps, it accumulates stress.

Different Qualities Carry Different Costs

One of the greatest misconceptions in training is assuming every physical quality responds to volume in the same way.

It doesn’t.

Absolute strength and power require exposure to high levels of force and velocity. A strong baseline in movements such as squats, deadlifts, presses, pulls, and Olympic lifts provide a foundation from which explosive force can be expressed.

Muscular endurance requires something different: the local capacity of muscles and the nervous system controlling them to repeatedly produce useful contractions despite accumulating fatigue. In gymnastics, that may mean sustaining pull-ups, push-ups, toes-to-bar, handstand push-ups, or muscle-ups. With a barbell, it may mean repeatedly cycling cleans, snatches, thrusters, or shoulder-to-overhead movements while maintaining enough technical integrity to continue working efficiently.

Cardiorespiratory endurance and stamina place another demand on the athlete. Aerobic and anaerobic metabolism must continually provide energy across efforts lasting seconds, minutes, or hours, while the athlete develops the capacity to sustain output and recover between repeated demands.

Strength, power, muscular endurance, barbell endurance, cardiorespiratory endurance, and stamina coexist, but they are not interchangeable.

A CrossFit athlete preparing for competition may intentionally increase muscular endurance, barbell cycling, aerobic development, and repeated-effort aerobic power and capacity training while maintaining rather than maximizing absolute strength.

An Olympic weightlifter may do almost the opposite, allocating considerably more training toward strength, power, technical consistency, and the competition lifts. A tactical professional may require substantial strength alongside loaded movement, cardiorespiratory endurance, muscular stamina, and repeated performance under fatigue.

An older adult may prioritize strength, muscle mass, aerobic capacity, mobility, balance, and resilience because the objective is preserving capability and independence rather than maximizing competitive performance.

None of these athletes are training incorrectly, they’re simply solving different problems. Volume only becomes meaningful when viewed through the adaptation being pursued.

Movement Quality Changes the Cost of Volume

There is another variable that sets and repetitions alone cannot explain: movement quality.

Before deciding that an athlete needs more squats, gymnastics, barbell work, or conditioning, the coach must understand whether the athlete can efficiently perform the movements being prescribed.

Can they squat through the required range of motion while maintaining position? Can they establish a stable overhead position and safely receive a clean or snatch? Do they possess the ankle, hip, thoracic, and shoulder mobility required for the task? Can they maintain trunk control and coordination as fatigue accumulates?

Flexibility and mobility are not decorative qualities simply sprinkled in at the beginning or at the end of a training session. Adequate range of motion allows the athlete to access the positions required for the task(s); mobility adds the ability to control those positions. Coordination, agility, and balance allow the athlete to organize movement, redirect force, transition between tasks, and preserve technical integrity under changing conditions.

These qualities are essential and non-negotiable under fatigue.

Walking on your hands while fresh is one skill. Maintaining a handstand walk after heavy cleans and/or several minutes of high-output conditioning is another. The same principle applies to receiving a snatch in a deep overhead squat, transitioning efficiently through ring muscle-ups, or maintaining clean mechanics while breathing heavily and losing grip strength.

Poor movement quality increases the cost of work. Efficient movement reduces it.

Two athletes can therefore complete exactly the same prescribed volume while experiencing meaningfully different training loads.

Sometimes the fastest way to improve work capacity isn’t adding more work.

It’s reducing wasted movement. Or, what we used refer to in CrossFit as seeking Virtuosity in movement.

Volume Exists in Time

Twenty weekly sets performed in one session are not equivalent to twenty sets distributed across four sessions.

Fatigue accumulates differently. Performance quality changes. Recovery opportunities change.

The same principle applies outside traditional resistance training. Twenty minutes of high-skill gymnastics performed while fresh is not equivalent to twenty minutes performed after heavy barbell work. Six sprint intervals distributed appropriately across a training week do not necessarily impose the same cost as those same intervals performed immediately after a demanding lower-body session.

Volume therefore cannot be separated from frequency, sequencing, and recovery. Where the work occurs matters, what happens before and after it matters. The body does not simply experience training volume. It experiences stress over time.

The Athlete Changes the Equation

Dynamis 

Genetics, sleep, nutrition, age, life stress, occupation, training history, and movement quality all influence the amount and type of training an athlete can productively tolerate.

A firefighter working rotating night shifts may have a very different MRV from a college student sleeping nine hours each night. Two athletes possessing similar strength may tolerate very different amounts of training, and two athletes capable of completing the same workout may require entirely different interventions because their limiting factors are different.

One may lack absolute strength. Another may lack muscular endurance. Another may possess tremendous strength but poor muscular endurance. Another may have excellent local muscular endurance but insufficient aerobic capacity to recover between efforts. Another may simply move inefficiently which can make each training session twice as hard as it needs to be with the most basic of movements like air squats, pushups, pullups or burpees.

That’s why programming that ignores recovery outside the gym ignores half the equation.

And programming that ignores the individual misunderstands the other half.

Autoregulation: Listening Without Guessing

Perhaps the greatest weakness of rigid programming is the assumption that today’s body is identical to yesterday’s.

It isn’t.

Autoregulation recognizes that readiness fluctuates. Instead of blindly completing predetermined workloads regardless of performance, intelligent athletes and coaches adjust training according to relevant objective and subjective information.

Bar speed, repetitions in reserve, perceived exertion, heart-rate recovery, sleep quality, motivation, persistent soreness, session performance, movement quality, and technical deterioration under fatigue can all provide useful information.

No single metric tells the entire story. The purpose is not to replace programming with daily improvisation.

Autoregulation isn’t abandoning structure it’s allowing physiology to inform execution.

Deloads: Adaptation’s Forgotten Partner

One of the greatest misconceptions in training is that progress results from uninterrupted accumulation. It doesn’t. Progress often depends upon strategic reduction.

Deloads intentionally reduce training stress so accumulated fatigue can dissipate while much of the underlying adaptation is preserved. The purpose isn’t simply to rest. It is to restore the athlete’s capacity to perform productive training again.

A deload is not necessarily a step backward. Often it is the point at which accumulated fitness becomes visible beneath accumulated fatigue. We’ll discuss deloading, and its importance in more detail, later in this series

Pacing, Bottlenecks, and Productive Volume

More volume is rarely the solution to poor performance.

Sometimes the athlete needs more strength. Sometimes they need greater muscular endurance, a larger aerobic base, better gymnastic skill, more technical practice, or improved movement economy.

And sometimes they simply need to stop going out too hard. Pacing by itself is a performance skill. Athletes have to learn how much work can be performed now without any degradation in overall performance.

That means learning how quickly your breathing recovers, knowing when to stop just before grip or shoulder failure, or when technically efficient barbell cycling becomes increasingly expensive, and where local muscular fatigue or technical breakdown reliably appears.

Meaning, where is the bottleneck?

An athlete who repeatedly falls apart during the final five minutes of a 20min AMRAP, may not need another conditioning session. They may benefit more from not trying to win the first five minutes.

Likewise, an athlete struggling with high-repetition cleans may assume the problem is conditioning when insufficient absolute strength is making every repetition too expensive. Another athlete may possess enormous strength but lose time because poor economy of motion makes their receiving positions inefficient. Another may possess the engine and strength but lack the coordination required to transition efficiently between gymnastics and other external loading.

The workout reveals the symptom(s) and good assessments identify the cause(s). That distinction matters because training should target the bottleneck, not just accumulate more fatigue around it.

Volume Is a Conversation, Not a Competition

Perhaps the most important lesson from the Volume Spectrum is this: Volume is not something to maximize, it’s something to be optimized.

It’s a training resource to be allocated according to the athlete’s objectives, abilities, limitations, and capacity to recover. The strongest programs are rarely those that demand the most work. They are the ones that consistently produce the greatest useful adaptation relative to their cost.

That balance changes throughout a career. It changes across seasons and according to the physical quality being developed. It changes during periods of occupational stress, poor sleep, illness, caloric restriction, or competition preparation. And it changes as weaknesses become strengths and new bottlenecks emerge.

The best coaches therefore don’t ask: How much volume can this athlete survive?

They ask: How much productive volume can this athlete recover from?

And eventually, they ask an even better question: Where should that volume be spent?

Those are profoundly different questions. One measures work while the other considers adaptation. And that final question brings us to the next principle.

Looking Ahead

By now, we’ve moved far beyond the old argument that strength and conditioning somehow exist in opposition to one another.

We’ve seen that the interference effect is real but contextual. We’ve examined what performance programs actually look like and why athletes with very different objectives still develop many of the same fundamental physical qualities. And now we’ve established that even the amount of training itself exists along a spectrum, from the work required merely to maintain an adaptation to the upper boundary of what the athlete can productively recover from.

But volume alone still cannot tell us what to do.

Knowing that an athlete can recover from twelve hours of training each week tells us nothing about how those twelve hours should be spent.

Should we build absolute strength and power? Develop muscular endurance or barbell cycling skill? Expand cardiorespiratory capacity? Improve flexibility and movement efficiency? Develop coordination, agility, and balance? Improve movement quality or technical skill? Practice pacing? Attack a specific bottleneck?

Or should several of those qualities simply be maintained while training resources are concentrated on the one that matters most right now?

That is where coaching becomes something more than exercise selection.

A bodybuilder, Olympic weightlifter, tactical professional, CrossFit athlete, and older adult may all require some combination of strength, endurance, power, movement competency, and resilience.

But their needs vary in degree and application, not in kind. What changes is the proportion.

What changes is the priority. What also changes is the organization of stress across time.

Good programming does not ask which physical quality is universally best. It asks which quality matters most for this athlete, at this moment, how much of the others must be developed or preserved, where the athlete’s bottlenecks exist, and how those pieces can coexist without obscuring the primary objective.

That is why programming cannot be reduced to exercises written beneath the days of the week, and it certainly isn’t the random accumulation of difficult workouts.

Programming is the deliberate organization of stress in pursuit of adaptation.

It determines what to develop, what to maintain, what to temporarily deprioritize, how much work to perform, when to perform it, when to push, when to pull back, and when the athlete standing in front of you requires something different from what you originally wrote on paper.

In Part V of First Principles of Performance we discover how programming is not the science of writing workouts. It’s the strategic art of organizing adaptation, we bring those pieces together and examine how coaches actually organize adaptation: how strength, power, muscular endurance, cardiorespiratory capacity, movement competency, skill, recovery, and the individual athlete become a coherent training system rather than a collection of disconnected workouts.

Because knowing the physiology is important, knowing the how and why we utilize MGW is foundational, and how and why knowing all of the movements is elemental. But, knowing how to organize them around the needs of the individual is where knowledge becomes art.

Programming is not simply the science of writing workouts. It is the art of organizing adaptation. As always, the principles remain constant.

The application is the art. And that’s what quality coaching is all about.

First Principles of Performance – Part III

What Do Performance Programs Actually Look Like?

The same physical qualities. Different priorities. Intelligent application.

Part I, we dismantled the myth.

Part II explained the physiology.

Part III shows how to construct the program.

The Central Thesis

Programming is not the indiscriminate accumulation of desirable exercises. It is the deliberate allocation of finite adaptive resources.

