Category: pentesting

First Principles of Cybersecurity: Essays on Leadership, Trust, and Organizational Maturity – Part II

First Principles of Cybersecurity Essays on Leadership, Trust, and Organizational Maturity -- MattShannonSecurityPro.com

Leadership Is a Security Control

The Environment Leaders Create Determines the Level of Security Their Organizations Achieve

Ask ten security professionals to name the most important security controls in a modern organization, and the answers will sound familiar. Multi-factor authentication. Endpoint detection and response. Network segmentation. Encryption. Vulnerability management. Security awareness training.

None of those answers is wrong. Each represents a critical layer in a mature security program.

Yet they all share a common characteristic: they are downstream of another control that receives far less attention but influences every one of them..

Leadership.

This may seem like an unusual assertion. Leadership does not appear on a network diagram. It cannot be licensed, deployed, or patched. It generates no alerts and produces no dashboard filled with metrics. Yet every meaningful security decision within an organization is ultimately shaped by leadership. Before a firewall is purchased, before a policy is written, before an employee completes awareness training, someone has already decided that security matters—or that it does not.

That decision is leadership in action.

Every Organization Is Perfectly Designed to Produce Its Security Culture

There is a saying often attributed to systems theorist W. Edwards Deming: “Every system is perfectly designed to get the results it gets.” Whether or not those were his exact words, the principle remains instructive.

Security culture is no exception.

Organizations rarely arrive at their security posture by accident. Rather, it emerges from thousands of decisions made over time. These are decisions about priorities, incentives, resources, accountability, and acceptable risk. Employees learn what truly matters not by reading policies, but by observing leadership.

If executives insist on secure practices even when they create inconvenience, employees notice.

If managers routinely ask teams to “just make it work” regardless of established procedures, employees notice that, too. Culture is not built through declarations. It is built through repetition.

Leadership determines what is repeated.

According to the 2024 Verizon Data Breach Investigations Report, over 80% of breaches involved a human element, highlighting that culture, behavior, and leadership are as critical as any technical control.

The Strongest Policies Cannot Overcome Weak Priorities.

Many organizations invest considerable effort in writing comprehensive security policies. These documents establish expectations, define responsibilities, and provide consistency across the enterprise. They are necessary.

They are also insufficient. A policy reflects what an organization says it values. Leadership reveals what it actually values.

Consider two organizations with identical password policies.

In the first, executives follow the same authentication requirements as everyone else, allocate time for security training, and treat security concerns as legitimate business discussions. In the second, executives routinely request exceptions, postpone security projects in favor of short-term operational gains, and regard cybersecurity as primarily the IT department’s responsibility.

On paper, the organizations appear identical. In practice, they are fundamentally different.

Policies establish direction and leadership establish credibility.

Employees are remarkably adept at distinguishing between the two.

Leadership Defines Acceptable Risk

One of the most misunderstood aspects of cybersecurity is the belief that the objective is to eliminate risk. It’s not. Every organization accepts risk. The question is whether those decisions are deliberate or accidental.

Leadership determines where that line is drawn. When a board approves funding for identity modernization rather than postponing the investment for another year, it is making a security decision.

When a superintendent supports temporary operational disruption to remediate a critical vulnerability rather than accepting unnecessary exposure, that is a security decision.

When an executive asks not only, “What will this cost?” but also, “What risk does this reduce?” security has become part of organizational decision-making rather than an afterthought.

Security professionals identify and communicate risk. Leadership determines which risks are acceptable.

These responsibilities are distinct, but inseparable.

Trust Is a Preventive Control

Technical controls prevent malicious activity, and leadership often prevents organizational failure.

Employees who trust their leaders report mistakes sooner. They ask questions before making assumptions. They admit uncertainty before uncertainty becomes an incident.

Conversely, organizations that punish honest mistakes often create an environment where employees hide them. The initial phishing email is rarely what causes the greatest damage.

Silence does.

Trust is therefore more than an abstract leadership quality. It is a practical security control that shortens response times, improves communication, and encourages the reporting behaviors upon which effective incident response depends.

Organizations frequently invest millions of dollars in detection technologies while overlooking one of the simplest ways to improve detection: creating an environment where people feel safe speaking up.

Technology Scales Capability. Leadership Scales Behavior.

Technology can authenticate identities, encrypt data, detect anomalies, and automate countless security functions. It can’t establish priorities, create accountability, model integrity, or build trust. Only leadership can accomplish those things.

This is why organizations with modest security budgets, but disciplined leadership often outperform organizations possessing sophisticated technologies but inconsistent governance. The difference is not the tools themselves. It is the environment in which those tools operate.

Technology amplifies capability and leadership amplifies behavior. Given enough time, behavior almost always proves to be the more influential force.

Actionable Steps for Leaders

  • Model security behaviors consistently at every level of the organization.
  • Integrate risk discussions into executive decision-making, not just technical reviews.
  • Foster a culture of psychological safety so employees feel comfortable reporting mistakes and asking questions.
  • Align security policies with actual business practices—avoid policies that are routinely bypassed.
  • Invest in both technology and leadership development to scale capability and culture in tandem.

Final Thoughts: Leadership as the First Control

It is tempting to think of cybersecurity as something managed by the security department. Firewalls belong to network engineers. Endpoint protection belongs to security analysts. Policies belong to governance teams.

Leadership belongs in every decision.

Every decision about priorities, every allocation of resources, every conversation about acceptable risk, and every example set by those entrusted to lead either strengthens or weakens the organization’s security posture.

For that reason, leadership should not be viewed merely as support for cybersecurity.

It should be recognized for what it is.

The first security control.

Key Takeaways:

  • The downstream effects of leadership shape every aspect of an organization’s security posture.
  • While policies and technology matter, leadership determines how they are valued, implemented, and, more importantly, enforced.
  • Trust and culture are practical security controls that improve incident response and reduce risk.
  • Consistent, visible prioritization of security by leaders is more influential than any single technical investment.
  • Security is ultimately a human endeavor, and its success is determined by the actions and environment set by those who lead.
  • This perspective is echoed by leading frameworks, NIST CSF and ISO 27001, which position governance and leadership at the foundation of resilient security programs.

The technologies organizations deploy may change. The threats they face certainly will. But the principle remains constant: every security program ultimately reflects the leadership that built it.

Leadership, then, is not merely support for security; it’s the foundation.

First Principles of Cybersecurity: Essays on Leadership, Trust, and Organizational Maturity – Part I

The Hidden Cost of Convenience in Cybersecurity

Why Intelligent People Circumvent Security,
and What Mature Organizations Do About It

Walk into almost any classroom in the country at the beginning of a new school year, and you’ll witness controlled chaos.

Teachers are preparing lesson plans, organizing classrooms, responding to parents, configuring technology, attending meetings, and welcoming a new group of students, all before the first bell ever rings. The pace is relentless, and every minute matters.

Now imagine walking past a cart of student Chromebooks and noticing something unexpected.

