The principles:
In all fighting, the direct method may be used for joining battle, but indirect methods will be needed in order to secure victory.
Indirect tactics, efficiently applied, are inexhaustible as Heaven and Earth, unending as the flow of rivers and streams; like the sun and moon, they end only to begin anew; like the four seasons, they pass away to return once more.
The Power of Controlled Motion
Sun Tzu’s fifth chapter deals with energy, not as brute strength, but as direct application of force.
He warned that a commander must know when to cultivate and store power and when to release it. Misapplied use of Energy burns itself out. However, when energy is focused, it bends the world to its will.
It’s an idea that translates effortlessly to today’s digital battlefield. Nations, like networks, often fail not because of a lack of capability, but because of a lack of control.
True mastery isn’t in how much force you can deploy. It’s in knowing how little you need to. It’s akin to the idea that, sure, you can kill a fly with a hammer, but is it the most effective tool at your disposal?
The Cost of Unchecked Energy
American Diplomatic and Military History is full of examples of lawmakers mistaking our capacity for clarity.
In Korea, overwhelming U.S. power pushed back North Korean forces, only to overextend toward China’s border and trigger an entirely new front. And thus, we have burdened ourselves with maintaining the “38th parallel” ever since.
In Vietnam, energy became inertia, force applied endlessly without definition, draining political and moral capital alike. If only the “peacemakers” at the Treaty of Versailles had let Ho Chi Minh deliver his speech on the Rights of Man, perhaps there would have been no quagmire in Southeast Asia to begin with. A guerrilla war that would take nearly 60,000 American lives and lead to what became known as the “Vietnam Syndrome.”
In Iraq, “shock and awe” demonstrated that a singular “tactical victory” can be swift, while a strategic victory remains elusive. Notwithstanding the entire list of false pretenses that led to the invasion of Iraq to begin with.
Each conflict began with a belief in momentum and ended with war fatigue. Demonstrating once again, force without direction always collapses under its own weight.
The lesson isn’t that force is wrong; it’s that force, when misapplied and unguided, becomes self-consuming. Power is not infinite. Neither is attention, money, or public trust.
The Cyber Equivalent: Sprawl and Burnout
Organizations repeat these same mistakes in digital form.
A breach occurs, and the reflex is to rush to acquire new tools, policies, and budgets, thereby triggering a cyberwar “surge.”
New dashboards, new alert monitoring, and new vendors lead to a surge in activity, while clarity plummets.
This is cyber energy without strategy, effort disconnected from insight.
As Sun Tzu also said: Amid the turmoil and tumult of battle, there may be seeming disorder and yet no real disorder at all; amid confusion and chaos, your array may be without head or tail, yet it will be proof against defeat.
Teams exhaust themselves chasing incidents instead of patterns. Leaders demand constant escalation, not realizing that perpetual crisis is its own vulnerability.
The result mirrors the national trap: motion is mistaken for genuine progress. The ability to endure is mistaken for endurance.
Energy as Rhythm, Not Frenzy
Sun Tzu described two forms of force:
- Normal energy — the steady discipline that sustains the fight.
- Extraordinary energy — the precise, unexpected burst that wins it.
In cybersecurity, the equivalent is security posture and precision in the application of policies.
Normal energy is the quiet work of patching, monitoring, and awareness training. Extraordinary energy is the calm, swift, and accurate incident response that turns chaos into closure.
Both are needed. But one cannot exist without the other. A team that never rests has no energy left to strike when it matters most.
It’s the same in martial arts.
In Wing Chun:
Normal energy = quality structure and energy sensitivity.
Extraordinary energy = the skill to deliver a singular, intercepting strike that ends the exchange.
Muay Thai:
Normal energy = footwork, guard, pacing.
Extraordinary energy = the slashing elbow, a stabbing teep, or perfectly placed knee.
BJJ:
Normal training energy = position, pressure, framing.
Extraordinary training energy = the ability to feel a submission triggered by feeling the opponent’s mistake. Or in Mandarin it’s an old idea called Wu Wei, or effortless action. Meaning, I don’t present the opportunity to attack; the enemy presents it to me, like water finding a leak in the dam.
