Tag: security

First Principles of Cybersecurity: Essays on Leadership, Trust, and Organizational Maturity – Part II

First Principles of Cybersecurity Essays on Leadership, Trust, and Organizational Maturity -- MattShannonSecurityPro.com

Leadership Is a Security Control

The Environment Leaders Create Determines the Level of Security Their Organizations Achieve

Ask ten security professionals to name the most important security controls in a modern organization, and the answers will sound familiar. Multi-factor authentication. Endpoint detection and response. Network segmentation. Encryption. Vulnerability management. Security awareness training.

None of those answers is wrong. Each represents a critical layer in a mature security program.

Yet they all share a common characteristic: they are downstream of another control that receives far less attention but influences every one of them..

Leadership.

This may seem like an unusual assertion. Leadership does not appear on a network diagram. It cannot be licensed, deployed, or patched. It generates no alerts and produces no dashboard filled with metrics. Yet every meaningful security decision within an organization is ultimately shaped by leadership. Before a firewall is purchased, before a policy is written, before an employee completes awareness training, someone has already decided that security matters—or that it does not.

That decision is leadership in action.

Every Organization Is Perfectly Designed to Produce Its Security Culture

There is a saying often attributed to systems theorist W. Edwards Deming: “Every system is perfectly designed to get the results it gets.” Whether or not those were his exact words, the principle remains instructive.

Security culture is no exception.

Organizations rarely arrive at their security posture by accident. Rather, it emerges from thousands of decisions made over time. These are decisions about priorities, incentives, resources, accountability, and acceptable risk. Employees learn what truly matters not by reading policies, but by observing leadership.

If executives insist on secure practices even when they create inconvenience, employees notice.

If managers routinely ask teams to “just make it work” regardless of established procedures, employees notice that, too. Culture is not built through declarations. It is built through repetition.

Leadership determines what is repeated.

According to the 2024 Verizon Data Breach Investigations Report, over 80% of breaches involved a human element, highlighting that culture, behavior, and leadership are as critical as any technical control.

The Strongest Policies Cannot Overcome Weak Priorities.

Many organizations invest considerable effort in writing comprehensive security policies. These documents establish expectations, define responsibilities, and provide consistency across the enterprise. They are necessary.

They are also insufficient. A policy reflects what an organization says it values. Leadership reveals what it actually values.

Consider two organizations with identical password policies.

In the first, executives follow the same authentication requirements as everyone else, allocate time for security training, and treat security concerns as legitimate business discussions. In the second, executives routinely request exceptions, postpone security projects in favor of short-term operational gains, and regard cybersecurity as primarily the IT department’s responsibility.

On paper, the organizations appear identical. In practice, they are fundamentally different.

Policies establish direction and leadership establish credibility.

Employees are remarkably adept at distinguishing between the two.

Leadership Defines Acceptable Risk

One of the most misunderstood aspects of cybersecurity is the belief that the objective is to eliminate risk. It’s not. Every organization accepts risk. The question is whether those decisions are deliberate or accidental.

Leadership determines where that line is drawn. When a board approves funding for identity modernization rather than postponing the investment for another year, it is making a security decision.

When a superintendent supports temporary operational disruption to remediate a critical vulnerability rather than accepting unnecessary exposure, that is a security decision.

When an executive asks not only, “What will this cost?” but also, “What risk does this reduce?” security has become part of organizational decision-making rather than an afterthought.

Security professionals identify and communicate risk. Leadership determines which risks are acceptable.

These responsibilities are distinct, but inseparable.

Trust Is a Preventive Control

Technical controls prevent malicious activity, and leadership often prevents organizational failure.

Employees who trust their leaders report mistakes sooner. They ask questions before making assumptions. They admit uncertainty before uncertainty becomes an incident.

Conversely, organizations that punish honest mistakes often create an environment where employees hide them. The initial phishing email is rarely what causes the greatest damage.

Silence does.

Trust is therefore more than an abstract leadership quality. It is a practical security control that shortens response times, improves communication, and encourages the reporting behaviors upon which effective incident response depends.

Organizations frequently invest millions of dollars in detection technologies while overlooking one of the simplest ways to improve detection: creating an environment where people feel safe speaking up.

Technology Scales Capability. Leadership Scales Behavior.

Technology can authenticate identities, encrypt data, detect anomalies, and automate countless security functions. It can’t establish priorities, create accountability, model integrity, or build trust. Only leadership can accomplish those things.

This is why organizations with modest security budgets, but disciplined leadership often outperform organizations possessing sophisticated technologies but inconsistent governance. The difference is not the tools themselves. It is the environment in which those tools operate.

Technology amplifies capability and leadership amplifies behavior. Given enough time, behavior almost always proves to be the more influential force.

Actionable Steps for Leaders

  • Model security behaviors consistently at every level of the organization.
  • Integrate risk discussions into executive decision-making, not just technical reviews.
  • Foster a culture of psychological safety so employees feel comfortable reporting mistakes and asking questions.
  • Align security policies with actual business practices—avoid policies that are routinely bypassed.
  • Invest in both technology and leadership development to scale capability and culture in tandem.

Final Thoughts: Leadership as the First Control

It is tempting to think of cybersecurity as something managed by the security department. Firewalls belong to network engineers. Endpoint protection belongs to security analysts. Policies belong to governance teams.

Leadership belongs in every decision.

Every decision about priorities, every allocation of resources, every conversation about acceptable risk, and every example set by those entrusted to lead either strengthens or weakens the organization’s security posture.

For that reason, leadership should not be viewed merely as support for cybersecurity.

It should be recognized for what it is.

The first security control.

Key Takeaways:

  • The downstream effects of leadership shape every aspect of an organization’s security posture.
  • While policies and technology matter, leadership determines how they are valued, implemented, and, more importantly, enforced.
  • Trust and culture are practical security controls that improve incident response and reduce risk.
  • Consistent, visible prioritization of security by leaders is more influential than any single technical investment.
  • Security is ultimately a human endeavor, and its success is determined by the actions and environment set by those who lead.
  • This perspective is echoed by leading frameworks, NIST CSF and ISO 27001, which position governance and leadership at the foundation of resilient security programs.

The technologies organizations deploy may change. The threats they face certainly will. But the principle remains constant: every security program ultimately reflects the leadership that built it.

Leadership, then, is not merely support for security; it’s the foundation.

First Principles of Cybersecurity: Essays on Leadership, Trust, and Organizational Maturity – Part I

The Hidden Cost of Convenience in Cybersecurity

Why Intelligent People Circumvent Security,
and What Mature Organizations Do About It

Walk into almost any classroom in the country at the beginning of a new school year, and you’ll witness controlled chaos.

Teachers are preparing lesson plans, organizing classrooms, responding to parents, configuring technology, attending meetings, and welcoming a new group of students, all before the first bell ever rings. The pace is relentless, and every minute matters.

Now imagine walking past a cart of student Chromebooks and noticing something unexpected.

A small adhesive label with a student’s name, username, and password affixed directly to the device.

At first glance, it’s easy to criticize the practice. After all, writing credentials on the very device they’re intended to protect undermines one of the most fundamental principles of information security.

But if that’s where the conversation ends, we’ve learned very little. The more interesting question isn’t why someone ignored security.

The better question is: Why did this feel like the best solution in the first place?

That distinction matters because mature cybersecurity is not built by identifying mistakes. It is built through understanding the conditions that make those mistakes seem reasonable.

Intelligent People Rarely Choose Insecurity

One of the most persistent misconceptions in cybersecurity is the belief that policy violations emanate primarily from ignorance, carelessness, or indifference.