A small adhesive label with a student’s name, username, and password affixed directly to the device.

At first glance, it’s easy to criticize the practice. After all, writing credentials on the very device they’re intended to protect undermines one of the most fundamental principles of information security.

But if that’s where the conversation ends, we’ve learned very little. The more interesting question isn’t why someone ignored security.

The better question is: Why did this feel like the best solution in the first place?

That distinction matters because mature cybersecurity is not built by identifying mistakes. It is built through understanding the conditions that make those mistakes seem reasonable.

Intelligent People Rarely Choose Insecurity

One of the most persistent misconceptions in cybersecurity is the belief that policy violations emanate primarily from ignorance, carelessness, or indifference.

In reality, most people are trying to do exactly what they’ve been hired to do. Teachers are trying to teach. Nurses are trying to care for patients. Engineers are trying to deliver systems. Executives are trying to lead organizations. Their objective is not to violate policy.

Their objective is to accomplish meaningful work. When security introduces unnecessary friction into that work, people naturally begin searching for ways to reduce it. Not because they oppose security. Because they are optimizing for progress. The sticky note wasn’t malicious. It was an optimization.

Unfortunately, it optimized the wrong variable.

The Path of Least Resistance

Human beings are remarkably consistent. When presented with multiple ways to accomplish the same objective, we tend to choose the one that requires the least effort. Behavioral psychologists have studied this phenomenon for decades. Economists describe it through concepts like bounded rationality and mental effort. Engineers simply recognize it as good design.

Cybersecurity often forgets it entirely.

Organizations frequently assume that if policies are written clearly enough, people will simply follow them. Experience suggests otherwise. People generally follow the path that requires the fewest decisions, the least interruption, and the least additional effort. That’s not laziness, it’s human nature.

Every unnecessary step added to a security process becomes another opportunity for someone to find a shortcut. And shortcuts have a way of becoming habits.

The Difference Between Immature and Mature Security Programs

Immature organizations respond to incidents by writing another policy. Mature organizations ask a different question.

Why did this make sense to someone?

That question shifts the conversation from blame to design. Consider the classroom example.

Should passwords remain private? Absolutely.

Should credentials ever be attached directly to a device? Of course not. But stopping there ignores the larger lesson. Why did an experienced educator, someone strongly dedicated to their students, conclude that this was the most practical solution?

Perhaps student onboarding was cumbersome. Perhaps the process required frequent password retrieval.

Perhaps the system created more friction than necessary during one of the busiest weeks of the year. Those possibilities deserve just as much attention as the policy itself. Because good security doesn’t merely tell people what not to do. It makes the secure choice the wise choice.

Security Culture Is a Design Problem

Culture is often described as shared values or shared beliefs. In cybersecurity, culture is better measured using shared behaviors. Those behaviors are influenced less by slogans than by systems.

When secure behavior is intuitive, people adopt it naturally. When secure behavior consistently slows people down, even well-intentioned professionals begin inventing workarounds.

The problem isn’t that people prefer convenience. The problem is when convenience and security are placed in opposition to one another. Strong organizations refuse to accept that tradeoff.

Instead, they ask: “How can we design systems where the secure path is also the easiest path?”

That question signifies a profound shift in thinking. Rather than expecting people to overcome human nature, mature organizations design with human nature in mind.

Leadership Beyond Technology: Setting Security Culture by Example

This principle extends far beyond passwords. In practice, organizations sometimes hard-code credentials because rotating them seems cumbersome. Employees reuse passwords because managing dozens of unique ones is impractical without support. Executives may bypass established processes they perceive as slow, sometimes even advocating for policies they themselves neglect. These behaviors highlight how security actions, good or bad, are shaped by leadership priorities and organizational culture.

Frameworks like Zero Trust (ZT) and NIST’s Cybersecurity Framework (CSF) both emphasize the importance of aligning policies and controls with real-world workflows. For example, Zero Trust encourages the principle of ‘never trust, always verify’, but it also emphasizes minimizing user friction by making secure access seamless. Similarly, NIST CSF calls for continuous improvement and adaptation to actual business context, including user experience, as a critical part of protecting information.

A 2024 Verizon Data Breach Investigations Report found that over 80% of breaches involved a human element, whether through error, misuse, or social engineering. This underscores the need to design security with people, not just technology, in mind.

Consider the widely publicized 2023 MGM Resorts breach: attackers gained access not through a technical exploit, but by manipulating an employee via social engineering. The aftermath highlighted both the human cost of poor security design and the value of resilient, well-communicated processes. Mature organizations study such incidents to inform better system and workflow design, not just to enforce stricter rules.

None of these behaviors are unique to education. They are remarkably consistent across industries. Whether it’s healthcare, finance, manufacturing, government, or cloud engineering, it’s the same.

Technology changes, human behavior does not. This is why effective cybersecurity leaders spend as much time understanding organizational behavior, workflow design, and communication as they do learning about technology. Firewalls protect networks, encryption protects data, identity platforms protect access, and leadership shapes behavior.

And behavior, modeled first by leadership, ultimately determines whether those technologies succeed.

Designing for Reality

There is an old saying in engineering: “Don’t design for perfect conditions. Design for the conditions that are the reality.”

Cybersecurity deserves the same mindset. People work under the pressure of deadlines. And many humans are easily distracted.

They make mistakes. They focus on competing responsibilities. Expecting otherwise isn’t leadership. It’s wishful thinking. The strongest security programs acknowledge these realities and build systems that accommodate them.

Not by lowering standards. By lowering unnecessary friction. Good security accounts for human behavior. Great security aligns human behavior with enterprise intent. That is where security culture begins.

Actionable Steps for Leaders:

  • Review critical workflows for unnecessary security friction; streamline processes where possible. Invest in user-friendly identity and access management platforms that support secure, seamless authentication (e.g., password managers, SSO).
  • Regularly communicate the ‘why’ behind security policies and invite feedback from end users.
  • Model secure behaviors at the leadership level; visible adherence by executives sets cultural expectations.
  • Align technology investments with both security best practices (ZT, NIST) and the realities of day-to-day business operations.

Final Thoughts: Designing for Humans

Key Takeaways:

  • Security workarounds are rarely due to ignorance; they’re often rational responses to unnecessary friction.
  • Mature organizations design security systems that align with natural human behaviors and incentives.
  • Leadership sets the tone—when executives model secure, user-friendly practices, security culture flourishes.
  • Frameworks like Zero Trust and NIST CSF emphasize the importance of user experience and continuous improvement.
  • The most resilient organizations prioritize systems that help people succeed, not just avoid failure.

The sticky note attached to the Chromebook was never really about the sticky note. It’s an example that every decision in a security environment reflects a larger system of incentives, constraints, priorities, and, mostly, habits.

More often than not, systems fail because they ask ordinary people to behave in extraordinary ways. Technology rarely fails first. People rarely fail first. The most resilient organizations understand this. They don’t build security around an idealized version of human behavior. They build it around reality.