Every athlete would benefit from being stronger, more muscular, more powerful, better conditioned, more mobile, and more resilient. The problem is that no one can maximize every quality simultaneously.

A sound program therefore asks:

  1. What must be developed?
  2. What must be maintained?
  3. What may be temporarily deprioritized and for how long?
  4. What forms of training deliver the greatest benefit with the least conflicting fatigue?

That’s where the individual disciplines separate.

The Framework

Before discussing specific populations, let’s discuss a common framework that can apply to anyone.

The Primary Objective

The primary objective determines what receives the athlete’s best energy, highest-quality practice, and largest recovery allocation.

  • General physical preparedness (GPP): broad competence without narrow specialization
  • Tactical readiness: resembles GPP but carries a different standard. Failure is not an option
  • Olympic Weightlifting: technical power, speed, athleticism, superior flexibility + stability at end ranges of motion, and maximal strength
  • CrossFit: develop broad competitive capacity across the 10 general physical skills and also have “home run” ability in several of those skills
  • Bodybuilding: hypertrophy, size, and muscular symmetry
  • Healthy aging and Wellness: preservation of strength, power, muscle, mobility, and cardiorespiratory fitness

Developing Secondary qualities

Secondary qualities support the principal objective but must not compete excessively with it.

For example:

  • An Olympic weightlifter needs aerobic fitness for recovery and general wellness, but not the capacity to run a marathon.
  • A bodybuilder needs conditioning, but not enough aerobic volume to take away from building muscle.
  • A tactical athlete needs strength, but not at the expense of sharpness of movement, the ability to endure, and engage and disarm enemy combatants, i.e. maintain occupational durability.
  • A more mature adult needs to build and/or maintain muscle mass, but also enough power, balance, coordination, flexibility, and aerobic capacity to remain independent.

Establishing the minimum effective dose

Not every quality requires maximal training volume. Some qualities can be developed with relatively little work. Others can be maintained with substantially less work than was required to build them.

This allows a coach to place most resources toward the current priority while preserving other capacities.

Control competing fatigue

The interference problem is not merely molecular. It is mechanical, neurological, metabolic, and logistical.

Two sessions may theoretically coexist but still conflict because they stress:

  • The same musculature
  • The same joints and connective tissues
  • The same energy systems
  • The same neurological resources
  • The athlete’s limited sleep, time, and nutrition

This is why modality, sequence, volume, and timing matter.

Sequence the training week intelligently

The highest-priority, highest-skill, and highest-velocity work should generally occur when the athlete is freshest.

A useful hierarchy is:

  1. Technical and explosive work
  2. Heavy strength work
  3. Hypertrophy or accessory work
  4. Conditioning
  5. Supplemental mobility and tissue restoration

That order can change according to the sport, but it gives us a sound starting point.

How the application changes

CrossFit: developing breadth without creating chaos

opt ccp drugs
opt ccp brain on drugs

CrossFit presents one of the hardest programming problems because nearly every physical quality matters.

Why does CrossFit usually present a problem for most coaches? We begin with the 10 general physical skills. They are cardiovascular/respiratory endurance, stamina, strength, flexibility, power, coordination, agility, balance, and accuracy.

  • Cardiovascular/respiratory endurance – The ability of the body’s systems to gather, process, and deliver oxygen
  • Stamina – The ability of body systems to process, deliver, store, and utilize energy
  • Strength – The ability of a muscular unit, or combination of muscular units, to apply force
  • Flexibility – the ability to maximize the range of motion at a given joint
  • Power – The ability of a muscular unit, or combination of muscular units, to apply maximum force in minimum time
  • Speed – The ability to minimize the cycle time of a repeated movement
  • Coordination – The ability to combine several distinct movement patterns into a singular distinct movement
  • Agility – The ability to minimize transition time from one movement pattern to another
  • Balance – The ability to control the placement of the body’s center of gravity in relation to its support base
  • Accuracy – The ability to control movement in any given direction or at a given intensity”

So, a competitive CrossFit athlete requires:

  • Maximal and relative strength
  • Olympic lifting proficiency
  • Gymnastics skill
  • Aerobic capacity
  • Anaerobic power
  • Muscular endurance
  • Movement efficiency
  • Fatigue resistance
  • Rapid recovery between efforts, et cetera

The danger is confusing variety with randomness.

A well-designed CrossFit program should not simply expose the athlete to more movements and more suffering. It should develop identifiable qualities in a logical sequence.

Primary considerations

Strength and skill must be developed and then protected.
Heavy lifting, technical precision/near perfection in the Olympic lifts, and advanced gymnastic skill should not routinely be performed after unnecessary fatigue.

Conditioning requires structure.
The athlete needs distinct exposures to:

  • Low-intensity aerobic development
  • Threshold or tempo work
  • Short glycolytic intervals
  • Sprint interval training
  • Mixed-modal competition pieces

Not every metcon should destroy the athlete.
Some sessions should develop pace, transitions, breathing control, or movement economy without producing maximal fatigue.

The interference effect is managed through planning.
Heavy squats should not be surrounded by repeated high-volume running, jumping, and cycling sessions unless that fatigue is intentional.

CrossFit programming should develop the unknown and unknowable by building deep, transferable capacities, not by making every day unknowable to the coach.

Hypertrophy: condition the athlete without stealing from growth

For hypertrophy, the principal objective is clear:

Accumulate sufficient high-quality resistance-training volume to stimulate muscle growth, then recover from it.

Cardiovascular training should improve health, work capacity, and recovery without degrading lifting performance.

Best applications

  • Zone 2 bike/row/ski, jogging if you can maintain zone 2, or other similar cardiac demand work
  • MAP training or what I call “CrossFit aerobics”
  • Short tempo intervals
  • Carefully dosed sprint work
  • Sleds, carries, or machines that reduce eccentric loading
  • Conditioning performed after lifting or in separate sessions

Primary constraints

The bodybuilder or hypertrophy-focused lifter must manage:

  • Total lower-body fatigue
  • Caloric expenditure
  • Joint stress
  • Session duration
  • Interference with progressive overload

The appropriate amount depends on the athlete’s training age, caloric intake, exercise selection, and recovery.

The practical rule is straightforward:

Conditioning should leave the athlete better prepared to train, not chronically less capable of producing force and volume.

Bodybuilding: hypertrophy with greater specialization

built rep after rep, brick after brick

Bodybuilding and general hypertrophy training overlap, but bodybuilding adds several constraints:

  • Muscular symmetry
  • Proportional development
  • High local training volume
  • Fatigue management across many isolation exercises
  • Contest preparation and caloric restriction
  • Preservation of muscle during fat loss

Cardio becomes more prominent during contest preparation, but recovery resources simultaneously decline.

That makes modality selection especially important.

Low-impact cardio often becomes preferable because it increases energy expenditure without imposing excessive eccentric loading or soreness. As calories fall, the athlete must also avoid the common mistake of increasing cardio aggressively while maintaining all previous lifting volume.

Bodybuilding programming is therefore an exercise in resource preservation:

  • Retain muscular tension
  • Preserve strength where possible
  • Manage fatigue
  • Increase energy expenditure gradually
  • Avoid turning every session into a test of willpower

The same physiology applies. The context changes.

General Physical Preparedness: build the widest useful base

unit
unit

GPP is not preparation for nothing. It is preparation for many possible things.

The objective is broad physical competence:

  • Reasonable strength
  • Useful muscle mass
  • Aerobic fitness
  • Anaerobic capacity
  • Mobility
  • Coordination
  • Power
  • Durability

A GPP program should avoid the extremes of narrow specialization.

The athlete does not need:

  • Powerlifting-level maximal strength
  • Marathon-level endurance
  • Bodybuilding-level weekly muscle volume
  • Elite Olympic lifting technique

But the athlete benefits from meaningful development in all of them.

A balanced GPP week might include:

  • Two or three strength sessions
  • One power or sprint exposure
  • Two aerobic sessions
  • One higher-intensity conditioning session
  • Carries, sleds, jumps, throws, crawling, or climbing
  • Regular movement-quality work

This is where first principles matter most. GPP should create optionality: the ability to enter a more specialized phase without beginning from zero.

Tactical readiness. The real unknown and unknowable.

walk em down

Tactical readiness resembles GPP but carries a different standard. Failure is not an option.

The tactical athlete may need to:

  • Sprint – short, medium, and long distance, under load, taking and returning fire
  • Climb – 15 – 30 ft. ropes for multiple reps
  • Fight – from striking, to grappling, to weapons defense and disarming skill, and all must work under possible extreme fatigue
  • Drag or carry another person, possibly multiple people
  • Move large loads, long distance, and quickly
  • Operate for hours
  • Recover quickly
  • Make innumerable decisions under fatigue
  • Repeat near perfect efforts without warning

That’s the minimum standard and it requires far more than “being strong” or being “in shape” ever can.

The old saying is, the novice practices the movements so they don’t get them wrong. The professional has practiced them so often they can’t get them wrong.

Programming priorities

  • Relative and absolute strength
  • Loaded movement capacity
  • Grip and trunk endurance
  • Aerobic base
  • Martial Proficiency
  • Repeated sprint ability
  • Anaerobic endurance
  • Power and rate of force development
  • Durability under imperfect, and often austere, conditions
  • Recovery between multiple, unpredictable efforts

The program must also preserve technical and occupational skills. Fitness should support marksmanship, defensive tactics, movement, communication, and decision-making rather than degrading them through constant exhaustion.

The “unknown and unknowable” should be addressed by building robust capacities and occasionally testing their integration.

It should not justify random training. Uncertainty in the mission does not require uncertainty in the program. That should be one of the article’s anchor lines.

Olympic weightlifting: develop strength, speed, power, technical skill, and force production

Greg and Amiee – the early days of Catalyst Athletics

Olympic weightlifting is a highly technical, speed-strength, and power output sport.

Its primary qualities are:

  • Technical proficiency
  • Explosive strength
  • Maximal strength
  • Speed-strength
  • Superior positional mobility
  • Well-developed neuromuscular adaptation

Conditioning is useful, but it must remain subordinate to performance in the snatch and the clean and jerk.

Productive conditioning

  • Low-intensity aerobic work
  • Short cyclical intervals
  • Sled work, carries, et cetera
  • Limited sprint exposures whether it’s running, rowing, bike erg assault bike, or ski erg
  • General body weight flow/movement and recovery work

Common programming error

A weightlifter can become so conditioned that the conditioning begins to impair the quality of technical practice, squatting, pulling, and recovery.

Conversely, poor aerobic fitness can reduce training density and the ability to recover between sets and sessions.

The goal is not maximal endurance.

It is sufficient conditioning to support greater quantities of high-quality weightlifting.

Healthy aging: train what age attempts to take away

Healthy aging may be the most important application because nearly every major physical quality declines without deliberate training.

The program should preserve:

  • Muscle mass
  • Maximal strength
  • Power
  • Bone density
  • Aerobic capacity
  • Balance
  • Coordination
  • Mobility
  • Confidence in movement

Power deserves particular emphasis because it often declines faster than maximal strength and is essential for preventing falls, climbing stairs, catching oneself, and moving quickly when necessary.