In reality, most people are trying to do exactly what they’ve been hired to do. Teachers are trying to teach. Nurses are trying to care for patients. Engineers are trying to deliver systems. Executives are trying to lead organizations. Their objective is not to violate policy.

Their objective is to accomplish meaningful work. When security introduces unnecessary friction into that work, people naturally begin searching for ways to reduce it. Not because they oppose security. Because they are optimizing for progress. The sticky note wasn’t malicious. It was an optimization.

Unfortunately, it optimized the wrong variable.

The Path of Least Resistance

Human beings are remarkably consistent. When presented with multiple ways to accomplish the same objective, we tend to choose the one that requires the least effort. Behavioral psychologists have studied this phenomenon for decades. Economists describe it through concepts like bounded rationality and mental effort. Engineers simply recognize it as good design.

Cybersecurity often forgets it entirely.

Organizations frequently assume that if policies are written clearly enough, people will simply follow them. Experience suggests otherwise. People generally follow the path that requires the fewest decisions, the least interruption, and the least additional effort. That’s not laziness, it’s human nature.

Every unnecessary step added to a security process becomes another opportunity for someone to find a shortcut. And shortcuts have a way of becoming habits.

The Difference Between Immature and Mature Security Programs

Immature organizations respond to incidents by writing another policy. Mature organizations ask a different question.

Why did this make sense to someone?

That question shifts the conversation from blame to design. Consider the classroom example.

Should passwords remain private? Absolutely.

Should credentials ever be attached directly to a device? Of course not. But stopping there ignores the larger lesson. Why did an experienced educator, someone strongly dedicated to their students, conclude that this was the most practical solution?

Perhaps student onboarding was cumbersome. Perhaps the process required frequent password retrieval.

Perhaps the system created more friction than necessary during one of the busiest weeks of the year. Those possibilities deserve just as much attention as the policy itself. Because good security doesn’t merely tell people what not to do. It makes the secure choice the wise choice.

Security Culture Is a Design Problem

Culture is often described as shared values or shared beliefs. In cybersecurity, culture is better measured using shared behaviors. Those behaviors are influenced less by slogans than by systems.

When secure behavior is intuitive, people adopt it naturally. When secure behavior consistently slows people down, even well-intentioned professionals begin inventing workarounds.

The problem isn’t that people prefer convenience. The problem is when convenience and security are placed in opposition to one another. Strong organizations refuse to accept that tradeoff.

Instead, they ask: “How can we design systems where the secure path is also the easiest path?”

That question signifies a profound shift in thinking. Rather than expecting people to overcome human nature, mature organizations design with human nature in mind.

Leadership Beyond Technology: Setting Security Culture by Example

This principle extends far beyond passwords. In practice, organizations sometimes hard-code credentials because rotating them seems cumbersome. Employees reuse passwords because managing dozens of unique ones is impractical without support. Executives may bypass established processes they perceive as slow, sometimes even advocating for policies they themselves neglect. These behaviors highlight how security actions, good or bad, are shaped by leadership priorities and organizational culture.

Frameworks like Zero Trust (ZT) and NIST’s Cybersecurity Framework (CSF) both emphasize the importance of aligning policies and controls with real-world workflows. For example, Zero Trust encourages the principle of ‘never trust, always verify’, but it also emphasizes minimizing user friction by making secure access seamless. Similarly, NIST CSF calls for continuous improvement and adaptation to actual business context, including user experience, as a critical part of protecting information.

A 2024 Verizon Data Breach Investigations Report found that over 80% of breaches involved a human element, whether through error, misuse, or social engineering. This underscores the need to design security with people, not just technology, in mind.

Consider the widely publicized 2023 MGM Resorts breach: attackers gained access not through a technical exploit, but by manipulating an employee via social engineering. The aftermath highlighted both the human cost of poor security design and the value of resilient, well-communicated processes. Mature organizations study such incidents to inform better system and workflow design, not just to enforce stricter rules.

None of these behaviors are unique to education. They are remarkably consistent across industries. Whether it’s healthcare, finance, manufacturing, government, or cloud engineering, it’s the same.

Technology changes, human behavior does not. This is why effective cybersecurity leaders spend as much time understanding organizational behavior, workflow design, and communication as they do learning about technology. Firewalls protect networks, encryption protects data, identity platforms protect access, and leadership shapes behavior.

And behavior, modeled first by leadership, ultimately determines whether those technologies succeed.

Designing for Reality

There is an old saying in engineering: “Don’t design for perfect conditions. Design for the conditions that are the reality.”

Cybersecurity deserves the same mindset. People work under the pressure of deadlines. And many humans are easily distracted.

They make mistakes. They focus on competing responsibilities. Expecting otherwise isn’t leadership. It’s wishful thinking. The strongest security programs acknowledge these realities and build systems that accommodate them.

Not by lowering standards. By lowering unnecessary friction. Good security accounts for human behavior. Great security aligns human behavior with enterprise intent. That is where security culture begins.

Actionable Steps for Leaders:

  • Review critical workflows for unnecessary security friction; streamline processes where possible. Invest in user-friendly identity and access management platforms that support secure, seamless authentication (e.g., password managers, SSO).
  • Regularly communicate the ‘why’ behind security policies and invite feedback from end users.
  • Model secure behaviors at the leadership level; visible adherence by executives sets cultural expectations.
  • Align technology investments with both security best practices (ZT, NIST) and the realities of day-to-day business operations.

Final Thoughts: Designing for Humans

Key Takeaways:

  • Security workarounds are rarely due to ignorance; they’re often rational responses to unnecessary friction.
  • Mature organizations design security systems that align with natural human behaviors and incentives.
  • Leadership sets the tone—when executives model secure, user-friendly practices, security culture flourishes.
  • Frameworks like Zero Trust and NIST CSF emphasize the importance of user experience and continuous improvement.
  • The most resilient organizations prioritize systems that help people succeed, not just avoid failure.

The sticky note attached to the Chromebook was never really about the sticky note. It’s an example that every decision in a security environment reflects a larger system of incentives, constraints, priorities, and, mostly, habits.

More often than not, systems fail because they ask ordinary people to behave in extraordinary ways. Technology rarely fails first. People rarely fail first. The most resilient organizations understand this. They don’t build security around an idealized version of human behavior. They build it around reality.

Because in the end, cybersecurity isn’t simply about protecting systems. It is the discipline of building systems that help people succeed. And perhaps that is the deeper lesson.

Convenience isn’t the enemy of security. Poor design is.

Or, said another way, Strong security cultures are not built by asking people to overcome human nature. They are built by knowing human nature well enough to design systems that coordinate convenience with security.

Zen and the Art of AWS Security Domain 6: Security Foundations and Governance | Holding the Line Without Rigidity


“When the structure is sound, movement becomes effortless.”

Most people expect security foundations and governance to be boring. Policy documents. Checklists. Frameworks. Meetings.

AWS, and seasoned security architects, know better.

Security Foundations and Governance are not about control. They are about alignment.

They are what allow everything else, detection, response, infrastructure, identity, and data protection, to function without friction. This is why Domain 6 exists. And why it quietly determines whether every other domain succeeds or fails.

1. What AWS Means by “Security Foundations”


AWS does not treat security foundations as a product or a service. They treat them as operating conditions.

Security foundations answer questions like:
• Who is responsible for what?
• How are decisions made?
• How do we know when something is “secure enough”?
• How do we scale security without slowing delivery?

In AWS terms, foundations are built on:

• Shared Responsibility
• Well-Architected principles
• Standardized controls
• Continuous improvement
• Clear ownership

If those are missing, everything else becomes reactive.