Because in the end, cybersecurity isn’t simply about protecting systems. It is the discipline of building systems that help people succeed. And perhaps that is the deeper lesson.

Convenience isn’t the enemy of security. Poor design is.

Or, said another way, Strong security cultures are not built by asking people to overcome human nature. They are built by knowing human nature well enough to design systems that coordinate convenience with security.

The Art of Cyberwar | Part X | Terrain

The principles:

“The natural formation of the country is the soldier’s best ally; make use of it to your advantage.”

“When the general is weak and without authority; when his orders are not clear and distinct; when there are no fixed duties assigned to officers and men, and the ranks are formed in a slovenly haphazard manner, the result is utter disorganization.”

“The general who advances without coveting fame and retreats without fearing disgrace, whose only thought is to protect his country and do good service for his sovereign, is the jewel of the kingdom.” — Sun Tzu

Ground First

Sun Tzu makes a simple demand: know the ground on which you stand.

The proper ground turns disadvantage into leverage. The wrong ground turns strength into exposure. Terrain is not merely soil; it is topology, logistics, law, culture, and architecture. In the modern world, it includes cloud regions, compliance borders, identity planes, and network topology. Choose well, and the fight often narrows into something you can actually win.

This is not an abstract chapter. It’s a practical one.

If you’ve ever seen a breach unfold, you’ve witnessed terrain deciding outcomes in real time: attackers rarely “win” because they are stronger; they win because they enter through easy ground, move through poorly observed corridors, and reach valuable systems before defenders can orient.

The defender’s job is to resist. It is to shape the ground, so the adversary’s best options become expensive, loud, or impossible.

Types of Terrain – What They Feel Like, What They Demand

Sun Tzu names a wide variety of ground. In practice, the terrain we face, militarily, digitally, and politically, collapses into recurring patterns: open, narrow, steep, encircled, and expansive.

Each demands a distinct strategy. Each punishes a different kind of arrogance.

Open Ground – Fast, visible, unforgiving

Open ground is where you can be seen.

In war, it is flat land with no cover: movement is easy, concealment is costly, and discipline decides whether speed becomes an advantage or panic. Detection and clean maneuvering are important because contact is constant.

In cybersecurity, open ground is your public-facing surface area: internet-exposed services, public APIs, external portals, and remote access entry points. This is not where you want complexity. You want ruthless simplicity, fewer doors, fewer endpoints, fewer exceptions, paired with strong telemetry. Frameworks like the CIS Controls and NIST CSF explicitly prioritize inventorying and minimizing public-facing assets—making clarity and control here a universal best practice.

Open ground is also where deception works best. Decoys, false signals, and baited paths can pull an enemy out of position. In cyber, honeypots and canary tokens do the same: they invite movement into visibility and turn curiosity into evidence.

Real-world case: In 2021, the Microsoft Exchange Server vulnerabilities (ProxyLogon) exposed thousands of organizations’ email systems to the internet. Attackers rapidly exploited unpatched, public-facing assets—demonstrating why CIS Controls and NIST CSF stress the importance of inventory and minimizing the external attack surface.

Open ground isn’t “unsafe.” It’s honest. It shows you what you built.

Narrow Ground – Chokepoints, bridges, legacy stacks

Narrow ground is where everything funnels.

In military history, chokepoints decide battles because geometry becomes force. A smaller army can hold a larger one, not by being stronger, but by limiting the enemy’s options. Just think of the legendary last stand of Leonidas and the Battle of Thermopylae.

In cyber and cloud, narrow ground is often the infrastructure everyone relies on and no one wants to touch: legacy integrations, VPN tunnels, identity gateways, brittle on-prem choke points, systems tied to modern workflows by thread and habit. They become bridges. Bridges become targets.

If you harden one thing this quarter, harden your chokepoints, segment around them. Add compensating controls. Increase logging where applicable. Treat narrow terrain as sacred because when it fails, everything behind it is exposed. The MITRE ATT&CK framework’s focus on lateral movement and privilege escalation highlights why chokepoints must be secured and closely monitored.

Mini-case: The 2021 Colonial Pipeline ransomware attack targeted a single VPN account—an overlooked chokepoint with no multi-factor authentication. This breach underscores the criticality of securing and monitoring privileged access pathways.

Martial principles show up cleanly here. Wing Chun teaches that in close range, cutting angles and superior structure become everything. Trapping is about denying your opponent options. Narrow terrain does the same: it constrains movement and penalizes sloppy positioning.

Steep Ground – Visibility and defensibility, limited mobility

Steep ground is an advantage you must maintain.

High ground offers visibility and defensive leverage, but you don’t sprint on it. Movement becomes deliberate. Once you lose it, regaining it costs more than taking it did.

In cyber/cloud terms, the “steep ground” is where you place your crown jewels: production enclaves, privileged access vaults, critical logging pipelines, backup infrastructure, and identity governance, zones with strict access controls, immutable logs, and minimal pathways. NIST Special Publication 800-53 and CIS Controls both emphasize layered defenses and strong separation for critical assets, reinforcing the need for deliberate, hardened environments.

These environments should feel “steep” to anyone moving through them, including your own staff. That friction is the point. Steep terrain ensures enforcement of control.

Industry example: Major cloud providers routinely isolate customer data and management functions in highly restricted “steep ground” zones, applying controls from NIST SP 800-53 and CIS to prevent lateral movement and ensure containment if a breach occurs.

In Jiu Jitsu, this is akin to mount or back control: you don’t rush to snatch up a submission. You stabilize, isolate, and apply pressure through position and then finish. The defender who gets impatient on steep ground usually falls off it.

Encircled Ground – When you risk being surrounded

Encircled terrain is where isolation becomes lethal.

In war, encirclement breaks supply lines, erodes morale, and forces rash decisions. In cyber, encirclement often begins as “convenience” and ends as captivity: vendor dependencies, brittle third-party integrations, shadow IT no one owns, “critical” workflows held together by one person’s tribal knowledge.

The danger is that encirclement rarely feels dramatic at first. It feels normal until you need to restore. Until a vendor is down. Until the contract becomes leverage. Until the only admin is on PTO and the incident is already in motion.

Encircled ground demands exits: recovery paths, out-of-band access, air-gapped backups, and playbooks that restore connectivity without improvisation. CIS Control 11 and the NIST CSF Recovery Function both emphasize the importance of tested backup and recovery plans, as reliance on a single vendor or system is a strategic vulnerability.

Recent headline: In the wake of the 2022 Okta breach, organizations that relied exclusively on one identity provider faced business continuity risks. Those with tested out-of-band recovery and contractual exit clauses, as recommended by CIS and NIST, were able to restore operations more quickly.

If you don’t have those, you don’t have resilience. You have hope.

Expansive Ground – Flat, wide, tempting for overreach

Expansive terrain invites ambition. It also hides risk.