A Security Team that never rests has no energy left for anything extraordinary.
Good CISOs, like good generals, good fighters, and good grapplers, understand rhythm. They know when to conserve strength so that action, when it comes, is clean and effective.
As Master Tzu also knew, “When he utilises combined energy, his fighting men become as it were like unto rolling logs or stones.” Leading to, … “the energy developed by good fighting men is as the momentum of a round stone rolled down a mountain thousands of feet in height. So important is the subject of energy.”
Diplomacy and the Misuse of Force
In diplomacy, the same physics apply. The U.S. has often wielded immense power but uneven patience.
Moments like the Marshall Plan and the Cuban Missile Crisis demonstrated the value of precision, employing limited force, clear objectives, and a proportional response.
But elsewhere, the misapplication of force became diplomatic impotence on full display. Prolonged occupations and open-ended interventions constantly drain strategic reserves of will and trust.
Every drone strike, every unconstitutional data collection program, every new cyber warfare doctrine carries a similar risk: that power’s convenience will overshadow its consequence.
The Taoist counterpoint from Lao Tzu still resonates to this day:
“He who knows when to stop never finds himself in trouble.”
Knowing when not to act is the highest use of force. It’s the difference between control and compulsion.
The Lesson for Cyber Strategy
A strong digital defense isn’t constant action, it’s intelligent action.
Practical translation:
- Automate the repeatable.
- Escalate only with context.
- Protect attention as aggressively as data.
- Reserve extraordinary effort for extraordinary situations.
Energy mismanaged becomes sprawl. Energy focused becomes resilience.
It’s never the size of the arsenal. It’s the precision of the response.
Momentum and the Myth of Constant Action
Modern life rewards constant motion, refresh, respond, and reply.
In cybersecurity and foreign policy alike, stillness feels dangerous to the untrained mind.
But strategy lives in the pause between movements. Quality fighting skills are always more effective when you can strike on the half-beat, a fundamental separator on the mats, and on digital and physical battlefields.
Force has a short half-life. When it’s used endlessly, it decays quickly and fades into the ether. When it’s reserved for the right moment, it changes everything.
A breach contained quietly is often a bigger victory than a public takedown.
A crisis de-escalated without violence often preserves more stability than any show of strength.
Knowing When to “Flow With the Go”
As one of the greatest living legends in Brazilian Jiu-Jitsu, Rickson Gracie once said, “In Jiu Jitsu we flow with the go.”
Meaning:
- don’t fight force with tension
- stay aware but not trapped by focus
- stay smooth and adaptive
- flow with the opponent’s energy
- let well-trained instinct and structure guide you
That metaphor fits the digital era perfectly. The best blue or purple teamers, like the best leaders, don’t fight the current; they learn to read it and swim with it, not against it.
Lao Tzu would say that “the soft overcomes the hard,” not through weakness but adaptability. Force channeled through awareness is stronger than force spent in anger.
In warfare and cybersecurity alike, energy is a currency. Spend it recklessly and you’ll be empty when it matters. Spend it wisely and you’ll be leading on the battlefield.
Final Reflection
Knowing how to use force is knowing its limits.
Sun Tzu and Lao Tzu shared the same truth from opposite angles:
Power must be balanced by patience.
Energy must be stored as much as it is spent.
History punishes those who forget this. So does network and security architecture.
The art isn’t in using force; it’s in knowing when the situation calls for little, none, or overwhelming force.
That’s not mysticism. That’s strategic maintenance. And it’s as accurate in security architecture as it is on the battlefield.
All of these lessons point us directly back to our opening principles: “In all fighting, the direct method may be used for joining battle, but indirect methods will be needed to secure victory.” And, “Indirect tactics, efficiently applied, are inexhaustible as Heaven and Earth, unending as the flow of rivers and streams; like the sun and moon, they end only to begin anew; like the four seasons, they pass away to return once more.
The wise strategist learns to move the same way.
Matt Shannon, Security Pro 