A complete healthy-aging program should therefore include:

  • Progressive resistance training
  • Safe explosive intent or power training
  • Zone 2 aerobic work
  • Some higher-intensity aerobic exposure
  • Balance and unilateral movement
  • Carries and gait work
  • Mobility sufficient for daily function
  • Practice getting down to and up from the floor

The objective is not merely extending lifespan.

It is preserving capability across the lifespan.

The 70-year-old and the competitive athlete are not performing identical workouts, but the underlying qualities remain the same. Load, velocity, complexity, volume, and risk are adjusted to the individual.

Again: different in degree, not in kind.

The comparative model

PopulationPrimary EmphasisSupporting ConditioningMain Interference Risk
CrossFitBroad competitive capacityFull spectrumExcessive mixed fatigue and inadequate specialization
HypertrophyMuscle growthLow-impact aerobic and concise intervalsReduced lifting quality and recovery
BodybuildingMuscular size, symmetry, leannessProgressive low-impact cardioEnergy deficit plus excessive total volume
GPPBroad competenceBalanced aerobic and anaerobic workRandomness without measurable progression
TacticalDurable performance under uncertaintyAerobic base, loaded work, repeated effortsFitness fatigue degrading occupational skill
Olympic weightliftingSkill, power, maximal strengthMinimal effective conditioning doseLoss of speed, freshness, and technical quality
Healthy agingCapability and independenceAerobic base plus selected intensityUnderloading, excessive caution, and lack of power work

The deeper lesson

This third article should not merely contain seven sample programs. It should teach the reader how to reason.

The reader should finish understanding that programming is a process of adjusting several variables:

  • Priority
  • Frequency
  • Intensity
  • Volume
  • Modality
  • Sequence
  • Recovery
  • Specificity

The exercises are not the program. The allocation of stress is the program.

That is how we prevent the article from becoming a collection of templates that readers blindly copy. We can include sample weekly structures, but each one should demonstrate the principle behind the arrangement.

The barbell, a bike, the rower, a sled, the track, or a pull-up bar are not competing philosophies. They are tools. Their value depends on the problem they are being used to solve.

A bodybuilder, Olympic weightlifter, tactical professional, CrossFit athlete, and older adult all require strength, endurance, power, movement competency, and resilience. The needs vary in application, not in kind.

Good programming does not ask which quality is universally best. It asks which quality matters most right now, how much of the others must be developed or preserved, and how they can coexist without obscuring the primary objective.

Programming is not the science of writing workouts. It is the art of organizing adaptation. As always, the principles remain constant. The application is the art and that’s what real coaching is all about

First Principles of Performance – Part II

The Interference Effect: Separating Physiology from Fitness Mythology

“Understanding what works is valuable. Understanding why it works changes the way you think forever.”

In the previous article, Cardio Doesn’t Kill Your Gains. Poor Programming Does, we challenged one of the most persistent myths in strength and conditioning.

The conclusion was straightforward.

Cardiovascular training does not inherently prevent muscle growth. Rather, poorly designed training, excessive volume, inadequate recovery, insufficient nutrition, and conflicting priorities, is what most often limits progress.

For the overwhelming majority of lifters, the question isn’t whether they should perform cardiovascular training. The question is how to integrate it intelligently into a well-designed program.

That practical advice is enough for most people.

But for coaches, athletes, and those who simply enjoy understanding why the body behaves the way it does, there is a much deeper story waiting beneath the surface.

That story begins inside a single muscle cell.

The Conversation Inside the Cell

Every training session asks your body a question.

Heavy squats ask: Can you produce more force?

A sprint interval asks: Can you generate enormous amounts of energy very quickly?

A thirty-minute Zone 2 session asks: Can you become more efficient?

Your muscles answer each of these questions by activating different signaling pathways that regulate adaptation.

These pathways are often portrayed as opposing armies locked in constant battle. One builds muscle. The other builds endurance. One must win while the other loses. It’s an appealing narrative. It’s also an oversimplification because biology is rarely that binary.

Meet the Two Most Famous Molecules in Exercise Physiology

If you’ve spent any time reading about muscle growth or endurance training, you’ve almost certainly encountered two acronyms:

AMPK

and

mTOR.

They’re frequently described as rivals. While that’s directionally true, the relationship is considerably more nuanced than the internet often suggests.

AMPK functions as the cell’s energy sensor. Whenever energy availability begins to decline, as happens during prolonged or demanding exercise, AMPK becomes activated.

Its job is straightforward and that’s to restore energy balance.

It encourages the body to become more metabolically efficient, increase glucose uptake, enhance fat oxidation, and promote mitochondrial adaptations that improve endurance over time.

mTOR serves a different purpose.

Rather than conserving energy, mTOR responds to mechanical tension, amino acid availability, particularly leucine, and adequate cellular energy by promoting protein synthesis, tissue repair, and muscle growth.

One pathway asks,

“How do we survive this demand?”

The other asks,

“How do we become stronger for the next one?”

Both are essential an neither is the enemy.

Where the Myth Begins

Here’s where decades of misunderstanding started. Researchers discovered that AMPK can suppress certain components of the mTOR pathway.

That finding quickly evolved into a popular conclusion:

“Cardio turns on AMPK.

AMPK turns off mTOR.

Therefore cardio kills muscle growth.”

Simple but also wrong, or at least incomplete. Because physiology almost never operates like a light switch.

Biology Prefers Dimmers Over Switches

One of the most overlooked aspects of exercise physiology is time. AMPK responds rapidly to energetic stress. During demanding exercise, it rises quickly.

Then, once the exercise ends and energy balance begins to recover, AMPK activity declines just as rapidly, often within minutes to a few hours.

mTOR behaves differently.

Following resistance training, especially when combined with adequate protein intake, mTOR signaling can remain elevated for many hours and, in some cases, more than a day as muscle protein synthesis continues.

These aren’t two permanent states competing for dominance. They’re temporary responses to changing physiological demands. Your body constantly adjusts which pathway receives greater emphasis based on what it needs at that moment.

Location Matters

Another misconception is that these pathways somehow control the entire body equally at all times. They don’t. Many signaling responses are remarkably localized.

The muscle fibers performing repeated contractions experience different metabolic demands than surrounding tissues. The cardiovascular system responds differently than skeletal muscle. The liver behaves differently than adipose tissue.

Even within skeletal muscle, fiber type influences adaptation. The body isn’t issuing a single command. It’s conducting an orchestra. Different sections play different parts. Together they produce adaptation.

The Body Doesn’t Choose Between Building and Improving

Perhaps the most fascinating aspect of this entire discussion is that AMPK and mTOR are not always mutually exclusive. Under certain physiological conditions, aspects of both pathways can be active simultaneously. Cells routinely remove damaged proteins while synthesizing new ones.

Energy availability can improve while structural remodeling occurs. Recovery itself is an ongoing process of destruction and regeneration. Our physiology isn’t designed around choosing one adaptation. It’s designed around balancing competing demands with extraordinary precision.

What the Research Shows

This is where molecular biology meets coaching.

When researchers move beyond isolated signaling pathways and study actual athletes over weeks and months, the dramatic interference many people fear becomes surprisingly difficult to reproduce outside very high volumes of endurance training.

Concurrent training research consistently demonstrates that the magnitude of the interference effect depends on factors such as:

  • Total endurance volume
  • Exercise modality
  • Session timing
  • Recovery
  • Nutritional status
  • Training experience
  • Overall programming

In other words, the molecular biology doesn’t invalidate the conclusions from the previous article, it explains them.

Recent research confirms that the so-called “interference effect” is real, but its magnitude depends on how training is programmed. For example, a 2016 study by Jones et al. found that, while concurrent training can slightly reduce strength gains compared to strength training alone, the effect is modest and can be minimized with thoughtful sequencing and recovery (Jones et al., 2016).

Why Running Sometimes Differs from Cycling

One particularly interesting finding is that not all endurance training produces the same interference.

High-volume running often creates greater reductions in hypertrophy than cycling or rowing.

Why?

Part of the explanation likely lies in mechanical loading. Running introduces thousands of eccentric foot strikes that generate additional muscular damage and recovery demands.

Cycling and rowing produce far less eccentric stress while still developing robust cardiovascular adaptations. The heart doesn’t particularly care how you elevate its workload.

Your joints and muscles often do. For athletes prioritizing hypertrophy, choosing lower-impact conditioning modalities can preserve more recovery capacity for strength training.

The First Principle

Understanding physiology should never replace good coaching.

It should explain it. The interference effect is real. But it is conditional, contextual, and frequently exaggerated. Most athletes don’t need to fear cardiovascular training. They need to respect recovery.

They need to understand adaptation. And above all, they need to remember that physiology doesn’t reward extremes. It rewards appropriate stress followed by appropriate recovery. That’s how stronger muscles are built. That’s how better cardiovascular systems are developed.

And that’s how thoughtful programming transforms isolated workouts into long-term performance.

Closing Thoughts

Perhaps the greatest lesson from the interference effect has nothing to do with AMPK or mTOR. It is a reminder that biology rarely conforms to the tidy, binary explanations we often prefer.

Strength or endurance. Cardio or muscle. Building or recovering. These are useful categories for conversation, but they are poor descriptions of how the human body actually functions. Our physiology is not governed by absolutes. It is governed by balance, adaptation, and context.

The best coaches understand this instinctively. Science simply helps explain why.

Next time we’ll discuss what performance programs actually look like. They’re the same physical qualities, simply applied with different priorities.

As always, the principles remain the same. The art is in the application of that knowledge.

References
Jones, T. W., Howatson, G., Russell, M., French, D. N., & Thomas, K. (2016). Performance and physiological differences between concurrent training and strength training. European Journal of Applied Physiology, 116(3), 665-678.

First Principles of Performance | Part I

Cardio Doesn’t Kill Your Gains. Poor Programming Does.

“The first principle isn’t choosing between strength and conditioning. It’s understanding what adaptation you’re trying to create.”

The Lion Killer

For decades, one of the most persistent myths in strength training has been deceptively simple:

“If you want to build muscle, avoid cardio.”

It sounds reasonable. After all, endurance athletes tend to be lean, while bodybuilders are muscular. Somewhere along the way, many people concluded that cardiovascular training and muscle growth must exist at opposite ends of the same spectrum.

Like most fitness myths, there’s a grain of truth buried beneath a mountain of oversimplification.

Can excessive endurance training interfere with maximal hypertrophy? Yes.

Can intelligently programmed cardiovascular training improve your health, enhance your recovery, increase your work capacity, and have little meaningful effect on muscle growth?

Also yes. The difference isn’t cardio. It’s programming

The Wrong Question

People often ask, “How much cardio can I do without losing muscle?” It’s the wrong question. The better question is: What adaptation am I trying to produce?

Every training session asks your body to solve a problem. Heavy squats ask it to produce more force. Tempo intervals ask it to become more efficient at clearing lactate.

Sprints demand explosive power. Long easy efforts improve aerobic efficiency.

These aren’t competing identities. They’re simply different physiological adaptations. Understanding that distinction changes everything.

First, Let’s Define “Cardio”

One reason this discussion becomes so confusing is because we use the word cardio as though it’s a type of exercise.

It isn’t. It’s a physiological demand.