Key Takeaway: On the exam and in real life, assume security foundations are always present, not optional. If a question describes a scenario with ambiguous responsibility, pause and seek alignment before acting.

2. The Shared Responsibility Model: The First Gate

Every AWS security exam, especially the Security Specialty, tests one thing relentlessly: Do you understand what AWS secures…and what you must secure yourself?

    AWS is responsible for:

    • Physical data centers
    • Underlying hardware
    • The cloud infrastructure itself

    You are responsible for:

    • Identity and access
    • Network controls
    • Data protection
    • OS and application security
    • Configuration

    Governance begins the moment you clearly accept that responsibility.

    Most real-world failures, and many exam traps, happen when responsibility is blurred.

    3. Governance Is How You Scale Trust

    Governance is not about saying “no.” It’s about creating guardrails so teams can move quickly without breaking things.

      AWS governance relies on:

      • AWS Organizations
      • Service Control Policies (SCPs)
      • Account separation
      • Tagging standards
      • Centralized logging and monitoring
      • Defined escalation paths

      Exam cue: If AWS wants you to prevent risky behavior without managing individual permissions, the answer is almost always SCPs.

      Governance operates above IAM, not instead of it.

      4. Well-Architected Security Pillar: The Quiet Backbone

      The AWS Well-Architected Framework is foundational to this domain.

        The Security Pillar emphasizes:

        • Strong identity foundations
        • Traceability
        • Infrastructure protection
        • Data protection
        • Incident response

        You’ve already studied all of these.

        Domain 6 exists to show how they fit together.

        AWS wants you to think:

        • Holistically
        • Long-term
        • With trade-offs in mind

        On the exam, this shows up as:

        • “Which solution is the most scalable?”
        • “Which approach reduces operational overhead?”
        • “Which option aligns with AWS best practices?”

        Governance favors simplicity, repeatability, and clarity.

        5. Policies, Standards, and Automation

        In AWS, policy without automation is aspirational. Automation without policy is dangerous.

          Strong governance includes:

          • Infrastructure as Code (CloudFormation, Terraform)
          • Automated security checks
          • Preventive controls (SCPs, Config rules)
          • Detective controls (GuardDuty, Security Hub)
          • Corrective actions (Lambda-based remediation)

          Exam cue: If the question says, “ensure compliance continuously”, the answer involves automation, not manual review. Governance is what turns security into a system, not a on-going project.

          Top 3 Exam Gotchas: Domain 6

          1. Over-relying on IAM and neglecting the power of Service Control Policies (SCPs) for organization-wide governance.
          2. Focusing on manual reviews instead of leveraging automation for continuous compliance.3. Choosing the most restrictive answer on the exam rather than the one that balances security, cost, and operational impact.
          3. Key Takeaway: The “safe” answer is not always the correct one—look for governance and automation at scale.

          6. Risk Management: Choosing, Not Eliminating

          AWS does not expect you to eliminate all risk.

          They expect you to:

          • Identify it
          • Understand it
          • Accept, mitigate, or transfer it intentionally

          This is why governance includes:

          • Risk registers
          • Compliance mappings
          • Business context
          • Cost-awareness

          On the exam:

          The “best” answer is rarely the most restrictive one. It is the one that balances security, cost, and operational impact.

          Scenario Example: Rapid Growth, Real Governance

          In 2024, a fintech company went from 10 to 60 AWS accounts in under six months. Security needed to prevent resource creation outside of approved regions and enable GuardDuty everywhere automatically.

          Best Approach: The team used AWS Organizations to apply SCPs for region lockdown, combined with automated account bootstrapping scripts that enabled GuardDuty by default. This solution leveraged automation and organizational guardrails—demonstrating mature, real-world AWS security thinking.

          Key Takeaway: AWS rewards answers that use policy-driven, automated, and scalable solutions, exactly as in this scenario.

          7. The Martial Parallel: Structure Enables Freedom

          In martial arts, beginners see rules as limitations.

            Advanced practitioners see them as:

            • Stability
            • Efficiency
            • Freedom under pressure and much more

            A strong stance doesn’t restrict movement; it enables it. Security foundations work the same way.

            When governance is clear:

            • Teams move faster
            • Incidents resolve cleaner
            • Mistakes are contained
            • Learning compounds

            When governance is weak:

            • Everything feels urgent
            • Security becomes adversarial
            • Teams work around controls instead of with them

            8. Exam Patterns for Domain 6

            Here’s how AWS tests this domain:

            • Account-level controls → AWS Organizations + SCPs
            • Preventing risky actions globally → SCPs
            • Balancing speed and security → Guardrails, not micromanagement
            • Scaling security → Automation and standardization
            • Aligning with best practices → Well-Architected Framework

            If the question asks:

            “Which solution is easiest to manage at scale?”

            Exam cue: Choose the centralized, automated, policy-driven option.

            Final Capstone: The Six Domains as One System

            Let’s put it all together.

            Domain 1 — Detection
            See clearly. You can’t secure what you can’t observe.
            Detection creates awareness and prevents surprise.

            Domain 2 — Incident Response
            Move decisively without panic. Preparation and clarity turn chaos into choreography.

            Domain 3 — Infrastructure Security
            Shape the terrain. Segmentation, isolation, and least exposure reduce blast radius before attacks happen.

            Domain 4 — Identity and Access Management
            Decide who can act. Identity is the new perimeter. Precision here determines everything else.

            Domain 5 — Data Protection
            Guard what truly matters. Encryption, key management, and lifecycle controls protect the mission itself.

            Domain 6 — Security Foundations and Governance
            Hold the line without rigidity. Governance aligns people, process, and technology into a system that scales.

            The Quiet Truth at the Center of AWS Security

            AWS security is not about fear.
            It is not about heroics.
            It is not about locking everything down.

            It is about clarity, balance, and intention.

            The exam rewards those who:
            • Pause before reacting
            • Think in systems, not silos
            • Choose scalable solutions
            • Respect trade-offs
            • Trust structure over force

            That’s Zen. That’s architectural mastery. You’re ready.

            When you sit for the exam, remember:
            Awareness first.
            Structure second.
            Action last.

            Everything else follows naturally.

            Verification & Citations Framework | “Leave No Doubt”

            Primary AWS Sources to Reference:

            • AWS Shared Responsibility Model
            • AWS Well-Architected Framework (Security Pillar)
            • AWS Organizations Documentation
            • Service Control Policies (SCPs)
            • AWS Security Best Practices Whitepaper
            • AWS Security Specialty Exam Guide (Domain 6)

            Verification Boxes (Suggested Placement):

            • After Shared Responsibility section
            • After SCPs / Governance section
            • After Well-Architected references

            Quick Reference Checklist: Domain 6 – Security Foundations & Governance

            Key Takeaways (Scan before the exam!)

            – Shared Responsibility Model: Always clarify what AWS secures vs. what you control.

            – Use AWS Organizations and SCPs for policy-driven, organization-wide governance.

            – Automate compliance: favor Infrastructure as Code, automated checks, and auto-enablement of detective/preventive controls.

            -Lean one the AWS Well-Architected Framework forbest practice alignment.

            – Favore scalable, centralized, and policy-drive solutionsy in exam scenarios.- Always check the latest AWS documentation—services and features evolve quickly.

            Final Tip: For scenario-based questions, ask: “Is this solution scalable, automated, and centralized?” If so, it’s likely the best choice.