Movement feels easy because there’s “room,” but oversight drops as the supply lines lengthen. This is how empires, and cloud estates, collapse: not from one failure, but from accumulated, ungoverned territory.

In cyber, expansive ground is sprawl: dozens of cloud accounts, multiple providers, endless permissions, duplicated tools, integrations stacked on integrations. Sprawl isn’t evil. It’s simply unmanaged terrain.

Expansive ground demands scalable governance: infrastructure-as-code policies, automated compliance, continuous asset inventory, and hard limits on “just one more integration.” Otherwise, you end up “owning” too many things to defend any of them properly. Both NIST CSF and the CIS Controls call for continuous asset management and automated enforcement to keep sprawl in check.

This is where adversaries thrive, inside your noise.

Example: Several high-profile breaches, including Capital One (2019), were linked to sprawling cloud environments where asset management and policy enforcement lagged behind rapid deployment. This highlights why NIST CSF and CIS Controls call for continuous inventory and automated governance.

Choosing the Ground – Offense Through Selection

A leader’s first tactical choice is where to fight. Good generals choose terrain that favors their force and punishes the enemy’s approach. That’s a decision, not a reflex.

In cybersecurity, this is how you win before the breach: place valuable services behind hardened, observable layers and force attackers into monitored choke points. Make lateral movement steep. Make privilege escalation loud. Make time and friction the price of progress.

In cloud architecture, it refers to trust zones and least-privilege boundaries that govern movement, much as terrain shapes an army’s movement. If an adversary wants access, they must climb and be exposed while doing it.

In foreign policy, it means choosing diplomatic and economic levers rather than landing zones that stretch logistics and public support. Sometimes the “terrain” is public will. Sometimes it’s alliance cohesion. Sometimes it’s your economy. Burn those, and you’ve lost the campaign even if you win the first clash.

Choosing ground is an active defense. It doesn’t surrender initiative; it shapes the enemy’s options.

This is where martial deception becomes a strategy. A feint isn’t a lie, it’s an invitation. In Wing Chun, you draw the reach, trap the limb, clear the line, and strike at the same time. In Muay Thai, you show the jab to invite a teep to sweep the leg. In Jiu Jitsu, you offer the submission attempt you’re prepared to counter. Terrain selection works the same way: you present what looks like access, but what you built is a corridor of control.

Leadership, Discipline, and Knowing Your Soldiers

Sun Tzu insists a general must know his troops. That’s leadership in a sentence.

A leader’s indecision, ego, or poor communication is as lethal as bad geography. Poor leaders over-commit, under-communicate, or ignore warnings. They treat friction as disobedience and clarity as optional. That is how organizations drift into the “slovenly haphazard” disorder Sun Tzu warns about: plenty of tools, no coherence.

Discipline matters. Soldiers and engineers, treated with respect but held to standards, perform under pressure. Leniency breeds sloppiness; cruelty breeds silence. Both are operational risks.

Know your teams: strengths, fatigue thresholds, and tempo. Rotate duty. Limit emergency hours. Maintain training. In cloud and cyber, this includes on-call limits, respect for sleep, post-incident retrospectives, and psychological safety to report near-misses before they become incidents.

Morale shows up earlier than metrics. Leaders build the culture that sustains long campaigns.

Calculation Before Battle – The Work of Winning

Sun Tzu elevates calculation above impulse: the commander who measures many variables before engagement usually wins; the one who does not, loses.

This calculation is methodical: map terrain, count supplies (capacity), estimate enemy options, and plan contingencies.

In cyber, that means knowing your attack surface, understanding threat actor patterns, identifying likely pivot points, and building tested response runbooks. Rehearse, not because you expect a breach, but because you refuse to improvise under duress.

In the cloud, this entails calculating blast radius, recovery objectives, and the cost of complexity relative to the cost of resilience. It also means choosing fewer tools and mastering them, because every new platform is a new terrain you must defend.

In policy, it means calculating costs in treasure, trust, and time. Private-sector analogs are attention, capital, and brand.

Winning is the product of preparation. You cannot improvise a viable posture in a crisis.

Specific Strategies by Terrain – Practical Moves

  • Open ground: prioritize speed and detection; keep public assets to a minimum; deploy decoys and canaries; monitor aggressively. (CIS Controls 1, 7; NIST CSF Identify & Protect).
  • Narrow ground: enforce access controls and logging; funnel traffic through audited gateways; validate identity aggressively. (MITRE ATT&CK, NIST CSF Detect)
  • Steep ground: design immutable environments and strict separation; place critical controls in high-ground enclaves with minimal human pathways. (NIST SP 800-53, CIS Control 13)
  • Encircled ground: ensure out-of-band recovery, air-gapped backups, manual admin paths; maintain contractual exit clauses with vendors. (NIST CSF Recovery, CIS Control 11)
  • Expansive ground: prune and consolidate; adopt infrastructure-as-code policies and automated compliance; set hard limits on new integrations. (CIS Control 1, NIST CSF Asset Management)

Every choice reduces the opponent’s options and preserves the defender’s leverage. In practice, aligning terrain strategies with proven frameworks isn’t bureaucracy; it’s how you translate doctrine into daily operations.

Parallels: Rome, Corporations, and Nations

Rome didn’t fail because it was weak; it failed because it could no longer pay for its expansion. The pattern repeats: a leader mistakes reach for control, stretches supply lines, and forgets the home base.

In business, over-expansion without integration kills cash flow and culture. In policy, interventions without sustainable objectives are hollow support. In cyber, growth without governance turns territory into liability.

The remedy is the same: select advantageous ground, keep logistics tight, and honor the limits of what you can sustain.

Closing: Ground, People, Calculation

Terrain teaches humility. It forces honesty about supply lines, political will, and human limits. Leaders must select ground that fits their forces, know their people well enough to deploy them without breaking them, and calculate relentlessly before contact. The best strategy isn’t the loudest; it’s the one most rigorously mapped to the ground and standards that define your domain.

Sun Tzu’s point is blunt: the general who prepares wins because he has already made many small victories before the first clash. The rest simply discover, too late, what the ground beneath them already knew.

The Next Step: Situations Reveal the Ground

Sun Tzu ends this chapter the way a good fighter ends an exchange: not with noise, but with control.

Terrain is not merely where you fight; it is what the fight allows. It determines which tactics are available, which movements are costly, and which victories are possible without incurring blood, bandwidth, or morale costs. The wise commander doesn’t “try harder” on bad ground. He changes the angle, changes the conditions, and shapes the enemy’s options.

Muay Thai does it with ring craft: take space, cut off exits, force exchanges where your strikes land cleanly. Jiu Jitsu does it with: position, then control, then submission, and sometimes with a ruthless setup: allowing the opponent to chase the submission you expected, only to counter when they overextend.

Terrain works the same way. Choose it well, and you’re not only defending but shaping the enemy’s approach until their “attack” becomes the opening you built the environment to reveal.