Your cardiovascular system doesn’t know whether you’re running, rowing, cycling, carrying sandbags, or performing twenty-rep squats. It only knows that your muscles require oxygen, nutrients, and energy.

Think about workouts like:
– The Standard (Grace – 30 clean and jerks at 135/95, 30 ring muscle ups, Isabel – 30 snatches at 135/95)
– Heavy sled pushes
– Oly complexes of 5 reps or more
– 2k row for time
– 5k run
– Fran
– 20 rep max back squat
– Murph

Nobody finishes those wondering whether their cardiovascular system was challenged. Weight training can absolutely become cardiovascular training depending on how it’s programmed.

Intensity.
Density.
Rest intervals.
Exercise selection.
Volume.

These variables determine the cardiovascular demand, not whether you’re holding a barbell or running shoes. The conversation isn’t “weights versus cardio.”

It never was.

Where the Myth Came From

The concern isn’t entirely imaginary.

Researchers have long studied what’s known as the interference effect, the observation that combining endurance and resistance training can, under certain conditions, reduce some strength and hypertrophy adaptations compared with resistance training alone.

Notice the language. Can. Under certain conditions.

Not: Always. Those conditions matter.

A competitive marathon runner performing sixty miles each week while trying to maximize leg hypertrophy faces a very different challenge than someone lifting four days a week while adding two thirty-minute conditioning sessions.

Those are not the same training problems. Yet they’re often discussed as though they are.

What Actually Interferes?

For most lifters, muscle isn’t lost because they jogged. It’s lost because recovery becomes the limiting factor.

Poor programming often looks like this:
Heavy lower-body lifting followed immediately by long-distance running.
High-volume conditioning layered on top of already excessive lifting volume.
Poor sleep.
Insufficient calories.
Inadequate protein intake.
Eventually something has to give.
Trying to train near maximally, whether it’s loading or intensity, 4-6 days per week.

If training continually exceeds your ability to recover, progress slows—not because cardio is inherently bad, but because the total stress exceeds your adaptive capacity.

The Research Is More Encouraging Than the Internet

Fortunately, the research is considerably more nuanced than the internet. Much of the fear surrounding cardio comes from laboratory discussions about molecular signaling. You’ll often hear that endurance exercise activates one pathway while resistance training activates another, and that these pathways “fight” each other.

There is truth here. But physiology is rarely as binary as social media suggests.

These signals are temporary. They’re influenced by nutrition, training age, exercise selection and most important, recovery.

And they’re often localized to the tissues being trained rather than acting as a simple on-off switch across the entire body.

More importantly, when researchers look beyond the molecular biology and examine actual training outcomes, the picture becomes much less dramatic.

For the overwhelming majority of recreational lifters, and even many competitive athletes, well-designed conditioning has little meaningful effect on muscle growth.

Programming matters far more than the mere presence of cardiovascular exercise.

I hope the archive of this blog never disappears. Optimum Performance Training (OPT) James Fitzgerald

Numerous studies support the idea that cardio, when programmed intelligently, does not meaningfully hinder muscle growth. For example, a 2015 meta-analysis by Dr. Brad Schoenfeld and colleagues concluded that combining strength and cardio training results in only a negligible impact on muscle and strength gains, provided programming is sound (Schoenfeld, B.J., Ogborn, D., & Krieger, J.W., 2015, Sports Medicine).

Cardio That Supports Muscle Growth

If hypertrophy is your primary objective, conditioning should complement not compete with your lifting.

Generally speaking, it could look like the following:

  • Shorter, more intense sprint work.
  • Use interval-based conditioning where appropriate.
  • Row.
  • Cycle.
  • Throw med-balls.
  • Use the SkiErg.
  • Carry odd objects.
  • Push and pull sleds.
  • Perform tempo intervals.
  • Carry heavy implements.
  • Include sprint interval training when recovery allows.
  • Separate demanding conditioning from heavy lower-body strength sessions whenever practical.

Most importantly, keep the main thing, the main thing.

Conditioning exists to improve health, increase work capacity, and support recovery, not to leave you so fatigued that tomorrow’s strength session suffers.

Keep the Main Thing the Main Thing

The best programs are surprisingly disciplined. They know exactly what they’re trying to improve. Everything else exists to support that objective, not distract from it.

One of the greatest mistakes athletes make is assuming every session must improve every quality simultaneously.

It doesn’t. Training is about emphasis or specificity to the individual and their goals. Some phases prioritize maximal strength. Some emphasize hypertrophy, aerobic capacity gymnastic or Olympic Weightlifting skill. A skill Ive always referred to as barbell gymnastics because of how skill dependent they are.

The art of coaching isn’t teaching every quality simultaneously. It’s knowing which qualities deserve emphasis today, and which can simply be maintained until tomorrow.

That’s programming.

Paleo - BJJ - white belt - black belt - earned not issued

The First Principle

Cardio doesn’t kill your gains. Poor programming does. If your training reflects clear priorities, if recovery matches workload, if nutrition supports adaptation, if conditioning complements rather than competes with strength, then you can become stronger. You will then become stronger, healthier, and better conditioned.

Not because you avoided cardio, but because you finally stopped asking whether strength and conditioning are enemies.

They never were. They simply need a coach who understands how to make them work together.

The principles remain constant. The application is the art.

If you’re curious why all of this works, not merely what to do, we’ll step out of the weight room and into the physiology laboratory. There we’ll explore the molecular conversation taking place inside skeletal muscle every time you lift, sprint, row, or recover, and discover why the story is far more nuanced than the internet would have you believe.

References

Schoenfeld, B. J., Ogborn, D., & Krieger, J. W. (2015). Effect of concurrent aerobic and strength training on maximal strength, power, and hypertrophy in healthy adults: A systematic review and meta-analysis. Sports Medicine, 45(5), 697–708.

Wilson, J. M., Marin, P. J., Rhea, M. R., Wilson, S. M. C., Loenneke, J. P., & Anderson, J. C. (2012). Concurrent training: A meta-analysis examining interference of aerobic and resistance exercises. Journal of Strength and Conditioning Research, 26(8), 2293–2307.

Zen and the Art of AWS Security Domain 6: Security Foundations and Governance | Holding the Line Without Rigidity


“When the structure is sound, movement becomes effortless.”

Most people expect security foundations and governance to be boring. Policy documents. Checklists. Frameworks. Meetings.

AWS, and seasoned security architects, know better.

Security Foundations and Governance are not about control. They are about alignment.

They are what allow everything else, detection, response, infrastructure, identity, and data protection, to function without friction. This is why Domain 6 exists. And why it quietly determines whether every other domain succeeds or fails.

1. What AWS Means by “Security Foundations”


AWS does not treat security foundations as a product or a service. They treat them as operating conditions.

Security foundations answer questions like:
• Who is responsible for what?
• How are decisions made?
• How do we know when something is “secure enough”?
• How do we scale security without slowing delivery?

In AWS terms, foundations are built on:

• Shared Responsibility
• Well-Architected principles
• Standardized controls
• Continuous improvement
• Clear ownership

If those are missing, everything else becomes reactive.

Key Takeaway: On the exam and in real life, assume security foundations are always present, not optional. If a question describes a scenario with ambiguous responsibility, pause and seek alignment before acting.

2. The Shared Responsibility Model: The First Gate

Every AWS security exam, especially the Security Specialty, tests one thing relentlessly: Do you understand what AWS secures…and what you must secure yourself?

    AWS is responsible for:

    • Physical data centers
    • Underlying hardware
    • The cloud infrastructure itself

    You are responsible for:

    • Identity and access
    • Network controls
    • Data protection
    • OS and application security
    • Configuration

    Governance begins the moment you clearly accept that responsibility.

    Most real-world failures, and many exam traps, happen when responsibility is blurred.

    3. Governance Is How You Scale Trust

    Governance is not about saying “no.” It’s about creating guardrails so teams can move quickly without breaking things.

      AWS governance relies on:

      • AWS Organizations
      • Service Control Policies (SCPs)
      • Account separation
      • Tagging standards
      • Centralized logging and monitoring
      • Defined escalation paths

      Exam cue: If AWS wants you to prevent risky behavior without managing individual permissions, the answer is almost always SCPs.

      Governance operates above IAM, not instead of it.

      4. Well-Architected Security Pillar: The Quiet Backbone

      The AWS Well-Architected Framework is foundational to this domain.

        The Security Pillar emphasizes:

        • Strong identity foundations
        • Traceability
        • Infrastructure protection
        • Data protection
        • Incident response

        You’ve already studied all of these.

        Domain 6 exists to show how they fit together.

        AWS wants you to think:

        • Holistically
        • Long-term
        • With trade-offs in mind

        On the exam, this shows up as:

        • “Which solution is the most scalable?”
        • “Which approach reduces operational overhead?”
        • “Which option aligns with AWS best practices?”

        Governance favors simplicity, repeatability, and clarity.

        5. Policies, Standards, and Automation

        In AWS, policy without automation is aspirational. Automation without policy is dangerous.

          Strong governance includes:

          • Infrastructure as Code (CloudFormation, Terraform)
          • Automated security checks
          • Preventive controls (SCPs, Config rules)
          • Detective controls (GuardDuty, Security Hub)
          • Corrective actions (Lambda-based remediation)

          Exam cue: If the question says, “ensure compliance continuously”, the answer involves automation, not manual review. Governance is what turns security into a system, not a on-going project.

          Top 3 Exam Gotchas: Domain 6

          1. Over-relying on IAM and neglecting the power of Service Control Policies (SCPs) for organization-wide governance.
          2. Focusing on manual reviews instead of leveraging automation for continuous compliance.3. Choosing the most restrictive answer on the exam rather than the one that balances security, cost, and operational impact.
          3. Key Takeaway: The “safe” answer is not always the correct one—look for governance and automation at scale.

          6. Risk Management: Choosing, Not Eliminating

          AWS does not expect you to eliminate all risk.

          They expect you to:

          • Identify it
          • Understand it
          • Accept, mitigate, or transfer it intentionally

          This is why governance includes:

          • Risk registers
          • Compliance mappings
          • Business context
          • Cost-awareness

          On the exam:

          The “best” answer is rarely the most restrictive one. It is the one that balances security, cost, and operational impact.

          Scenario Example: Rapid Growth, Real Governance

          In 2024, a fintech company went from 10 to 60 AWS accounts in under six months. Security needed to prevent resource creation outside of approved regions and enable GuardDuty everywhere automatically.

          Best Approach: The team used AWS Organizations to apply SCPs for region lockdown, combined with automated account bootstrapping scripts that enabled GuardDuty by default. This solution leveraged automation and organizational guardrails—demonstrating mature, real-world AWS security thinking.

          Key Takeaway: AWS rewards answers that use policy-driven, automated, and scalable solutions, exactly as in this scenario.

          7. The Martial Parallel: Structure Enables Freedom

          In martial arts, beginners see rules as limitations.

            Advanced practitioners see them as:

            • Stability
            • Efficiency
            • Freedom under pressure and much more

            A strong stance doesn’t restrict movement; it enables it. Security foundations work the same way.