            Change Awareness Note:

            AWS governance services evolve regularly. Always validate SCP behavior, Organizations features, and Well-Architected guidance against current AWS documentation. For the latest on each topic, see:

            Shared Responsibility Model

            AWS Well-Architected Framework

            AWS Organizations

            Service Control Policies

            AWS Security Best Practices

            Security Specialty Exam Guide

            Security Without the Pessimism | Capstone: The Human Architecture of Resilience

            There’s a moment in every incident, and in every life, when things go sideways.
            An urgent alert comes in at 2 a.m.
            The phone buzzes with something you didn’t want to see.
            The room suddenly feels smaller.
            Your pulse skyrockets ahead of your ability to reason.

            That’s the pivot point.

            Not the breach, not the threat actor, not the malware strain. The moment your mind decides whether to rush, freeze, or breathe.

            And if the past two decades in cybersecurity have taught us anything, it’s this: The most overlooked control isn’t technical at all — it’s the ability to think clearly under pressure.

            You can build the best firewall on earth, layer your identity stack, and lock down every endpoint within reach. But if the wrong person panics at the wrong moment? Your architecture won’t crumble, but your response will.

            And the irony is that the same pattern shows up everywhere.
            In the gym.
            In martial arts.
            In American foreign policy across multiple generations.
            In corporate culture.
            In our personal lives.

            Technology changes. Tools evolve.
            But human behavior remains the battlefield.

            This capstone is about that battlefield, the one beneath all the dashboards and diagrams.
            The human architecture of resilience.

            Not fear.
            Not pessimism.
            Not endless warnings.
            Just clarity, culture, awareness, and depth.

            I. The Calm Before the Click: Thinking Clearly Under Pressure

            Cybersecurity professionals often discuss “root cause.”
            The CVE.
            The misconfig.
            The missing patch.
            The malicious link.

            But if you trace incidents far enough back, you rarely find a purely technical failure.
            You find someone who was tired.
            Someone who rushed.
            Someone is overloaded with tasks, tabs, or alerts.
            Someone who clicked before the mind caught up.

            Attackers have known this longer than we have.
            Social engineering is, at its core, the psychological equivalent of an ambush.
            It doesn’t rely on brilliance — it relies on rhythm.
            Interrupt someone’s rhythm, and you can make them do almost anything.

            History played the same game long before phishing emails existed.

            During WWI, the U.S. population had no appetite for a European conflict until the Committee on Public Information mastered message engineering on a national scale.

            During Vietnam, selective narratives were used to anchor the Gulf of Tonkin resolution, one of the clearest examples of how urgency overrides discernment.

            After 9/11, emotional exhaustion and fear gave the green light to decisions that would shape two decades of conflict, including the push toward Iraq in 2003 on intelligence the government already knew was questionable at best.

            The pattern is timeless: pressure → perception drops → people accept what they would normally question.

            In cybersecurity, that’s the moment a breach begins. Not when the payload deploys, but the moment someone stops breathing long enough to see clearly.

            Martial arts teach this early: when your structure collapses, so does your mind. The fight is rarely won by the strongest, but by the one who stays calm.

            Cybersecurity isn’t so different. We need quieter minds, not louder alarms. Consider the Apollo 13 mission: when an oxygen tank exploded in space, it wasn’t advanced technology alone that saved the crew—it was the unwavering composure, clear communication, and problem-solving focus of both astronauts and mission control. Their story remains a testament to the power of preparation, training, and the human spirit under pressure.

            Psychological research supports this need for balance: the Yerkes-Dodson Law demonstrates that while a certain level of stress can sharpen performance, too much leads to mistakes and paralysis. It’s not the loudest alarms or the highest stress that produce the best outcomes, but the ability to operate with steady focus under pressure.

            II. Security Isn’t a Toolset. It’s a Culture.

            This is the part vendors never put in their brochures.
            Tools matter, of course they do, but they’re not the foundation.
            If a team’s culture is fractured, fearful, or fatigued, the best tool becomes another dashboard no one trusts.

            A culture of security is built on three traits: Curiosity. Communication. Psychological safety.

            Curiosity is the click buffer. It’s the pause before the action. It’s the “does this feel right?” instinct that catches what technology misses.

            Communication is the force multiplier. If people don’t feel comfortable asking questions, you don’t have a security program; you have a façade. The worst breaches happen in organizations where employees believe that reporting something suspicious will get them punished.

            Psychological safety is the foundation beneath it all. You cannot build defense through fear.
            If people feel judged, they go silent. And silence is where threat actors win.

            Across American history, the same dynamic appears at scale. Governments that relied on controlling the narrative rather than fostering transparency created long-term instability.
            Nations that punished dissent instead of listening to it made poorer decisions, walked into unnecessary conflicts, or ignored early warnings because no one felt safe raising them.

            In cybersecurity, the equivalent is leadership that says: “If you click a bad link, come to us immediately, you’re part of the solution, not the problem.”

            Culture isn’t a policy. Culture is what happens when no one is watching.

            III. The Invisible Threat: Complacency

            Complacency is the enemy that feels like a friend. It arrives quietly. It shows up after long stretches of “nothing happened.” It hides behind phrases like:

            • “We’ve never had an incident.”
            • “We’ve always done it this way.”
            • “Our tools would catch that.”

            Every major breach you can name—SolarWinds, Equifax, Colonial Pipeline—roots itself in complacency somewhere: A missed update. An over-trusted vendor. An assumption that the environment was safer than it actually was. The 2013 Target data breach is a sobering example: multiple security alarms were triggered, but critical warnings were overlooked amidst noise and unclear processes. The failure wasn’t just technical—it was cultural and human. True resilience is built not on more tools, but on clear communication, shared responsibility, and organizational discipline.

            There’s a parallel here, too, in public psychology. Before WWI, the U.S. believed oceans protected it.

            Before the Vietnam War, we believed that superior technology guaranteed strategic clarity.
            Before 9/11, we believed asymmetrical warfare couldn’t reach our shores.
            Before the Iraq invasion, many believed intelligence agencies couldn’t be wrong.

            Every time, familiarity dulled skepticism. Certainty replaced awareness.

            Threat actors exploit the same weakness in cybersecurity: When we stop questioning our own assumptions, we hand them the keys.

            But the solution isn’t paranoia. It’s presence—the discipline to stay aware without fear, engaged without burning out, and to use quiet periods to strengthen fundamentals rather than relax them.

            Martial artists call this “maintaining the white belt mentality.” It’s the idea that no matter how skilled you become, your awareness must remain humble. The strike you don’t see coming isn’t the strongest; it’s the one you assumed wouldn’t land.

            IV. Defense in Depth Begins With Humans in Depth

            Defense in depth is usually presented as a diagram: Layers. Controls. Policies. Logging. Detection.

            But the deepest layer is always the human beings behind the console.

            Humans who communicate clearly under pressure.
            Humans who don’t panic.
            Humans who collaborate instead of silo.
            Humans who maintain integrity even when no one is watching.

            You can’t automate those traits.
            You can only cultivate them.

            A resilient team has depth:
            Depth of character.
            Depth of discipline.
            Depth of humility.
            Depth of trust.

            Leadership plays a massive role here.
            A leader who panics creates a cascading failure.
            A leader who hides incidents creates blind spots.
            A leader who blames creates avoidance.

            But a leader who stays calm?
            A leader who listens?
            A leader who respects the intelligence of their team?

            That kind of leadership becomes its own security layer, the kind attackers can’t penetrate.

            Martial philosophy applies here beautifully:
            The master doesn’t fight everything.
            The master knows when not to fight.
            The master conserves energy, maintains structure, and remains sufficiently present to move precisely when needed.