That leads us directly back to the principles that opened this chapter:

“The natural formation of the country is the soldier’s best ally; make use of it to your advantage.” Because once you understand the ground, you stop fighting the fight the enemy wants, and start forcing the battle they cannot win.

And when leadership is weak, orders are unclear, and duties are unfixed, the result is exactly what Sun Tzu promised: utter disorganization, not because the enemy was brilliant, but because the ground exposed what was already unstable.

The highest standard remains unchanged: the general who advances without vanity and retreats without fear, whose only thought is to protect his people and do good service, is the jewel of the kingdom.

Bridge to Part XI – The Nine Situations

Terrain teaches you what is possible. The Nine Situations teaches you what to do when possibility collapses into reality, when you’re advancing, retreating, encircled, trapped, deep in enemy ground, or approaching decisive contact.

It is a doctrine of movement under pressure: acting in accordance with circumstances without losing coherence.

You’ve learned how to read the ground.
Next, you’ll learn how to fight on it.

Security Without the Pessimism | Capstone: The Human Architecture of Resilience

There’s a moment in every incident, and in every life, when things go sideways.
An urgent alert comes in at 2 a.m.
The phone buzzes with something you didn’t want to see.
The room suddenly feels smaller.
Your pulse skyrockets ahead of your ability to reason.

That’s the pivot point.

Not the breach, not the threat actor, not the malware strain. The moment your mind decides whether to rush, freeze, or breathe.

And if the past two decades in cybersecurity have taught us anything, it’s this: The most overlooked control isn’t technical at all — it’s the ability to think clearly under pressure.

You can build the best firewall on earth, layer your identity stack, and lock down every endpoint within reach. But if the wrong person panics at the wrong moment? Your architecture won’t crumble, but your response will.

And the irony is that the same pattern shows up everywhere.
In the gym.
In martial arts.
In American foreign policy across multiple generations.
In corporate culture.
In our personal lives.

Technology changes. Tools evolve.
But human behavior remains the battlefield.

This capstone is about that battlefield, the one beneath all the dashboards and diagrams.
The human architecture of resilience.

Not fear.
Not pessimism.
Not endless warnings.
Just clarity, culture, awareness, and depth.

I. The Calm Before the Click: Thinking Clearly Under Pressure

Cybersecurity professionals often discuss “root cause.”
The CVE.
The misconfig.
The missing patch.
The malicious link.

But if you trace incidents far enough back, you rarely find a purely technical failure.
You find someone who was tired.
Someone who rushed.
Someone is overloaded with tasks, tabs, or alerts.
Someone who clicked before the mind caught up.

Attackers have known this longer than we have.
Social engineering is, at its core, the psychological equivalent of an ambush.
It doesn’t rely on brilliance — it relies on rhythm.
Interrupt someone’s rhythm, and you can make them do almost anything.

History played the same game long before phishing emails existed.

During WWI, the U.S. population had no appetite for a European conflict until the Committee on Public Information mastered message engineering on a national scale.

During Vietnam, selective narratives were used to anchor the Gulf of Tonkin resolution, one of the clearest examples of how urgency overrides discernment.

After 9/11, emotional exhaustion and fear gave the green light to decisions that would shape two decades of conflict, including the push toward Iraq in 2003 on intelligence the government already knew was questionable at best.

The pattern is timeless: pressure → perception drops → people accept what they would normally question.

In cybersecurity, that’s the moment a breach begins. Not when the payload deploys, but the moment someone stops breathing long enough to see clearly.

Martial arts teach this early: when your structure collapses, so does your mind. The fight is rarely won by the strongest, but by the one who stays calm.

Cybersecurity isn’t so different. We need quieter minds, not louder alarms. Consider the Apollo 13 mission: when an oxygen tank exploded in space, it wasn’t advanced technology alone that saved the crew—it was the unwavering composure, clear communication, and problem-solving focus of both astronauts and mission control. Their story remains a testament to the power of preparation, training, and the human spirit under pressure.

Psychological research supports this need for balance: the Yerkes-Dodson Law demonstrates that while a certain level of stress can sharpen performance, too much leads to mistakes and paralysis. It’s not the loudest alarms or the highest stress that produce the best outcomes, but the ability to operate with steady focus under pressure.

II. Security Isn’t a Toolset. It’s a Culture.

This is the part vendors never put in their brochures.
Tools matter, of course they do, but they’re not the foundation.
If a team’s culture is fractured, fearful, or fatigued, the best tool becomes another dashboard no one trusts.

A culture of security is built on three traits: Curiosity. Communication. Psychological safety.

Curiosity is the click buffer. It’s the pause before the action. It’s the “does this feel right?” instinct that catches what technology misses.

Communication is the force multiplier. If people don’t feel comfortable asking questions, you don’t have a security program; you have a façade. The worst breaches happen in organizations where employees believe that reporting something suspicious will get them punished.

Psychological safety is the foundation beneath it all. You cannot build defense through fear.
If people feel judged, they go silent. And silence is where threat actors win.

Across American history, the same dynamic appears at scale. Governments that relied on controlling the narrative rather than fostering transparency created long-term instability.
Nations that punished dissent instead of listening to it made poorer decisions, walked into unnecessary conflicts, or ignored early warnings because no one felt safe raising them.

In cybersecurity, the equivalent is leadership that says: “If you click a bad link, come to us immediately, you’re part of the solution, not the problem.”

Culture isn’t a policy. Culture is what happens when no one is watching.

III. The Invisible Threat: Complacency

Complacency is the enemy that feels like a friend. It arrives quietly. It shows up after long stretches of “nothing happened.” It hides behind phrases like:

  • “We’ve never had an incident.”
  • “We’ve always done it this way.”
  • “Our tools would catch that.”

Every major breach you can name—SolarWinds, Equifax, Colonial Pipeline—roots itself in complacency somewhere: A missed update. An over-trusted vendor. An assumption that the environment was safer than it actually was. The 2013 Target data breach is a sobering example: multiple security alarms were triggered, but critical warnings were overlooked amidst noise and unclear processes. The failure wasn’t just technical—it was cultural and human. True resilience is built not on more tools, but on clear communication, shared responsibility, and organizational discipline.

There’s a parallel here, too, in public psychology. Before WWI, the U.S. believed oceans protected it.

Before the Vietnam War, we believed that superior technology guaranteed strategic clarity.
Before 9/11, we believed asymmetrical warfare couldn’t reach our shores.
Before the Iraq invasion, many believed intelligence agencies couldn’t be wrong.

Every time, familiarity dulled skepticism. Certainty replaced awareness.

Threat actors exploit the same weakness in cybersecurity: When we stop questioning our own assumptions, we hand them the keys.

But the solution isn’t paranoia. It’s presence—the discipline to stay aware without fear, engaged without burning out, and to use quiet periods to strengthen fundamentals rather than relax them.

Martial artists call this “maintaining the white belt mentality.” It’s the idea that no matter how skilled you become, your awareness must remain humble. The strike you don’t see coming isn’t the strongest; it’s the one you assumed wouldn’t land.