            When governance is clear:

            • Teams move faster
            • Incidents resolve cleaner
            • Mistakes are contained
            • Learning compounds

            When governance is weak:

            • Everything feels urgent
            • Security becomes adversarial
            • Teams work around controls instead of with them

            8. Exam Patterns for Domain 6

            Here’s how AWS tests this domain:

            • Account-level controls → AWS Organizations + SCPs
            • Preventing risky actions globally → SCPs
            • Balancing speed and security → Guardrails, not micromanagement
            • Scaling security → Automation and standardization
            • Aligning with best practices → Well-Architected Framework

            If the question asks:

            “Which solution is easiest to manage at scale?”

            Exam cue: Choose the centralized, automated, policy-driven option.

            Final Capstone: The Six Domains as One System

            Let’s put it all together.

            Domain 1 — Detection
            See clearly. You can’t secure what you can’t observe.
            Detection creates awareness and prevents surprise.

            Domain 2 — Incident Response
            Move decisively without panic. Preparation and clarity turn chaos into choreography.

            Domain 3 — Infrastructure Security
            Shape the terrain. Segmentation, isolation, and least exposure reduce blast radius before attacks happen.

            Domain 4 — Identity and Access Management
            Decide who can act. Identity is the new perimeter. Precision here determines everything else.

            Domain 5 — Data Protection
            Guard what truly matters. Encryption, key management, and lifecycle controls protect the mission itself.

            Domain 6 — Security Foundations and Governance
            Hold the line without rigidity. Governance aligns people, process, and technology into a system that scales.

            The Quiet Truth at the Center of AWS Security

            AWS security is not about fear.
            It is not about heroics.
            It is not about locking everything down.

            It is about clarity, balance, and intention.

            The exam rewards those who:
            • Pause before reacting
            • Think in systems, not silos
            • Choose scalable solutions
            • Respect trade-offs
            • Trust structure over force

            That’s Zen. That’s architectural mastery. You’re ready.

            When you sit for the exam, remember:
            Awareness first.
            Structure second.
            Action last.

            Everything else follows naturally.

            Verification & Citations Framework | “Leave No Doubt”

            Primary AWS Sources to Reference:

            • AWS Shared Responsibility Model
            • AWS Well-Architected Framework (Security Pillar)
            • AWS Organizations Documentation
            • Service Control Policies (SCPs)
            • AWS Security Best Practices Whitepaper
            • AWS Security Specialty Exam Guide (Domain 6)

            Verification Boxes (Suggested Placement):

            • After Shared Responsibility section
            • After SCPs / Governance section
            • After Well-Architected references

            Quick Reference Checklist: Domain 6 – Security Foundations & Governance

            Key Takeaways (Scan before the exam!)

            – Shared Responsibility Model: Always clarify what AWS secures vs. what you control.

            – Use AWS Organizations and SCPs for policy-driven, organization-wide governance.

            – Automate compliance: favor Infrastructure as Code, automated checks, and auto-enablement of detective/preventive controls.

            -Lean one the AWS Well-Architected Framework forbest practice alignment.

            – Favore scalable, centralized, and policy-drive solutionsy in exam scenarios.- Always check the latest AWS documentation—services and features evolve quickly.

            Final Tip: For scenario-based questions, ask: “Is this solution scalable, automated, and centralized?” If so, it’s likely the best choice.

            Change Awareness Note:

            AWS governance services evolve regularly. Always validate SCP behavior, Organizations features, and Well-Architected guidance against current AWS documentation. For the latest on each topic, see:

            Shared Responsibility Model

            AWS Well-Architected Framework

            AWS Organizations

            Service Control Policies

            AWS Security Best Practices

            Security Specialty Exam Guide

            The Art of Cyberwar | Part XIII | The Use of Spies

            The principles:

            “Knowledge of the enemy’s dispositions can only be obtained from other men.”

            “However, spies cannot be usefully employed without a certain intuitive sagacity.”

            “Be subtle and use your spies for every kind of business.”

            “Hence, it is only the enlightened ruler and the wise general who will use the highest intelligence of the army for purposes of spying, and thereby they achieve great results.”

            The Quiet After the Fire

            After the smoke clears, the last weapon isn’t destruction; it’s knowledge. Sun Tzu closes his book here, not with conquest, but with insight. The general who knows through others, he says, wins without fighting. The one who fights without knowing spends blood buying what wisdom could have earned.

            In modern form, intelligence replaces escalation. Information, verified and interpreted, is the ultimate force multiplier.

            The Five Spies

            Sun Tzu’s framework remains elegant and practical. He identifies five types of spies, each still alive and well in today’s cyber and geopolitical landscape.

            1. Local spies = insiders, collaborators, citizens.
              • Modern analogue: human intelligence, insider threat programs, whistleblowers, or local analysts embedded in culture.
              • Lesson: you can’t know an environment without someone who breathes its air.
            2. Inward spies – the enemy’s own people who provide insight.
              • Modern analogue: defectors, double agents, internal whistleblowers, or compromised insiders in adversary organizations.
              • In cyber: infiltration of adversary forums, threat actor telemetry, or behavioral analysis of attacker TTPs.
            3. Converted spies – enemy agents who have been turned.
              • Modern analogue: captured malware turned into indicators, enemy disinformation repurposed for exposure.
              • Intelligence and counterintelligence merge – data becomes self-revealing.
            4. Doomed spies – agents sent with false information, knowing they will be sacrificed.
              • Modern analogue: honeypots, decoy networks, misinformation campaigns used to draw out adversaries.
              • Lesson: deception has cost; calculate it.
            5. Surviving spies – those who return with verified knowledge.
              • Modern analogue: analysts who gather, vet, and integrate multiple data sources to produce actual intelligence.
              • Lesson: data isn’t knowledge until it’s interpreted and fed back into strategy.

            The five together form a complete intelligence loop: gather, plant, deceive, sacrifice, verify.
            Today, we refer to this as the intelligence cycle.

            Information as the New Espionage

            We live in an age where everything and everyone collects or steals your data. Apps harvest movement. Sensors record temperature and tone. Governments build databases so vast they blur into prophecy.

            But the principle hasn’t changed: intelligence is not about having information – it’s about understanding what matters and when.

            A terabyte of telemetry means nothing without discernment. One well-placed attacker can outperform a thousand firewalls.

            Foreign Policy and the Failure of Insight

            Throughout the 20th century, U.S. foreign policy often suffered from information abundance but a lack of the ability to interpret the intelligence it had gathered.

            • Pearl Harbor: a multitude of signals existed, but interpretation failed.
            • Vietnam: metrics replaced meaning – body counts masquerading as progress.
            • Iraq WMDs: intelligence distorted to paint a specific picture rather than inform decision-making.
            • Afghanistan: decades of data existed without a clear endgame, destroyed thousands of American lives, and wasted trillions of taxpayers’ dollars.

            Each case proves Sun Tzu’s point: “If you know neither the enemy nor yourself, you will succumb in every battle.”

            Intelligence was there, but self-awareness wasn’t. Knowing isn’t only about them; it’s about seeing what you refuse to see in yourself.

            Cyber Intelligence: Seeing Without Touching

            In cybersecurity, the “spies” are telemetry, sensors, analysts, and sometimes friendly adversaries.
            Every alert, log, and anomaly is a scout’s report. But like all intelligence, its value depends on interpretation.

            • Local spies: internal logs and behavior analytics.
            • Inward spies: penetration testing, red-team operations, insider threat programs.
            • Converted spies: captured malware and attacker infrastructure repurposed for defense.
            • Doomed spies: honeypots, deception networks, and fake data seeds.
            • Surviving spies: analysts, threat-hunters, and intel-sharing alliances.

            The objective is clarity without exposure, to see everything while remaining unseen. Fire consumes, intelligence illuminates.

            The Moral Dimension of Knowing

            Intelligence work carries moral weight. Spies, human or digital, trade in trust. Sun Tzu demands that the general handle them with the highest regard: reward them generously, guard them carefully, and never waste them carelessly.

            The ethical parallel today is privacy. The line between intelligence and intrusion is measured in intent and restraint. Knowledge gathered without purpose is voyeurism. Knowledge used without reflection is manipulation.

            Sun Tzu’s ideal: learn enough to prevent war, not to justify one.

            Strategic Lessons for Leaders

            1. Listen to your scouts.
              Truth often arrives quietly, wrapped in discomfort. Leaders who dismiss dissent lose foresight.
            2. Reward information honestly.
              Transparency and gratitude feed the flow of truth; fear and ego choke it.
            3. Centralize interpretation, not collection.
              Many sensors, one mind – unified analysis, decentralized data.
            4. Balance secrecy with accountability.
              Intelligence held too tightly becomes blindness.
            5. Use information to avoid fire.
              The goal of knowledge is to make destruction unnecessary.

            From Fire to Silence

            The transition from Attack by Fire to Use of Spies is the book’s moral hinge. After escalation comes discernment; after destruction, discipline.

            Sun Tzu understood what modern states and corporations often forget: Force is crude, information is subtle – and subtlety wins the wars that power cannot.

            In cybersecurity, this is the move from reaction to anticipation. In foreign policy, it’s the evolution from aggression to diplomacy. In leadership, it’s the shift from command to comprehension.

            The best security posture isn’t dominance – it’s awareness. The most powerful army is one that rarely fights.

            Epilogue — The Quiet Art

            The Art of War ends not with blood or banners, but with silence, a stillness that comes from mastery.

            True security, like true wisdom, is invisible.
            It doesn’t announce itself.
            It doesn’t need to.

            When you know yourself and your adversary, every threat is already half-dissolved. When you act only when necessary, victory becomes maintenance rather than spectacle. And when you can learn from what moves unseen, you stop fighting the same battles over and over again.

            As Operation Aurora proved, a sophisticated cyber espionage campaign that quietly infiltrated major tech companies, the side with better intelligence rarely needs to escalate; quiet knowledge can outmaneuver brute force.

            That’s the art of cyberwar – when you know yourself and your adversary, every threat is already half-dissolved. When you act only when necessary, victory becomes maintenance rather than spectacle. And when you can learn from what moves unseen, you stop fighting the same battles over and over again.

            That is the final lesson of Sun Tzu, and of cyberwar:
            Not destruction, but understanding.
            Not conquest, but control of your own attention.
            Not escalation, but insight.

            Not noise, but silence.

            The art is not in the fight, but in the knowing. Return always to the principle: “Knowledge of the enemy’s dispositions can only be obtained from other men.”

            And, in the end, mastery is realizing you rarely need to fight at all.

            The Art of Cyberwar | Part X | Terrain

            The principles:

            “The natural formation of the country is the soldier’s best ally; make use of it to your advantage.”

            “When the general is weak and without authority; when his orders are not clear and distinct; when there are no fixed duties assigned to officers and men, and the ranks are formed in a slovenly haphazard manner, the result is utter disorganization.”

            “The general who advances without coveting fame and retreats without fearing disgrace, whose only thought is to protect his country and do good service for his sovereign, is the jewel of the kingdom.” — Sun Tzu

            Ground First

            Sun Tzu makes a simple demand: know the ground on which you stand.

            The proper ground turns disadvantage into leverage. The wrong ground turns strength into exposure. Terrain is not merely soil; it is topology, logistics, law, culture, and architecture. In the modern world, it includes cloud regions, compliance borders, identity planes, and network topology. Choose well, and the fight often narrows into something you can actually win.