            That’s cybersecurity at its best. Not a flurry of tools or panic-driven responses. But steady awareness, grounded action, and a team that trusts itself. The response to the Stuxnet worm demonstrated the power of multidisciplinary collaboration: security researchers, government agencies, and private-sector teams worked together to analyze, share intelligence, and adapt rapidly. Their coordinated effort underscores that no single individual or technology has all the answers—resilience is a collective achievement.

            V. The Four Pillars of Real Resilience

            Looking back across this entire series, four fundamentals keep appearing.

            1. Calm

            The ability to breathe before acting. Security begins in the mind, not the machine.

            2. Culture

            Tools help. Culture protects. Culture catches what software can’t.

            3. Awareness

            Not paranoia, presence. The discipline to question, verify, and stay awake to the world around you.

            4. Depth

            Technical depth is valuable. Human depth is irreplaceable. Depth fuels resilience in every domain: networks, clouds, teams, and nations.

            These aren’t pessimistic ideas. These are empowering ideas. They’re principles that make security feel less like fear and more like clarity.

            Threat actors depend on confusion. They depend on fatigue. They depend on people who doubt their instincts.

            A calm mind. A strong culture. A present awareness. A deep team.

            That’s how you win. Not loudly, but with consistency.

            VI. Final Thought: Security Is a Human Practice Before It’s a Technical One

            If there’s a thesis to Security Without the Pessimism, it’s this: Security isn’t something we bolt onto systems. It’s something we build into ourselves.

            The work isn’t glamorous or cinematic. It’s often quiet, slow, and unrecognized. But it matters, because every decision and moment of awareness contributes to something bigger than any one of us, a culture of resilience.

            So here’s the takeaway: You don’t need pessimism to stay secure. You just need presence. You need clarity and people who care enough to pause, communicate, and stay humble.

            That’s the foundation of a safer digital world, built one calm, aware, disciplined human at a time.

            Security Without the Pessimism: The VPN Comfort Myth

            The Digital Blanket We All Love

            Few tools in cybersecurity inspire more misplaced comfort than the VPN.

            We picture it as an invisibility cloak or a tunnel of safety where no one can see us, track us, or touch our data. Turn it on, and suddenly you’re “secure.”

            That feeling of control is powerful, especially in a world that never stops reminding you how unsafe the internet supposedly is.

            But here’s the quiet truth: a VPN protects you from some things, not from everything.
            It’s a tool, not a shield.

            What VPNs Actually Do

            At its core, a VPN (Virtual Private Network) encrypts your internet traffic and routes it through a secure server. It hides your IP address and protects your data from casual snooping, especially on public Wi-Fi.

            That’s useful, but not magic.

            VPNs do not:

            • Protect you from phishing or malware
            • Stop you from logging into fake sites
            • Prevent data collection once you’re signed in somewhere

            If your VPN provider keeps logs or has weak security, your trust shifts from the ISP to them.

            So yes, a VPN helps. But only if you understand where its power ends.

            Safety Theater for the Digital Age

            VPNs scratch a deep psychological itch: the need to feel safe, even when we can’t verify it.

            They’re the digital equivalent of locking your front door but leaving the windows open, a visible act that soothes anxiety without addressing every risk.

            That invincibility leads many to take more risks online. This risk compensation means perceived safety can spark riskier behavior.

            Real security isn’t about hiding. It’s about awareness.

            Where Comfort Becomes Complacency

            The most significant problems with VPN use aren’t technical; they’re behavioral.

            • Blind trust in providers. Some “free” VPNs monetize your data rather than protect it.
            • Performance trade-offs. Slower speeds lead people to disable it, often forgetting to turn it back on.
            • Assumed anonymity. Logging into your personal accounts still links behavior to identity.
            • Neglected basics. Users skip updates or MFA because “I’ve got a VPN.”

            The tool becomes a crutch, and that comfort can cost you more than the subscription.

            Layer, Don’t Lean

            A VPN should be part of a layered defense, not its foundation.

            Here’s how to use it wisely:

            • Choose providers with no-log policies and independent audits
            • Keep software updated. VPNs rely on encryption protocols that age fast
            • Use MFA everywhere. A VPN won’t save a stolen password
            • Understand context. VPNs are best for travel, remote work, and untrusted networks — not daily browsing at home

            Security isn’t about hiding behind one tool. It’s about stacking the right ones.

            Culture Over Blame — Moving Past Security Myths

            The VPN story mirrors how we approach most security advice: quick fixes over long habits.

            Instead of mocking people for misunderstanding what VPNs do, we can use that comfort as a bridge: “Good start. Now let’s talk about the rest.”

            Awareness grows when education feels empowering rather than condescending. The goal isn’t to shame people for feeling safe; it’s to help them feel safe for the right reasons.

            Final Thought

            A VPN isn’t a vault; it’s just a smaller door to the same big house. Use it, respect it, but don’t mistake a single layer for complete protection.

            Real protection isn’t invisible. It’s intentional. That’s not pessimism, that’s just good sense.

            The Art of Cyberwar | Part VII | Maneuvering

            Chapter VII’s artwork conveys the essence of Sun Tzu’s Maneuvering with clarity and grandeur. A lone commander surveys a vast, unfolding landscape of troops in motion, symbolizing disciplined rhythm rather than frantic pace. The terrain’s natural flow mirrors the movement of cloud-age systems, and the light breaking across the valley evokes strategic awareness dawning before action. It is a rare blend of historical resonance and modern metaphor, a visual philosophy.

            Movement After Position

            The Principle: “We may take it then that an army without its baggage-train is lost; without provisions it is lost; without bases of supply it is lost.” — Sun Tzu

            The Art of Coordinated Movement

            A cybersecurity team detects a breach at 2 AM. They have the skills, the tools, and the authority to act. But without coordination, that capability becomes chaos, analysts duplicating work, containment efforts conflicting, and communication breaking down. By dawn, the advantage is gone.

            In February 1943, American forces faced German tanks at Kasserine Pass in North Africa. They had the weapons, the numbers, the training. What they lacked was coordination between units and effective air-ground communication. The result? The first major American defeat of WWII was not due to a lack of capability, but to failure to maneuver as a unified force.

            Fifteen months later, those same American forces learned the lesson. On June 6, 1944, D-Day coordinated 12 nations, over 7,000 vessels, and 160,000 troops across five beaches in a single operation. Not because they suddenly acquired better weapons, but because they mastered maneuvering. Kasserine Pass taught them that capability without coordination is chaos. Normandy proved that coordination transforms capability into victory.

            Eighty years later, the battlefield is digital, but the lesson remains the same.

            Sun Tzu called this the difference between movement and maneuvering.

            Maneuvering is the discipline of transforming positional advantage into progress without depleting resources. Though movement may appear straightforward (advance, pivot, respond), it demands careful coordination. Without coordination, movement breeds confusion and disorder, undermining any initial advantage.

            In Brazilian Jiu-Jitsu, there’s a fundamental principle: position before submission. A novice rushes for the choke. A master secures the proper position, seeks control, applies the proper pressure, isolates the arm, and then the finish is there for the taking. The submission becomes inevitable because the position made it so.

            Maneuvering works the same way: structured movement from an established position. Not frenetic action. Coordinated, calculated movement in advance.

            Whether in military operations, government, or cybersecurity, the true challenge lies in maintaining momentum while preserving balance. Effective teams favor structured, intentional movement, not just speed.

            This is the heart of maneuvering: composure, intent, and clarity. Act from principle, not anxiety.

            The Maneuvering Decision Matrix

            Sun Tzu understood that effective maneuvering requires reading the moment, knowing when to accelerate, when to pause, and when to let the environment dictate pace.