IV. Defense in Depth Begins With Humans in Depth

Defense in depth is usually presented as a diagram: Layers. Controls. Policies. Logging. Detection.

But the deepest layer is always the human beings behind the console.

Humans who communicate clearly under pressure.
Humans who don’t panic.
Humans who collaborate instead of silo.
Humans who maintain integrity even when no one is watching.

You can’t automate those traits.
You can only cultivate them.

A resilient team has depth:
Depth of character.
Depth of discipline.
Depth of humility.
Depth of trust.

Leadership plays a massive role here.
A leader who panics creates a cascading failure.
A leader who hides incidents creates blind spots.
A leader who blames creates avoidance.

But a leader who stays calm?
A leader who listens?
A leader who respects the intelligence of their team?

That kind of leadership becomes its own security layer, the kind attackers can’t penetrate.

Martial philosophy applies here beautifully:
The master doesn’t fight everything.
The master knows when not to fight.
The master conserves energy, maintains structure, and remains sufficiently present to move precisely when needed.

That’s cybersecurity at its best. Not a flurry of tools or panic-driven responses. But steady awareness, grounded action, and a team that trusts itself. The response to the Stuxnet worm demonstrated the power of multidisciplinary collaboration: security researchers, government agencies, and private-sector teams worked together to analyze, share intelligence, and adapt rapidly. Their coordinated effort underscores that no single individual or technology has all the answers—resilience is a collective achievement.

V. The Four Pillars of Real Resilience

Looking back across this entire series, four fundamentals keep appearing.

1. Calm

The ability to breathe before acting. Security begins in the mind, not the machine.

2. Culture

Tools help. Culture protects. Culture catches what software can’t.

3. Awareness

Not paranoia, presence. The discipline to question, verify, and stay awake to the world around you.

4. Depth

Technical depth is valuable. Human depth is irreplaceable. Depth fuels resilience in every domain: networks, clouds, teams, and nations.

These aren’t pessimistic ideas. These are empowering ideas. They’re principles that make security feel less like fear and more like clarity.

Threat actors depend on confusion. They depend on fatigue. They depend on people who doubt their instincts.

A calm mind. A strong culture. A present awareness. A deep team.

That’s how you win. Not loudly, but with consistency.

VI. Final Thought: Security Is a Human Practice Before It’s a Technical One

If there’s a thesis to Security Without the Pessimism, it’s this: Security isn’t something we bolt onto systems. It’s something we build into ourselves.

The work isn’t glamorous or cinematic. It’s often quiet, slow, and unrecognized. But it matters, because every decision and moment of awareness contributes to something bigger than any one of us, a culture of resilience.

So here’s the takeaway: You don’t need pessimism to stay secure. You just need presence. You need clarity and people who care enough to pause, communicate, and stay humble.

That’s the foundation of a safer digital world, built one calm, aware, disciplined human at a time.

Security Without the Skepticism: Password Managers – Modern-Day Trust Issues in a Zero-Trust World

Trusting the One Tool Rule Them All

Cybersecurity presents a paradox: we are taught to be wary of everyone online, yet we’re expected to trust one application with all our passwords.

That’s a BIG ask.

Password managers claim to offer both convenience and security. They eliminate the need for sticky notes, memory tricks, and risky repeated logins. Yet, handing over the credentials to your digital life may feel risky, as if you’re leaving your house key under someone else’s doormat.

Even people who are good with technology feel this hesitation. Trusting one place with everything can seem like putting all your eggs in one basket.

How Password Managers Actually Work

At their best, password managers create a secure vault for your passwords. This vault is protected by a master password that only you know.

They use zero-knowledge encryption, so even the company that stores your vault cannot see your data.

That’s how it’s supposed to work. In reality, people hesitate because of things like:

  • High-profile breaches (e.g., LastPass, 2022)
  • Syncing fears (“What if my vault gets intercepted?”)
  • Human error (“What if I forget my master password?”)

Even though the underlying technology is strong, public trust wavers each time a major breach is reported. People remember negative headlines more than encryption details.

Control vs. Convenience

Using a password manager isn’t just a technical choice; it’s also a psychological one.

Humans like to be in control, especially when it comes to security. We equate manual effort with safety. Typing passwords ourselves feels safer than letting software do it, even when we know the software is objectively smarter than we are.

However, for many, convenience ultimately prevails: after trying a password manager, the newfound ease often surpasses early distrust.

This dynamic shows that modern security requires balance: people want independence, but security improves with some delegation to trusted tools.

When Trust Breaks Down

No password manager is immune to risk, but relying on weaker alternatives such as reused passwords or predictable patterns leaves you even more vulnerable. Minimizing trust is about minimizing risk, not eliminating it.

If a vault provider is breached, attackers still face encryption. But if you reuse one password across five sites, there’s no barrier at all.

So, it’s less about trusting the tool absolutely, and more about managing where that trust sits:

  • Choose providers with open security audits.
  • Enable MFA on your vault.
  • Keep the master password offline, not saved, not synced.

The core issue isn’t the tool itself, but the risk of blind faith. Sometimes, people subconsciously seek blind faith from such tools.

Zero-Trust Starts with You

Zero-trust isn’t just a corporate buzzword; it’s a mindset. Assume every system can fail. Build layers so failures aren’t fatal.

For password managers, apply zero-trust this way:

  • Separate critical credentials (server logins, service accounts, etc.) from general logins.
  • Regularly export and back up encrypted copies to an offline location.
  • Keep MFA active everywhere.

Aim for persistence and resilience, not perfection.

Culture Over Blame

We often criticize people for using sticky notes, but we don’t always show them better ways.

Security maturity grows when using a password manager feels normal, not nerdy. Encourage colleagues and family to use them and to question them. Healthy skepticism keeps systems honest.

A culture of curiosity always beats compliance.

Final Thought

Zero-trust is about choosing where to place your trust, not avoiding it altogether. Good judgment is at the heart of modern security.

Password managers aren’t a magic fix. They’re just one important layer of security, and they work well if you stay alert.

In the end, good security comes from making careful, informed choices about trust, not just believing in technology without question.

That’s not being skeptical, that’s working to overcome modern-day trust issues in a zero-trust world.

Security Without Pessimism: Shadow IT – When Convenience Becomes a Security Risk

The Shortcut That Became the Standard

We’ve all done it.

You’re trying to get something simple done, but the company’s “official” tool takes six steps and two approvals just to open a project. So, you find a better one, quicker, cleaner, easier.

Maybe it’s a shared Google Sheet, a new messaging app, or some AI productivity tool that actually works. It saves you time, gets results, and honestly, no one seems to mind.

That is, until someone finally notices.

That’s Shadow IT, the silent, well-intentioned workaround that slowly turns into a security liability.

The issue isn’t carelessness; it’s the drive for efficiency.

The Anatomy of Shadow IT and How It Slips Through

Shadow IT doesn’t begin as an act of rebellion. It starts as a way to get things done.