            This is not an abstract chapter. It’s a practical one.

            If you’ve ever seen a breach unfold, you’ve witnessed terrain deciding outcomes in real time: attackers rarely “win” because they are stronger; they win because they enter through easy ground, move through poorly observed corridors, and reach valuable systems before defenders can orient.

            The defender’s job is to resist. It is to shape the ground, so the adversary’s best options become expensive, loud, or impossible.

            Types of Terrain – What They Feel Like, What They Demand

            Sun Tzu names a wide variety of ground. In practice, the terrain we face, militarily, digitally, and politically, collapses into recurring patterns: open, narrow, steep, encircled, and expansive.

            Each demands a distinct strategy. Each punishes a different kind of arrogance.

            Open Ground – Fast, visible, unforgiving

            Open ground is where you can be seen.

            In war, it is flat land with no cover: movement is easy, concealment is costly, and discipline decides whether speed becomes an advantage or panic. Detection and clean maneuvering are important because contact is constant.

            In cybersecurity, open ground is your public-facing surface area: internet-exposed services, public APIs, external portals, and remote access entry points. This is not where you want complexity. You want ruthless simplicity, fewer doors, fewer endpoints, fewer exceptions, paired with strong telemetry. Frameworks like the CIS Controls and NIST CSF explicitly prioritize inventorying and minimizing public-facing assets—making clarity and control here a universal best practice.

            Open ground is also where deception works best. Decoys, false signals, and baited paths can pull an enemy out of position. In cyber, honeypots and canary tokens do the same: they invite movement into visibility and turn curiosity into evidence.

            Real-world case: In 2021, the Microsoft Exchange Server vulnerabilities (ProxyLogon) exposed thousands of organizations’ email systems to the internet. Attackers rapidly exploited unpatched, public-facing assets—demonstrating why CIS Controls and NIST CSF stress the importance of inventory and minimizing the external attack surface.

            Open ground isn’t “unsafe.” It’s honest. It shows you what you built.

            Narrow Ground – Chokepoints, bridges, legacy stacks

            Narrow ground is where everything funnels.

            In military history, chokepoints decide battles because geometry becomes force. A smaller army can hold a larger one, not by being stronger, but by limiting the enemy’s options. Just think of the legendary last stand of Leonidas and the Battle of Thermopylae.

            In cyber and cloud, narrow ground is often the infrastructure everyone relies on and no one wants to touch: legacy integrations, VPN tunnels, identity gateways, brittle on-prem choke points, systems tied to modern workflows by thread and habit. They become bridges. Bridges become targets.

            If you harden one thing this quarter, harden your chokepoints, segment around them. Add compensating controls. Increase logging where applicable. Treat narrow terrain as sacred because when it fails, everything behind it is exposed. The MITRE ATT&CK framework’s focus on lateral movement and privilege escalation highlights why chokepoints must be secured and closely monitored.

            Mini-case: The 2021 Colonial Pipeline ransomware attack targeted a single VPN account—an overlooked chokepoint with no multi-factor authentication. This breach underscores the criticality of securing and monitoring privileged access pathways.

            Martial principles show up cleanly here. Wing Chun teaches that in close range, cutting angles and superior structure become everything. Trapping is about denying your opponent options. Narrow terrain does the same: it constrains movement and penalizes sloppy positioning.

            Steep Ground – Visibility and defensibility, limited mobility

            Steep ground is an advantage you must maintain.

            High ground offers visibility and defensive leverage, but you don’t sprint on it. Movement becomes deliberate. Once you lose it, regaining it costs more than taking it did.

            In cyber/cloud terms, the “steep ground” is where you place your crown jewels: production enclaves, privileged access vaults, critical logging pipelines, backup infrastructure, and identity governance, zones with strict access controls, immutable logs, and minimal pathways. NIST Special Publication 800-53 and CIS Controls both emphasize layered defenses and strong separation for critical assets, reinforcing the need for deliberate, hardened environments.

            These environments should feel “steep” to anyone moving through them, including your own staff. That friction is the point. Steep terrain ensures enforcement of control.

            Industry example: Major cloud providers routinely isolate customer data and management functions in highly restricted “steep ground” zones, applying controls from NIST SP 800-53 and CIS to prevent lateral movement and ensure containment if a breach occurs.

            In Jiu Jitsu, this is akin to mount or back control: you don’t rush to snatch up a submission. You stabilize, isolate, and apply pressure through position and then finish. The defender who gets impatient on steep ground usually falls off it.

            Encircled Ground – When you risk being surrounded

            Encircled terrain is where isolation becomes lethal.

            In war, encirclement breaks supply lines, erodes morale, and forces rash decisions. In cyber, encirclement often begins as “convenience” and ends as captivity: vendor dependencies, brittle third-party integrations, shadow IT no one owns, “critical” workflows held together by one person’s tribal knowledge.

            The danger is that encirclement rarely feels dramatic at first. It feels normal until you need to restore. Until a vendor is down. Until the contract becomes leverage. Until the only admin is on PTO and the incident is already in motion.

            Encircled ground demands exits: recovery paths, out-of-band access, air-gapped backups, and playbooks that restore connectivity without improvisation. CIS Control 11 and the NIST CSF Recovery Function both emphasize the importance of tested backup and recovery plans, as reliance on a single vendor or system is a strategic vulnerability.

            Recent headline: In the wake of the 2022 Okta breach, organizations that relied exclusively on one identity provider faced business continuity risks. Those with tested out-of-band recovery and contractual exit clauses, as recommended by CIS and NIST, were able to restore operations more quickly.

            If you don’t have those, you don’t have resilience. You have hope.

            Expansive Ground – Flat, wide, tempting for overreach

            Expansive terrain invites ambition. It also hides risk.

            Movement feels easy because there’s “room,” but oversight drops as the supply lines lengthen. This is how empires, and cloud estates, collapse: not from one failure, but from accumulated, ungoverned territory.

            In cyber, expansive ground is sprawl: dozens of cloud accounts, multiple providers, endless permissions, duplicated tools, integrations stacked on integrations. Sprawl isn’t evil. It’s simply unmanaged terrain.

            Expansive ground demands scalable governance: infrastructure-as-code policies, automated compliance, continuous asset inventory, and hard limits on “just one more integration.” Otherwise, you end up “owning” too many things to defend any of them properly. Both NIST CSF and the CIS Controls call for continuous asset management and automated enforcement to keep sprawl in check.

            This is where adversaries thrive, inside your noise.

            Example: Several high-profile breaches, including Capital One (2019), were linked to sprawling cloud environments where asset management and policy enforcement lagged behind rapid deployment. This highlights why NIST CSF and CIS Controls call for continuous inventory and automated governance.

            Choosing the Ground – Offense Through Selection

            A leader’s first tactical choice is where to fight. Good generals choose terrain that favors their force and punishes the enemy’s approach. That’s a decision, not a reflex.

            In cybersecurity, this is how you win before the breach: place valuable services behind hardened, observable layers and force attackers into monitored choke points. Make lateral movement steep. Make privilege escalation loud. Make time and friction the price of progress.

            In cloud architecture, it refers to trust zones and least-privilege boundaries that govern movement, much as terrain shapes an army’s movement. If an adversary wants access, they must climb and be exposed while doing it.

            In foreign policy, it means choosing diplomatic and economic levers rather than landing zones that stretch logistics and public support. Sometimes the “terrain” is public will. Sometimes it’s alliance cohesion. Sometimes it’s your economy. Burn those, and you’ve lost the campaign even if you win the first clash.

            Choosing ground is an active defense. It doesn’t surrender initiative; it shapes the enemy’s options.

            This is where martial deception becomes a strategy. A feint isn’t a lie, it’s an invitation. In Wing Chun, you draw the reach, trap the limb, clear the line, and strike at the same time. In Muay Thai, you show the jab to invite a teep to sweep the leg. In Jiu Jitsu, you offer the submission attempt you’re prepared to counter. Terrain selection works the same way: you present what looks like access, but what you built is a corridor of control.

            Leadership, Discipline, and Knowing Your Soldiers

            Sun Tzu insists a general must know his troops. That’s leadership in a sentence.

            A leader’s indecision, ego, or poor communication is as lethal as bad geography. Poor leaders over-commit, under-communicate, or ignore warnings. They treat friction as disobedience and clarity as optional. That is how organizations drift into the “slovenly haphazard” disorder Sun Tzu warns about: plenty of tools, no coherence.

            Discipline matters. Soldiers and engineers, treated with respect but held to standards, perform under pressure. Leniency breeds sloppiness; cruelty breeds silence. Both are operational risks.

            Know your teams: strengths, fatigue thresholds, and tempo. Rotate duty. Limit emergency hours. Maintain training. In cloud and cyber, this includes on-call limits, respect for sleep, post-incident retrospectives, and psychological safety to report near-misses before they become incidents.

            Morale shows up earlier than metrics. Leaders build the culture that sustains long campaigns.

            Calculation Before Battle – The Work of Winning

            Sun Tzu elevates calculation above impulse: the commander who measures many variables before engagement usually wins; the one who does not, loses.

            This calculation is methodical: map terrain, count supplies (capacity), estimate enemy options, and plan contingencies.

            In cyber, that means knowing your attack surface, understanding threat actor patterns, identifying likely pivot points, and building tested response runbooks. Rehearse, not because you expect a breach, but because you refuse to improvise under duress.

            In the cloud, this entails calculating blast radius, recovery objectives, and the cost of complexity relative to the cost of resilience. It also means choosing fewer tools and mastering them, because every new platform is a new terrain you must defend.

            In policy, it means calculating costs in treasure, trust, and time. Private-sector analogs are attention, capital, and brand.

            Winning is the product of preparation. You cannot improvise a viable posture in a crisis.

            Specific Strategies by Terrain – Practical Moves

            • Open ground: prioritize speed and detection; keep public assets to a minimum; deploy decoys and canaries; monitor aggressively. (CIS Controls 1, 7; NIST CSF Identify & Protect).
            • Narrow ground: enforce access controls and logging; funnel traffic through audited gateways; validate identity aggressively. (MITRE ATT&CK, NIST CSF Detect)
            • Steep ground: design immutable environments and strict separation; place critical controls in high-ground enclaves with minimal human pathways. (NIST SP 800-53, CIS Control 13)
            • Encircled ground: ensure out-of-band recovery, air-gapped backups, manual admin paths; maintain contractual exit clauses with vendors. (NIST CSF Recovery, CIS Control 11)
            • Expansive ground: prune and consolidate; adopt infrastructure-as-code policies and automated compliance; set hard limits on new integrations. (CIS Control 1, NIST CSF Asset Management)

            Every choice reduces the opponent’s options and preserves the defender’s leverage. In practice, aligning terrain strategies with proven frameworks isn’t bureaucracy; it’s how you translate doctrine into daily operations.

            Parallels: Rome, Corporations, and Nations

            Rome didn’t fail because it was weak; it failed because it could no longer pay for its expansion. The pattern repeats: a leader mistakes reach for control, stretches supply lines, and forgets the home base.

            In business, over-expansion without integration kills cash flow and culture. In policy, interventions without sustainable objectives are hollow support. In cyber, growth without governance turns territory into liability.