            Modern leaders need the same discernment:

            When to Accelerate:

            • The advantage is clear and actionable.
            • Resources are sufficient.
            • Team alignment is strong.
            • Opponent is vulnerable

            When to Pause:

            • Visibility is degraded
            • Fatigue is setting in across the team.
            • Purpose has become uncertain.
            • Information remains incomplete

            When to Let Environment Dictate:

            • The opponent is making mistakes.
            • Terrain is shifting faster than you can control
            • Patience offers a strategic advantage.
            • Reactive movement would expose weakness.

            This isn’t indecision. It’s tactical discipline. The fighter who controls tempo controls the outcome.

            Tempo and Terrain

            In both war and cybersecurity, timing determines outcomes more than sheer speed. When to act matters more than how quickly you act.

            Sun Tzu cautioned that armies advancing too rapidly become fatigued, while those moving too slowly forfeit initiative. Balance requires understanding rhythm, discerning when to accelerate, when to pause, and when to let the environment set the pace.

            Today, that terrain is digital.

            The modern battlefield consists of networks, cloud environments, and global systems. Effective cybersecurity professionals study the digital landscape to move with intent, not to avoid movement altogether.

            In the cloud era, terrain isn’t geography, it’s architecture.

            Latency, visibility, and complexity shape what’s possible. The most secure organizations extend beyond perimeter defense by developing a comprehensive understanding of their operational landscape. They design systems where quick tactical movements don’t create strategic vulnerabilities.

            The Cyber Battlefield: Coordination Over Chaos

            In cybersecurity, effective maneuvering means more than quick patching or immediate responses. It requires aligning teams, especially during high-pressure situations.

            • Incident response represents maneuvering under pressure: containment, communication, and recovery.
            • Threat intelligence involves maneuvering through uncertainty—transforming fragmented information into actionable insights without prematurely acting on incomplete data.
            • Automation functions as the logistical backbone, the supply chain supporting frontline operations. When automation fails, even highly skilled analysts face burnout.

            Many security operations centers (SOCs) miss this point. Constant urgency and nonstop action may seem productive, but endless motion risks exhaustion and reduced effectiveness.

            Authentic maneuvering is characterized by calm, control, deliberation, and focus.

            • Wing Chun’s centerline theory offers a simple, direct, economical model. SOC analysts don’t need fifty tools—they need the right three, automated properly, with clear escalation paths. Economy of force.
            • The central point: when your playbook drives decisions, you maneuver. When alerts drive decisions, you react.

            Cloud Mobility: The Terrain in Flux

            The shift to cloud computing redefined what “maneuvering” means. In the old world, servers stayed put. Now, data, workloads, and identities move across providers, borders, and legal frameworks.

            In this environment, organizational strength comes not from rigidly restricting movement, but from orchestrating secure and transparent operations.

            Cloud maneuvering looks like:

            • Workloads shifting across regions without breaking compliance
            • Data flowing securely through APIs without leaving blind spots
            • Teams pivoting incident response playbooks across hybrid environments in real time

            Cloud environments reward planning for motion. Organizations win by designing for agile, secure movement, not by resisting change.

            In 2023, a Fortune 500 company’s cloud migration stalled not because of technical limitations, but because their security team designed for a static perimeter. When workloads needed to shift regions for compliance, every move required manual review.

            Organizations that assume static conditions are at a disadvantage.

            This aligns with the martial principle of flow: Rigid fighters’ break. Rigid systems break faster.

            Foreign Policy and the Cost of Motion

            Nations, too, confuse movement with progress. America’s 20th-century record is full of lessons in tempo and fatigue.

            But no example better illustrates the danger of resource-driven maneuvering than what led to the attack on Pearl Harbor.

            The Pearl Harbor Lesson: When Resources Force Your Hand

            Japan’s attack wasn’t born from ambition, it was forced by logistics. The U.S., Britain, and the Dutch enforced the ABCD embargo, cutting off:

            • Oil
            • Rice
            • Steel
            • Rubber
            • Machine parts

            Japan imported 90% of its oil. Cut off from fuel, it faced two choices: fight or run out of energy and food entirely.

            Sun Tzu wrote: “Throw your men into death ground, and they will fight.”

            Japan was placed on death ground by resource denial. Their maneuver, the attack itself, was coordinated brilliantly. Six aircraft carriers, 353 aircraft, precise timing across multiple strike waves.

            Tactically, it was masterful.

            But strategically? Admiral Yamamoto knew: “I fear all we have done is awaken a sleeping giant.”

            A lingering question remains: was America truly sleeping? WWI had concluded only 20 years earlier. Before WWII, WWI was considered the deadliest war in human history, earning the moniker “The Great War” for its immense scale and death toll of approximately 20 million lives. Its unprecedented destruction set it apart from previous conflicts. So, America was hardly asleep. Back to Pearl Harbor.

            The lesson isn’t about the attack’s execution. It’s about what happens when maneuvering is dictated by desperation rather than position. When resources force your hand, even perfect coordination can’t save you.

            Sun Tzu’s calculus applies: survival-driven movement, no matter how well-executed, is still reactive. And reactive maneuvering rarely wins wars.

            The United States later encountered similar challenges in Vietnam, Iraq, and Afghanistan, where rapid action outpaced strategic learning. Momentum itself became a compelling but hazardous force.

            Diplomacy is maneuvering in another realm.

            In contrast, contemporary policy frequently equates reaction with strategy, prompting responses to every crisis even when restraint or delay might prove more advantageous.

            Sun Tzu’s wisdom cuts through centuries: “If you know neither the terrain nor the season, you march to fatigue, not to victory.”

            The Logistics of Cyber Power

            For cybersecurity professionals, logistics consists not of physical supplies, but of bandwidth, personnel, and operational clarity.

            Sustained operations aren’t feasible if systems are overburdened, personnel remain on constant alert, and every issue is treated as critical.

            Good logistics in cyberspace means disciplined prioritization:

            • Which assets are mission-critical?
            • Which alerts deserve escalation?
            • What response cadence prevents burnout?

            Sun Tzu would call this “feeding the army.” In today’s language, it’s resource stewardship.

            An effective CISO ensures security professionals maintain resilience and don’t become exhausted before adversaries lose their resolve.

            The data shows progress. Organizations took an average of 241 days to identify and contain breaches in 2025, down from 287 days in 2021. Not because threats got easier, but because purple-teamers got better at coordinated response. They learned to maneuver.

            Maneuvering the Human Factor

            The most challenging aspect of coordination isn’t the technical infrastructure; it’s the human element. While individuals contribute creativity, they also introduce unpredictability.

            The numbers confirm what practitioners already know: 88% of cybersecurity breaches are caused by human error. Not zero-days. Not sophisticated malware. Human mistakes. The technology isn’t the weak link—the coordination of people using that technology is.

            Sun Tzu understood morale as a weapon system. He coordinated hearts and minds before he coordinated units.

            The same applies to martial arts and security culture.

            • In Muay Thai, they call it ring generalship, the fighter who controls space controls pace. The same applies to security teams. Leaders who set tempo, who decide when to press and when to absorb pressure, create the conditions for team effectiveness.
            • The most effective cybersecurity teams operate like jazz ensembles, distributed but synchronized. Training, communication, and trust are the modern equivalents of morale.

            This is modern maneuvering: achieving precision in movement without relying solely on hierarchical control.

            The Risk of Endless Marching

            Sun Tzu cautioned that armies remaining in the field for extended periods experience internal decline. This phenomenon appears today as burnout, alert fatigue, and continuous red team exercises that fail to produce lasting improvements.