Teams feel pressure, tools are slow, and company processes can’t keep up. So, someone tries a new tool that bends the rules, just for this one time.

That quick fix gets shared with others and soon becomes the usual way of doing this.

Before long, company data is moving through several tools that no one has officially approved:

  • Free cloud drives with no encryption.
  • Personal accounts are used for client data.
  • Messaging platforms without audit trails.
  • Chrome extensions quietly sync user info to external servers.

It’s not done out of malice; it’s just human nature. People pick what helps them get the job done. But each time we choose convenience over control, we lose sight of what’s happening.

Why Good People Go Rogue

Most shadow IT isn’t about breaking rules. It’s about finding better ways to work.

People want to do their jobs well. When approved systems slow them down, they look for alternatives. This creativity isn’t careless, but it can still be risky.

Most people don’t focus on compliance when facing a tight deadline. They focus on getting results.

Here’s the problem: attackers know this. They rely on busy teams taking shortcuts, creating unmonitored accounts, or storing data in places that go unnoticed.

Shadow IT doesn’t look like rule-breaking. It looks like taking initiative.

When Visibility Vanishes

Each unapproved app creates another potential risk.

Security teams can’t track data, fix vulnerabilities, or control access. Soon, they may not even know what needs protection.

If something goes wrong, you can’t protect what you can’t see. A hacked third-party app or a compromised account can quietly put the whole system at risk.

Shadow IT isn’t a single big mistake. It’s many small, hidden problems. By the time someone notices, it’s often too late to trace the cause.

Balance Control with Capability

The solution isn’t to make things stricter. It’s to make official tools easier to use.

Security should support people in their actual work, not just follow what policy says.

Here’s what helps:

  • Simplify the approved stack. If it’s painful to use, it’s already compromised.
  • Create a “request to innovate” process. Let employees suggest tools safely.
  • Shadow IT discovery audits. Not witch hunts — open conversations.
  • Default to transparency. Make it normal to say, “I’m testing this app” without fear.

The aim is partnership, not strict control. If security punishes creativity, people will just hide what they’re doing. Problems will still find a way through.

Building Trust Around Tools

You can’t get rid of Shadow IT by being strict. The only way is to build trust instead of secrecy.

If people think speaking up will get them in trouble, they’ll stay silent. But if they see it as a chance to work together, you’ll know what’s really happening.

The best workplaces see curiosity as a strength, not a risk. Security and innovation aren’t enemies; they work together toward the same goal.

Final Thought

Shadow IT isn’t caused by bad people. It happens when good intentions don’t fit with strict systems. For security to keep up with creativity, it needs to act as a guide, not just a gatekeeper.

That’s not being pessimistic. That’s reality and an opportunity to get better, together.

The Art of Cyberwar | Part I | The Illusion of Truth

The principle:
All warfare is based on deception. —Sun Tzu

In warfare, there’s a certain irony in how often truth becomes a casualty before the first shot is ever fired. As an American, that line from The Art of War has always carried extra weight. Our history is full of moments when deception wasn’t just a tactic on the battlefield; it was the spark that lit the fuse.

From the smoke and mirrors of the Spanish-American War to the Gulf of Tonkin and the blurred motives of the Gulf Wars and the Global War on Terrorism, we’ve seen how perception shapes permission. Wars don’t always start because one side is stronger; they start because one story feels true enough to believe.

And since “All warfare is based on deception,” Sun Tzu went on to say:

When you’re able to attack, you must appear unable. When using our forces, we must seem inactive. When we are near, we must make the enemy believe we are far away. When we’re far away, we must make him believe we are nearby.

We must hold out bait to entice the enemy and then crush him. If he is superior in strength, evade him. If your opponent is overconfident in nature, seek to provoke him. Pretend to be weak, so that he may grow arrogant and attack when he otherwise wouldn’t. Attack him where he is unprepared, appear where you are not expected. If he is trying to take rest and recover, give him no rest. If his forces are united, divide them.

The general who loses a battle has made only a few calculations beforehand. Thus, many calculations lead to victory, and making only a few calculations ensures defeat. By paying attention to these points, I can foresee who is likely to win or lose.

Deception as Strategy

The principles articulated by Sun Tzu extend beyond the battlefield to broader strategic contexts. His observations highlight the value of misdirection for leaders and strategists. The objective is not to create disorder, but to control perception and attention. In both conventional warfare and digital security, success frequently depends on understanding the adversary’s perception of reality. This principle underpins the effectiveness and prevalence of social engineering tactics.

Contemporary deception strategies have shifted focus from traditional military maneuvers to achieving information dominance. Modern tools include manipulated narratives, deepfakes, phishing campaigns, propaganda, and misinformation. These methods target cognitive processes rather than physical harm. Once individuals accept misinformation as truth, further manipulation becomes significantly easier. The Committee on Public Information, the United States’ World War I propaganda agency, exemplifies institutionalized information control.

Cybersecurity’s Ethical Deception

In cybersecurity, deception is employed with the intent to enhance defense mechanisms. Techniques such as honeypots attract attackers, sandbox environments facilitate malware analysis, and red team exercises simulate adversarial tactics to maintain robust security postures.

In this context, deception functions as a defensive measure rather than an offensive tool. It is utilized to identify vulnerabilities rather than to exploit them. The underlying principle that can mislead a nation may, when applied ethically, serve to protect it. The distinction lies in the intent: defense and awareness as opposed to manipulation and illusion.

Both approaches depend on psychological insight and require strategic foresight. However, only defensive deception is fundamentally grounded in ethical integrity.

The Martial Mirror

Martial artists understand deception in its purest, most physical form. A feint isn’t a lie, it’s a question. In Wing Chun, they’re called “asking hands.” You draw your opponent’s attention, focus and/or movement one way to reveal where they’re vulnerable. The best fighters aren’t those who hide, but those who read intent faster than it’s shown. It’s why attacks on the halfbeat are so effective. But, that’s a lesson for another time.

Cybersecurity employs similar principles. Confrontation is not always optimal; instead, threats are redirected, absorbed, or neutralized preemptively. The discipline emphasizes anticipating patterns before they fully emerge, rather than merely reacting. This approach is often described as the art of fighting without fighting.

The Modern Maxim

“Deception reveals more than it hides, it shows what we most want others to believe.”

In this context, each act of deception simultaneously reveals underlying motives, strategies, and tactics.

For those responsible for safeguarding systems, individuals, or factual accuracy, the task often begins where clarity diminishes. The primary challenge is not to eliminate deception entirely, but to recognize and understand it without compromising ethical standards.

The initial action in any conflict, whether digital, physical, or psychological, is seldom a direct attack; it is often the creation of a narrative to tell. The essential responsibility is to accurately identify threats based on objective analysis, rather than relying solely on presented information. Illustrating the everlasting importance of learning the principle of this story: All warfare is based on deception.