            The remedy is the same: select advantageous ground, keep logistics tight, and honor the limits of what you can sustain.

            Closing: Ground, People, Calculation

            Terrain teaches humility. It forces honesty about supply lines, political will, and human limits. Leaders must select ground that fits their forces, know their people well enough to deploy them without breaking them, and calculate relentlessly before contact. The best strategy isn’t the loudest; it’s the one most rigorously mapped to the ground and standards that define your domain.

            Sun Tzu’s point is blunt: the general who prepares wins because he has already made many small victories before the first clash. The rest simply discover, too late, what the ground beneath them already knew.

            The Next Step: Situations Reveal the Ground

            Sun Tzu ends this chapter the way a good fighter ends an exchange: not with noise, but with control.

            Terrain is not merely where you fight; it is what the fight allows. It determines which tactics are available, which movements are costly, and which victories are possible without incurring blood, bandwidth, or morale costs. The wise commander doesn’t “try harder” on bad ground. He changes the angle, changes the conditions, and shapes the enemy’s options.

            Muay Thai does it with ring craft: take space, cut off exits, force exchanges where your strikes land cleanly. Jiu Jitsu does it with: position, then control, then submission, and sometimes with a ruthless setup: allowing the opponent to chase the submission you expected, only to counter when they overextend.

            Terrain works the same way. Choose it well, and you’re not only defending but shaping the enemy’s approach until their “attack” becomes the opening you built the environment to reveal.

            That leads us directly back to the principles that opened this chapter:

            “The natural formation of the country is the soldier’s best ally; make use of it to your advantage.” Because once you understand the ground, you stop fighting the fight the enemy wants, and start forcing the battle they cannot win.

            And when leadership is weak, orders are unclear, and duties are unfixed, the result is exactly what Sun Tzu promised: utter disorganization, not because the enemy was brilliant, but because the ground exposed what was already unstable.

            The highest standard remains unchanged: the general who advances without vanity and retreats without fear, whose only thought is to protect his people and do good service, is the jewel of the kingdom.

            Bridge to Part XI – The Nine Situations

            Terrain teaches you what is possible. The Nine Situations teaches you what to do when possibility collapses into reality, when you’re advancing, retreating, encircled, trapped, deep in enemy ground, or approaching decisive contact.

            It is a doctrine of movement under pressure: acting in accordance with circumstances without losing coherence.

            You’ve learned how to read the ground.
            Next, you’ll learn how to fight on it.

            The Art of Cyberwar | Part IX | The Army on the March

            “The Army on the March” — Illustrated for The Art of Cyberwar, Part IX. This artwork evokes the visual language of classical Chinese scroll painting, capturing the essence of Sun Tzu’s Chapter IX with striking thematic fidelity. The scene unfolds in layers across a sweeping golden landscape: tightly ordered battalions march along mountain paths, supply barges cross a winding river, and distant formations assemble beneath the rising sun. Each element reflects the logistical burden, psychological tension, and environmental dependence that define an army deep into foreign territory. At the foreground, a lone commander on horseback surveys the terrain, flanked by advisors whose varied stances suggest counsel, observation, and caution. His elevated vantage mirrors Sun Tzu’s emphasis on awareness — the practice of reading fatigue, momentum, and environmental signals before they harden into irreversible consequences. The river crossing, perilous and slow, symbolizes the fragility of overextension; the distant city, shimmering beyond the horizon, represents both ambition and the looming threat of exhaustion. The overall composition blends serenity with strain, grandeur with vulnerability. In doing so, it transforms ancient military wisdom into a timeless reminder for modern strategists: every march requires vigilance, and every expansion carries its cost.

            The Principle:

            “When you leave your own country behind, and take your army across neighboring territory, you find yourself in a position of dependence on others. There you must watch for signs of strain.”— Sun Tzu

            The Signs Before the Fall

            Sun Tzu’s ninth chapter is about perception.

            Here he shifts from action to awareness. It’s about how a commander reads fatigue, imbalance, and internal decay before they destroy an army from within.

            This is not simply a lesson in combat, but more importantly, it’s a lesson in foresight. This is a crucial distinction that often separates a near-flawless victory from a crushing defeat.

            Because every empire, every enterprise, every cyber defense effort eventually faces the same drift:

            • expansion that outruns understanding
            • momentum that hides exhaustion
            • ambition that blinds leadership
            • reach that exceeds resources

            Armies break this way.
            Companies implode this way.
            Nations lose coherence this way.

            In martial arts, this is the moment a fighter looks powerful, but their footwork is mis-aligned, the subtle tell of hand movement, the delayed return to guard, or the half-beat of hesitation that usually precedes success but this time leads to being hit.

            Sun Tzu teaches us: if you can’t read the signs, you can’t survive the march.

            Overreach: The Eternal Temptation

            History loves proving this point.

            Rome’s legions stretched from Britain to Mesopotamia until it could no longer feed its own frontiers. Britain built an empire “over all seas,” only to watch its overstretched supply lines rot from within.

            The United States, victorious after World War II, constructed a global presence so vast that presence itself began replacing purpose.

            Sun Tzu warned: The longer the march, the more fragile the army becomes.

            Modern America has been marching for generations, militarily, economically, digitally, and each expansion has carried both pride and price.

            Corporations experience the same decay. Cloud ecosystems suffer it even faster. What begins as strength, scale, reach, integration, becomes fragility when maintenance exceeds cost-tolerance.

            In martial arts, overreach is the fighter who throws too many power shots, chasing a knockout rather than reading the opponent. They exhaust themselves long before the opponent is even breathing heavily.

            Strength without pacing is just a longer route to collapse.

            The Weight of Infinite Reach

            In cybersecurity, overreach becomes complexity collapse.

            Each new department adopts a new tool. Each executive demands a new dashboard. Each vendor promises a universal cure.

            Suddenly:

            • no one sees the whole system
            • logs pile up unread
            • alerts become background noise
            • integrations multiply into untraceable webs
            • dependencies form faster than they can be understood

            What once felt powerful becomes paralyzing.

            Foreign policy suffers the same rhythm on a grander scale.

            WWI.
            WWII.
            The Cold War.
            Korea.
            Vietnam.
            Bosnia
            Iraq.
            Afghanistan.

            Each began with a clean, confident objective. Most devolved into attrition, mission creep, and moral fatigue. It can confidently be argued that mission creep began with WWI, but that’s a conversation for another time.

            Sun Tzu would summarize it simply: When the troops are weary and the purpose uncertain, the general has already lost.

            In BJJ, this is the fighter who scrambles nonstop, burning energy on transitions without securing position. Sometimes, not even needing to scramble or change position, but hasn’t trained long enough to even know that.

            In boxing, it’s the puncher throwing combinations without footwork. The fighter simply stands in place, wondering why his punches never land.

            In Kali, it’s the practitioner who commits too aggressively, losing awareness of angles and openings.

            The march becomes too long.
            The lines become too thin.
            And collapse becomes inevitable.

            Business: The Corporate Empire Syndrome

            Businesses suffer the same fate as empires.

            Growth attracts attention. Attention fuels pressure to expand. Expansion becomes compulsive.

            Suddenly, the company is chasing:

            • ten markets
            • ten products
            • ten strategies
            • ten “high-priority” initiatives

            Each of these demanding its own “army.”

            The parallels to national instability are perfect:

            • Expansion without integration
            • Strategy scaling faster than understanding.
            • Leaders mistaking size for stability.

            Eventually, the weight becomes unsustainable.

            The company can no longer “feed the army.”
            Costs rise.
            Culture cracks.
            Purpose fades.

            What killed Rome wasn’t the final battle; it was the slow erosion of balance across its territory.

            Most businesses die the same way, and so do most digital ecosystems.

            In Wing Chun, this is the collapse of structure, the moment you can see a fighter trying to do too much, forgetting the centerline, being everywhere except where they need to be.

            Overreach is always invisible until it isn’t.

            The Modern March: Cyber Empires and Digital Fatigue

            Our networks are the new empires.

            Every integration is a border.
            Every API is a supply line.
            Every vendor is an ally whose failure becomes your crisis, and you can never plan for when that crisis comes.

            Cloud architecture multiplied this exponentially.

            Organizations now live everywhere and nowhere at once.

            Sun Tzu’s image of an army dependent on supply lines maps perfectly to modern digital infrastructure:

            • Multi-cloud systems
            • SaaS sprawl
            • CI/CD pipelines with invisible dependencies
            • Third-party integrations with inherited vulnerabilities

            When visibility fades, risk multiplies. When dependencies become opaque, consequences become catastrophic.

            A company that cannot trace its supply chain of code is like an army that has lost its map.

            One outage.
            One breach.
            One geopolitical tremor.

            And the entire formation can buckle.

            We call this “scalability.”
            Sun Tzu would call it: Marching too far from home.

            Reading the Dust Clouds

            Sun Tzu taught his officers to read subtle signs:

            • dust patterns revealing troop movement
            • birds startled into flight
            • soldiers’ voices around the fire
            • the speed of camp construction
            • the tone of marching feet

            Modern versions of those signs are just as revealing:

            • Escalating ‘critical’ alerts no one addresses
            • Morale fading under constant pressure
            • Defensive posture maintained through inertia
            • Strategies repeated because they worked once, not because they work now
            • Partners showing hesitation before they show defection

            In WWI, the Lusitania offered one of the clearest “dust clouds” in modern history.

            Germany declared unrestricted submarine warfare. British intelligence knew passenger liners were targets. The Lusitania was warned. The U.S. was warned. Even the ship’s cargo, which included munitions, made it a predictable target.

            Yet the warnings were dismissed.
            The signs were clear.
            The perception failed.

            And America’s reaction, too, was predictable; a “neutral nation” was pushed closer to war by a tragedy entirely foreseeable. Some might argue that certain American politicians sought to force the US into the war. Again, that’s a discussion for another time.

            Sun Tzu’s maxim remains timeless: The first to lose perception always loses position.

            The Cost of Endless Motion

            Overextension rarely appears dramatic at first.

            It looks like success:

            • revenue rising
            • troops advancing
            • dashboards expanding
            • integrations multiplying

            Then the consequences arise:

            • fatigue
            • erosion
            • misalignment
            • burnout
            • doubt

            You begin fighting just to justify how far you’ve marched.

            In cybersecurity, this is the company chasing every vulnerability without fixing their architecture.

            In foreign policy, it’s the nation fighting endless “small wars” that collectively cost more than stability ever would.

            In boxing, it’s the fighter who keeps moving forward until they walk into exhaustion, not a punch.

            In Kali, it’s the flow practitioner who adds complexity until their movement becomes noise rather than intent.

            Sun Tzu warned: An army that has marched a thousand li must rest before battle.

            Modern systems rarely rest. We only measure uptime, not wisdom.

            Restraint as Renewal

            The answer isn’t retreat, it’s an informed, measured rhythm.

            Knowing when to:

            • advance
            • consolidate
            • recover
            • regroup
            • reconsider the terrain

            Strategic restraint is not weakness. It is self-preservation.

            Rome could have lasted longer by fortifying fewer borders. Corporations could thrive longer by protecting focus instead of chasing scale. Nations could endure longer by strengthening their homeland defenses before ever wasting a single dime projecting power abroad.