            Organizations that never rest eventually turn on themselves. This applies equally to companies and nations.

            Movement should support strategic objectives, not substitute for them. Effective leadership requires recognizing when to pause, regroup, and restore organizational strength.

            Without periodic rest, strength deteriorates into strain, and resilience devolves into attrition.

            The Bridge to Variation

            The final lesson of maneuvering emphasizes humility: movement does not constitute mastery; it serves as its test.

            Any army, individual, or system that acquires the ability to move must subsequently develop adaptability: the capacity to alter rhythm, diversify tactics, and confound adversaries who anticipate predictability.

            Leading us back to the initial principle: “We may take it then that an army without its baggage-train is lost; without provisions it is lost; without bases of supply it is lost.”

            Maneuvering determines survival. Variation determines victory.

            But first, you must learn to move without falling apart. Master coordination before you attempt improvisation. Secure your supply lines before you advance.

            Because, as Sun Tzu understood, an army that moves with discipline can adapt. An army that moves with chaos can only collapse. The next chapter explores variation, but only those who’ve mastered maneuvering will recognize when to use it.

            The Art of Cyberwar | Part VI | Weak Points and Strong

            matt shannon art of cyberware chapter VI weak points an strong

            The principle:
            “So in war, the way is to avoid what is strong and to strike at what is weak.”

            Strength and Weakness Are Temporary

            Sun Tzu emphasized that strength and weakness are dynamic rather than static. Although this principle may seem self-evident, it is often overlooked in practice. Many individuals disregard straightforward strategies, mistakenly believing that complexity is required. This oversight often leads to the violation of previous strategic principles or “lessons learned”, indicating a lack of genuine understanding.

            It is essential to recognize that what appears robust today may become fragile in the future, while seemingly vulnerable elements can become decisive with time and increased awareness.

            Power, whether military or digital, shifts with context.

            The critical factor is not the quantity of resources, but the ability to perceive the entire operational landscape. Vulnerabilities arise not only from an adversary’s strengths, but also from areas where situational awareness is lacking and the speed at which adaptation occurs when new realities emerge.

            In contemporary contexts, both nations and security architects often neglect this fundamental principle. There is a tendency to focus on constructing increasingly formidable defenses rather than developing adaptive strategies. Regardless of the scale of these defenses, adversaries require only minor vulnerabilities to compromise their effectiveness. Always remember, your adversaries only need to find a tiny leak in the walls to bring the entire system down.

            Predictability: The Modern Weakness

            Even the most secure fortresses eventually become familiar terrain for attackers. Cyber adversaries do not rely on brute force; instead, they employ strategic analysis. They examine organizational habits and exploit vulnerabilities such as unpatched servers, unmanaged privileged or service accounts, unchanged passwords, and the susceptibility of executives to social engineering.

            Their success depends not on force, but on the predictability of organizational behaviors.

            Nations exhibit similar vulnerabilities. Bureaucratic routines solidify into doctrine, which can devolve into dogma. Adversaries exploit these predictable patterns, waiting for repetition before executing successful attacks.

            Historical events, such as the Pearl Harbor attack, the September 11 attacks, the Gulf of Tonkin incident, and numerous cyber intrusions, demonstrate that deficiencies in critical thinking, complacency, rigidity, and hubris significantly increase the likelihood of successful surprise attacks.

            When Comfort Masquerades as Strength

            Many organizations and governments allocate excessive resources to familiar areas, fostering a false sense of security. This environment allows risks to proliferate unnoticed, undermining overall resilience.

            Cybersecurity teams often spend millions fortifying infrastructure while leaving users untrained.

            Organizations frequently monitor technical metrics while neglecting human behavior. The most significant vulnerabilities often arise from areas presumed to be under adequate management.

            System failures are typically attributable not to insufficient funding, but to misaligned priorities.

            This pattern is evident at the national level as well. Large militaries and substantial budgets often obscure underlying fragilities, including slow adaptation, reliance on outdated assumptions, unstable alliances, and insufficient strategic foresight regarding emerging forms of conflict.

            Historical Lessons of Misguided Strength

            The First World War began with nations convinced that industrial might and rigid plans guaranteed victory. Those plans dissolved within months under the weight of modern weapons and static thinking.

            During the Vietnam War, a major power misinterpreted its capacity for endurance as a guarantee of superiority. The Viet Cong’s guerrilla tactics transformed conventional advantages into significant liabilities.

            Even the rapid success of Operation Desert Storm fostered complacency. Efficiency was mistaken for enduring security, and the perceived triumph was erroneously interpreted as evidence of invincibility.

            Each era reaffirms the principle that the most conspicuous assets are not necessarily the most powerful.

            Flexibility as True Power

            Sun Tzu’s insight was to conceptualize power as dynamic movement. He advocated that a general should emulate water, seeking the path of least resistance and adapting to the terrain.

            Within the cyber domain, the operational landscape evolves rapidly, with new threats, actors, and vulnerabilities emerging on a continual basis.

            In this context, strength is defined by agility:

            • Rotate keys and credentials regularly.
            • Automate but verify.
            • Decentralize authority so teams can act without waiting for hierarchy.

            The most effective defenders are those who demonstrate the greatest adaptability, learning and evolving more rapidly than adversaries can adjust their tactics.

            Lao Tzu’s Echo

            Lao Tzu put it simply:

            “Water overcomes the stone not by strength, but by persistence.”

            Endurance surpasses dominance. Properly understood, flexibility is not a sign of weakness but of resilience, characterized by the capacity to absorb disruption and recover to an original state.

            In the digital context, resilience is reflected in recovery planning, redundancy, and organizational culture. The true measure of strength is not the infrequency of failure, but the speed of recovery following a compromise.

            Turning Weakness Into Insight

            All systems possess inherent flaws. Denial of these vulnerabilities allows them to remain concealed until a crisis occurs. Proactive defenders employ audits, red-team exercises, and transparent communication to identify weaknesses at an early stage.

            Transparency transforms potential liabilities into opportunities for organizational learning.

            Nations could use the same humility.

            Public acknowledgment of mistakes enhances credibility, whereas concealment increases risk. The most resilient governments are not those without flaws, but those capable of adapting transparently before their constituents.

            From Awareness to Action

            Identifying vulnerabilities constitutes only part of the challenge; addressing them effectively demands both discipline and restraint.

            In cybersecurity, this approach entails prioritizing remediation over self-congratulation, thorough preparation prior to disclosure, and critical evaluation before taking action.

            In policy contexts, this requires deliberate prioritization, engaging only in actions where the anticipated outcomes justify the associated costs.
            Misapplied strength can become a source of vulnerability, whereas a thorough understanding of weaknesses can provide strategic foresight.

            The Next Step: The Flow of Force

            Sun Tzu ends this chapter with motion: the strong shifting to the weak, the weak transforming to the strong.

            He implies that awareness must evolve into timing. The wise general aligns his force with the moment, not against it. And that, “All men can see the tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved.”

            This concept serves as a transition to the subsequent lesson, which focuses on the dynamics of energy in motion and the strategic management of power with balance and rhythm.

            We’ve learned where to stand. Next, we’ll learn how to move. As Master Tzu concludes Chapter VI:

            Military tactics are like unto water; for water in its natural course runs away from high places and hastens downwards. Water shapes its course according to the nature of the ground over which it flows; the soldier works out his victory in relation to the foe whom he is facing. Therefore, just as water retains no constant shape, so in warfare there are no constant conditions.

            Leading us directly back to this lesson’s seemingly simple principle: “So in war, the way is to avoid what is strong and to strike at what is weak.”