Strength & Resilience: Why Chaos Is the Real Teacher

henry rollins matt shannon cloud security
The Iron Never Lies — Henry Rollins

High-intensity training is humbling. Fatigue strips away polish and shows where your skills really break down. As the old saying goes, “the iron never lies,” and neither does the clock. Chaos reveals the gaps.

We like to think we’re smooth and calm under pressure, until that pressure arrives. The same principle applies whether you’re under a heavy barbell, in the final round of a sparring session, or defending a network: stress exposes your true level of expertise.

In a breach, system failure, or when your team runs on caffeine and instinct, you see what you practiced well and where things collapse.

Here’s why training under ideal conditions often lets us down, and why we must look beyond comfort:

How to Train for Chaos
* Red-team drills. Simulate unexpected, worst-case attacks, not the ones you anticipate.
* Tabletop exercises. Practice response under a running clock; short timeframes sharpen decisions.
* Fatigue training. Follow the playbook while tired, short-staffed, or distracted because reality won’t wait or be kind.

Training in perfect conditions makes you comfortable, but it doesn’t make you stronger. You build real resilience when things get tough and you keep going anyway. Always strive to step out of your comfort zone.

The goal isn’t perfection but adapting to exposure, building composure, and staying focused when plans collapse.

The Martial Parallel

Sparring isn’t about perfect technique; it’s about applying skills under unpredictable pressure. You rarely win every round, but you improve because chaos clarifies. If you win every round, find new partners! Progress demands resistance.

In cybersecurity, the same holds true. Incidents are sparring. They test you, which can be painful, but they can also be educational. You learn to breathe, recognize patterns more quickly, react decisively, and stay calm when alarms go off.

Real strength isn’t proven in stillness; it’s proven in motion.
Resilience is forged where control slips away.

Progress Isn’t Linear, in Martial Arts or Cybersecurity

Progress isn’t linear. Martial artists learn this the hard way. One day you nail a three punch combo finished with a clavicle crushing elbow; the next, you stumble over the same movement combination you were hitting regularly just a couple days before. Some weeks, you level up quickly, while others days you’ll hit stumbling blocks. Always approach your wins and losses with the same humility.

Cybersecurity follows the same rhythm. Just as martial artists face setbacks, security professionals experience their own ups and downs. You patch systems, close vulnerabilities, and tighten configurations. Then a new zero-day vulnerability emerges, or an audit reveals previously unaddressed blind spots. It feels like sliding backward.

musashi

That slide isn’t a failure, it’s where progress truly forms.

The Myth of Linear Progress

We often imagine progress as, although slow, always moving upward. Reality is less predictable.

  1. Perfection Bias
    We assume improvement should always feel smooth. However, mastery, in both martial arts and cybersecurity, is a jagged path. The dips are where the depth develops.
  2. The Comparison Trap
    We see others’ highlight reels, the black belt breaking boards, or the company posting its “zero vulnerabilities” report, and mistake it for constant progress. Behind every clean result lies a mess of mistakes, patches, and failed tests.
  3. Forgetting That Setbacks Build Strength
    Regression often signals deeper adaptation in progress. In training, it’s when you refine mechanics. In security, it’s when you reinforce foundations.

Why Steps Back Matter

Plateaus and regressions aren’t detours; they’re checkpoints. They test persistence. Anyone can stay motivated when everything goes as planned; resilience forms when it doesn’t.

They reveal gaps in fundamentals. A failed pen test or misconfigured IAM or conditional access policy highlights what needs real attention. They build humility and precision. Overconfidence blinds; setbacks sharpen focus.

On the mats and in the SOC, mastery isn’t about avoiding mistakes, it’s about learning faster from them.

The Cybersecurity Parallel

You don’t know what you don’t know so every incident teaches you something you didn’t know you needed to learn. Every vulnerability scan reveals details you may have overlooked. It isn’t failure. It’s your system adapting, like a martial artist’s mind & body.

A martial artist doesn’t quit after a rough sparring session. They analyze what went wrong, refine their techniques, and return smarter & stronger. Security teams should do the same. A missed vulnerability isn’t a defeat; it’s a mirror. It can show you where your technique slipped & where to tighten your counter-offensive skills.

From the Mats to the Data Center

Both disciplines thrive on discipline, reflection, and repitition:

Training drills = Routine audits. Each repetition builds muscle memory for fighters and for security teams.

Pad work and shadow boxing = Playbooks and runbooks. Practicing in controlled settings builds confidence under pressure.

Sparring = Incident Response sims. You can’t simulate chaos perfectly, but you can train to be calm, and respond correctly, in chaos. That’s why you just keep training and doing reps over and over because each time your partner responds differently but you’re learning to respond with the correct technique every time.

Every repetition, every submission attempt, every punch, every kick, or incident response builds competence and confidence. Every CVE update, OWASP update or vulnerability scan creates visibility and awareness.

The Real Skill of a Black Belt: The Ability to Adapt and Overcome

In martial arts, the belt color doesn’t make you untouchable; it signifies you’ve learned and adapted more than others. In cybersecurity, it’s the same. The strongest organizations aren’t flawless; they’re mobile, agile and when necessary, hostile.

Adaptation beats perfection. Reflection beats reaction. Resilience beats your comfort zone. So the next time your scan lights up with new vulnerabilities or your red team exposes a blind spot, don’t get discouraged. It’s just another training session.

Final Thought

Progress, whether in close range combat or in your code, isn’t about avoiding setbacks. It’s about showing up again after them. The real win isn’t being unbreakable, it’s being unshakable.

Keep patching. Keep learning. Keep moving. Progress isn’t linear, but staying adaptive always drives you forward. Or, as it was once famously said, “Be water my friend.”

162 Hours on Udemy, Building the Foundation for a Career in Pentesting

When I first clicked “Enroll,” I didn’t know it would add up to 162 hours of training.
That’s almost a full month of time — stolen from late nights, weekends, and early mornings before work.

Like a lot of people breaking into cybersecurity, I started with curiosity and a mess of browser tabs. YouTube videos, Reddit threads, course recommendations. It’s easy to drown in the noise. What made the difference wasn’t just finding the right content, it was learning how to stay with it long enough for the dots to connect.

Udemy became my training ground. Not glamorous, not perfect, but consistent.
Over time, those 162 hours weren’t just “video time.” They became hours of repetition, frustration, and slow understanding.

There’s a phase in every learner’s path where you stop studying for a test and start thinking like the work.

That’s what those hours taught me, how to reason through a network like a puzzle, how to see the seams where systems and people meet, how to build patience in a field where curiosity is the only constant.

Looking back, those 162 hours weren’t just prep for certification. They were the price of entry, not into a career, but into a mindset.

Every scan that failed, every lab that wouldn’t load, every problem that took three days instead of three hours, they were all small rehearsals for the real work ahead.

And that’s the absolute truth about cybersecurity training: the time never feels fast, but it’s never wasted. You’re not just learning commands. You’re learning endurance. It’s the art of staying with a problem long enough to earn its answer.