            Sun Tzu’s art was never about conquest. It was about sustainability.

            Victory without stability is just defeat on layaway.

            Awareness in Motion

            Awareness is the antidote to overreach.

            It requires honest measurement:

            • what’s working
            • what’s weakening
            • what’s cracking
            • what’s already lost

            It requires humility: no army, business, or nation can move indefinitely without rest.

            In cybersecurity, awareness is visibility.
            In leadership, it’s listening.
            In foreign policy, it’s simply remembering.

            Awareness doesn’t stop momentum. It calibrates it.

            It’s the half-beat between breaths that keeps the system alive.

            Bridge to Chapter X | Terrain

            Sun Tzu ends this chapter by looking outward again.

            Once you’ve learned to read fatigue, imbalance, and decay within, the next step is to read the environment beyond.

            The internal determines how you survive the external.

            Which returns us to the opening principle: When you leave your own country behind…you find yourself in a position of dependence on others.

            An army on the march teaches us to see ourselves. Chapter X Terrain teaches us to read the world:

            • its obstacles
            • its openings
            • its deception
            • its opportunities
            • its traps

            Awareness of self means little without awareness of landscape. That’s where the next battle begins.

            The Art of Cyberwar | Part VIII | Variation in Tactics

            The principle: “There are not more than five musical notes, yet the combinations of these five give rise to more melodies than can ever be heard.” — Sun Tzu

            Adaptation Over Assumption

            In Maneuvering, we learned the art of movement and how to turn posture into progress. Now Sun Tzu takes the next step: variation.

            Variation is the discipline of adaptation. Not improvisation for its own sake. It’s controlled flexibility and fluidity; the kind that keeps a force alive while in motion.

            Sun Tzu’s warning is ruthless: Predictability is the slow death of strategy. Every organization that wins too long risks repeating itself.

            Every CISO, every architect, every nation-state faces the same danger: When your patterns stabilize, your adversary’s job gets easier.

            Attackers study rhythm.
            They hunt repetition.
            They exploit formula.

            What you repeat becomes your weakness.

            Static Defenses, Dynamic Threats

            In cybersecurity, repetition feels like discipline:

            • the same checklists
            • the same daily, weekly or quarterly assessments
            • the same scanning cadence
            • the same unchanged playbooks

            It feels stable but it’s stagnation dressed as process.

            Meanwhile attackers evolve hourly.

            Their payloads morph.
            Their lures update.
            Their timing adapts to human fatigue cycles.

            They don’t overpower blue teamers; they systematically outlearn them.

            Sun Tzu’s guidance, “alter your plans according to circumstances,” isn’t merely poetic.

            It’s operational doctrine. Security isn’t a system. Security is a cycle.

            • Every breach teaches.
            • Every false alarm reveals.
            • Every routine day hides patterns waiting to be broken.

            The teams that adapt fastest aren’t the biggest.

            They’re the most fluid and adaptable.

            Variation is awareness in motion.

            Red Teams, Blue Teams, and the Dance of Adaptation

            Variation is the heartbeat of adversarial testing. Red teams live in uncertainty: improvisation, deception, broken rhythm. Blue teams train in structure: detection, containment, resilience.

            A mature organization doesn’t let them exist as siloed tribes. It merges them into purple teaming, where the creativity of offense and the rigor of defense evolve together.

            • Red exposes blind spots.
            • Blue turns discovery into discipline.
            • Together they adapt.

            This is the martial logic of sparring:

            • Wing Chun’s angle changes, where the same attack comes from different entries vs simply straight lines.
            • Muay Thai’s broken rhythm, where timing destroys expectation.
            • BJJ’s transition → position → submission sequence, where variation becomes game, set, match.

            Each engagement becomes rehearsal for reality. You’re not preparing for yesterday’s threat. You’re learning from tomorrow’s rehearsal. That’s Sun Tzu’s Variation: adaptation as preparation.

            Cloud Security: Adaptation as Architecture

            Cloud environments shift constantly:

            • APIs update
            • services deprecate
            • compliance rules revise
            • identity models evolve
            • integrations multiply

            Static thinking is fatal in a fluid system. Cloud security is variation embodied.

            Infrastructure-as-code lets architecture evolve at speed. Automation turns intent into consistent action, but without visibility, variation becomes drift.

            Sun Tzu’s metaphor of water fits perfectly: Water adapts to its container yet always seeks its level.

            Cloud engineers do the same:

            • change with the environment, without losing alignment
            • allow flexibility, without losing control
            • evolve configurations, without losing accountability

            Adaptation is necessary. Principles are non-negotiable.

            Foreign Policy and the Trap of Predictability

            Nations decay when their doctrine ossifies.

            The American foreign policy establishment has often fallen into this trap over and over again:

            • Cold War containment repeated even after the context changed.
            • counterinsurgency tactics applied to environments that defied them
            • interventions driven by reflex rather than awareness

            Vietnam: A doctrine built for conventional warfare in Europe applied to guerrilla conflict in jungle terrain. The U.S. measured success through body counts and attrition, while the enemy measured it through will and time. Same playbook, wrong war. Predictable escalation met adaptive resistance.

            Afghanistan: Twenty years of rotating commanders, each bringing their own tactical variation, but all operating under the same strategic assumption—that nation-building through military presence could succeed where it had failed for empires before. The tactics changed every 18 months with each new general. The doctrine never did. The enemy simply waited.

            Iraq 2003: Intelligence assumptions treated as certainties. A swift conventional victory followed by the assumption that democratic institutions could be installed through force. When insurgency emerged, the U.S. applied a counterinsurgency doctrine designed for different conflicts. By the time adaptation occurred (the Surge), years of predictable responses had already created the conditions for ISIS.

            But perhaps the most revealing pattern is the rhetorical one: every emerging threat becomes “the new Hitler,” every conflict the next World War II.

            • Saddam Hussein was Hitler.
            • Gaddafi was Hitler.
            • Milosevic was Hitler.
            • Assad was Hitler.

            The framing never changes. The enemy is always being Chamberlain in 1939 and being “appeasers of Hitler.” The infantile argument is always to stave off the newest existential threat to humanity. This isn’t strategy, it’s intellectual predictability masquerading as moral rectitude and always sticking by the banal cliche “never again,” whether is really applies or not.

            World War II was a unique conflict: a mechanized, industrial-scale war between nation-states with clear battle lines, total mobilization, and, foolishly, unconditional surrender as the objective. Applying that framework to insurgencies, civil wars, and regional conflicts doesn’t just fail tactically, it reveals a dangerous inability to see the situation as it actually is.

            The Hitler analogy serves a purpose: it short-circuits debate, frames inaction as appeasement, and makes intervention seem inevitable. But it’s also the ultimate form of strategic predictability. When every threat is Hitler, every response becomes World War II, and variation dies.

            Variation in statecraft means reading each situation fresh, not recycling last decade’s doctrine into a new century, and certainly not recycling a doctrine from 80 years ago. In each case, tactical adjustments happened but strategic doctrine remained rigid. That’s the opposite of Sun Tzu’s teaching: vary tactics, never principles. These conflicts varied neither.

            The Global War on Terror: The Ultimate Failure of Variation

            And then there’s the final, most damning example of strategic predictability: Ahmed al-Sharaa, originally known as Abu Mohammed al-Jolani, who once led al-Qaeda’s Al-Nusra Front or Jabhat al-Nusra in Syria and spent years detained by U.S. forces as a terrorist in Iraq, was welcomed to the White House in November 2025 by President Trump.

            He once had a $10 million U.S. bounty on his head. He founded al-Nusra Front, al-Qaeda’s Syrian branch. Now he’s a partner in the Global War on Terror.

            This isn’t adaptation. This is strategic incoherence dressed as pragmatism.

            Twenty-four years after 9/11, after trillions spent, after Afghanistan and Iraq, after “we don’t negotiate with terrorists” became doctrine, the United States now supports the former head of the very organization we invaded multiple countries to destroy.

            The justification? He helps combat ISIS. The same ISIS that emerged from the predictable chaos of the Iraq War. The same conflict where al-Sharaa himself fought as a leading al-Qaeda member against U.S. forces.

            This is what happens when doctrine ossifies while reality shifts. When every threat is framed through the same lens (“the new Hitler”), when every intervention follows the same playbook, when strategic thinking atrophies into bureaucratic reflex you end up shaking hands with yesterday’s enemy because you can’t recognize that your framework has failed.

            Sun Tzu’s warning rings clear: predictability invites exploitation. The GWOT’s predictable responses—invasion, occupation, counterinsurgency, withdrawal created a cycle that adversaries learned to exploit.

            They adapted. We repeated.

            And now, the former al-Qaeda commander who once fought U.S. forces receives a hero’s welcome at the seat of American power. Not because the threat changed. Because we ran out of variations on the same failed strategy.

            Predictability in diplomacy invites miscalculation.
            Predictability in force posture invites escalation.
            Predictability in cyber deterrence invites probing.

            Again, as an example, at the extreme end of predictability lies Pearl Harbor.

            Japan didn’t strike out of pure ambition; it struck because the U.S. cut off:

            • 90% of its oil
            • vital steel
            • food
            • rubber
            • machinery
            • industrial materials

            A nation deprived of resources enters what Sun Tzu called death ground, the place where maneuver becomes inevitable.

            • Predictable embargo.
            • Predictable deterioration.
            • Predictable desperation.
            • Predictable strike.

            Sun Tzu understood the principle: the more rigid your doctrine, the more your opponent will shift. Nations, like networks, must evolve, or decay through repetition.

            Variation Without Confusion

            Adaptability is not inconsistent. Sun Tzu warned that blind variation, change for its own sake,
            creates disorder.

            The rule is simple: Vary your tactics. Never vary your principles.

            In cybersecurity, the principles are visibility, trust, and accountability.
            In cloud architecture, they are governance and clarity.
            In foreign policy, they are restraint and realism.

            Change how you respond.
            Never change why you respond.

            That’s how variation becomes strength rather than noise.

            Modern Lessons in Motion

            Across every domain, the real art lies in learning faster than you decay:

            • In cybersecurity, adapt playbooks to every alert, not just every quarter.
            • In cloud: treat configuration as a living organism, not a static diagram.
            • In diplomacy: update doctrine before circumstances force your hand.

            Predictability invites attack.
            Curiosity creates resilience.

            Sun Tzu didn’t worship flexibility. He prized awareness in motion, responsiveness guided by principle.

            That is how you survive modern complexity: move → learn → realign → repeat.

            That’s variation.

            From Variation to Awareness

            Variation teaches movement. The next lesson teaches perception.

            In Chapter IX, The Army on the March, Sun Tzu turns to the signals that guide a force in motion,  how to read the terrain, sense morale, detect fatigue, and recognize when momentum turns into danger.

            If Variation in Tactics is about adapting to survive, The Army on the March is about understanding the signs that tell you whether your adaptation is working.

            Bringing us full circle to our opening principle: “There are not more than five musical notes, yet the combinations of these five give rise to more melodies than can ever be heard.”

            In our next installment, we’ll discuss perception and reality in networks, in nations, in martial skill, and most critically, in ourselves.