            The Art of Cyberwar | Part IV | Tactical Dispositions

            the art of cyberwar - tactical dispositions. matt shannon cloud security.

            The Principles:
            “The good fighters of old first put themselves beyond the possibility of defeat, and then waited for an opportunity of defeating the enemy.”

            “Thus it is that in war the victorious strategist only seeks battle after the victory has been secured, whereas he who is destined to be defeated, first fights, and afterwards looks for victory.” —Sun Tzu

            Every data breach, foreign conflict, and policy error typically originates from an action taken without adequate prior positioning.

            There is a common tendency to conflate activity with progress. Sun Tzu recognized that true invincibility is rooted in defense, while the opportunity for victory depends on the adversary.

            In contemporary terms, this concept is referred to as defensive posture: the disciplined practice of preparation prior to visibility.

            Defensive Positions

            Effective cybersecurity teams secure their positions well in advance of any actual test. They maintain comprehensive awareness of data locations, access privileges, and the criticality of various systems. Such teams implement patches discreetly, monitor systems consistently, and design infrastructures to recover from failures rather than assuming failures will not occur.

            That’s tactical disposition:

            • Enforcing least privilege to build resilience.
            • Applying timely patching to keep critical systems protected.
            • Building backups as integrated mechanisms for redundancy and recovery.
            • Running tabletop exercises to rehearse scenarios that organizations hope never occur.

            This often-invisible work may appear inconsequential until it proves essential in critical moments.

            When Nations Forget the Same Lesson

            Historical evidence indicates that both nations and organizations seldom pause sufficiently to engage in strategic reflection.

            Nations often amass extensive arsenals, initiate large-scale programs, and extend supply lines to project strength. However, when strength is dispersed excessively, it transforms into fragility, a phenomenon known as overreach. Overreach fundamentally undermines resilience.

            The United States has frequently responded to perceived threats with disproportionate measures, conflating activity with effective strategy and reallocating resources without a long-term perspective. Engagements in wars and alliances often occur more rapidly than preparations for their potential consequences.

            The consequences include wasted resources, public fatigue, and strategic exhaustion. All of which contribute to diminished geopolitical and geostrategic self-awareness.

            According to Sun Tzu, achieving invincibility does not involve amassing weapons, engaging in unnecessary interventions, or imposing ineffective sanctions. Instead, it requires constructing economic, digital, and diplomatic systems capable of absorbing shocks while maintaining integrity. A resilient nation need not swing at every shadow.

            Resource Stewardship

            Cybersecurity is frequently perceived as a process of continual escalation, characterized by the addition of more tools, dashboards, and alerts.

            However, each new platform introduces additional complexity, which in turn creates new potential attack surfaces.

            Effective security practices may require declining adoption of the latest technologies and decommissioning unnecessary systems to simplify complex environments.

            As Bruce Lee once said “I fear not the man who has practiced 10,000 kicks once, but I fear the man who has practiced one kick 10,000 times.”

            Simplifying operations enables organizations to concentrate on mastering essential tools, particularly when resources are limited. The principles of simplicity, directness, and economy of motion are fundamental to effective practice.

            Our government should also learn to exercise the same restraint. Faithful stewardship isn’t constant investment in everything; it’s a deliberate focus on what matters most.

            This approach exemplifies strategic minimalism, which emphasizes the optimal utilization of public resources and, ultimately, enriches us all by conserving precious and limited resources.

            Similarly, as America’s original Foreign Policy was initially articulated by John Quincy Adams on July 4th, 1821:

            [America]…goes not abroad, in search of monsters to destroy. She is the well-wisher to the freedom and independence of all.

            She is the champion and vindicator only of her own.

            She will commend the general cause by the countenance of her voice, and the benignant sympathy of her example.

            She well knows that by once enlisting under other banners than her own, were they even the banners of foreign independence,

            She would involve herself beyond the power of extrication, in all the wars of interest and intrigue, of individual avarice, envy, and ambition, which assume the colors and usurp the standard of freedom.

            The fundamental maxims of her policy would insensibly change from liberty to force…
            She might become the dictatress of the world. She would be no longer the ruler of her own spirit…

            [America’s] glory is not dominion, but liberty. Her march is the march of the mind. She has a spear and a shield: but the motto upon her shield is, Freedom, Independence, Peace. This has been her Declaration: this has been, as far as her necessary intercourse with the rest of mankind would permit, her practice.

            This practical wisdom may appear boring. However, organizations and governments alike must identify their assets, maintain them, and protect only what can be effectively defended. Continuous review, revision, and updates are fundamental.

            The Cost of Perpetual Readiness

            Sun Tzu cautioned that armies maintained in the field for extended periods deplete their own strength. Contemporary parallels include budgets exhausted by perpetual emergencies and professionals experiencing burnout due to continuous false positives.

            The solution lies in cultivating a well-developed security posture rather than succumbing to ongoing panic and overreaction.

            Organizations should prepare comprehensively, rest intentionally, and engage only when strategically necessary.

            This sequence, prioritizing defense before offense and clarity before action, establishes the resilience that many organizations seek.

            Learning From Tactical Blindness

            Security breaches frequently result from overlooked fundamentals, such as unpatched systems, insufficiently trained users, and unreviewed alerts.

            Similarly, the escalation of wars or crises is often attributable to unexamined assumptions.
            Both scenarios arise from neglecting the primary principle of tactical disposition: understanding one’s position before determining a course of action.

            Modern Application

            • In cybersecurity: organizations should implement defense-in-depth strategies, automate routine checks, and prioritize cultivating awareness rather than fear. Emphasizing culture over blame.
            • In governance: it is essential to align objectives with available capacity, critically assess the true cost of each commitment, and recognize that restraint can be the most strategic option.

            This parallel represents a recurring pattern rather than a mere metaphor.

            Practitioner’s Questions To Ask Yourself:

            1. Am I defending by hope instead of design?
            2. Which tools add noise without adding clarity?
            3. What assumptions have gone unchallenged for too long?
            4. Where has “doing more” replaced “preparing better”?

            Final Reflection

            While invincibility is not the explicit objective, it is often the understated result of an effective security architecture. Complete protection cannot be guaranteed. However, it can be achieved through patience and persistence. Although this approach may lack glamour, in the ongoing struggle to maintain tactical disposition, it remains essential.

            Sun Tzu’s good fighter was never reckless, never idle. He shaped his defenses so well that the enemy’s attacks lost meaning.

            Nations and security architects should adopt similar practices. Consistently apply the principles of tactical disposition, exercise prudent stewardship of public resources, and cultivate strength, resilience, and wisdom.

            The objective is not to engage in conflict frequently, but to do so only when absolutely necessary. Making it essential to fully understand and apply this story’s principles:

            “The good fighters of old first put themselves beyond the possibility of defeat, and then waited for an opportunity of defeating the enemy.”

            “Thus it is that in war the victorious strategist only seeks battle after the victory has been secured, whereas he who is destined to be defeated, first fights, and afterwards looks for victory.”

            Cloud Security and Meal Prep: The Routine That Saves You When It Counts

            Whether you’re a cloud engineer, a school IT lead, or just someone juggling a lot of responsibilities, you know routines matter. Here’s how a few simple habits, both in the kitchen and in the cloud, can make all the difference when things get hectic.

            Meal prep can feel like a grind: chopping, portioning, stacking containers into neat rows. Yet when a demanding week hits, that fridge full of ready-made meals is your quiet victory. It’s proof that routine pays off when pressure arrives.

            Vulnerability scanning and patching works similarly. It’s repetitive, rarely celebrated, and usually annoying. But consistency is what saves you during mission-critical moments, when vulnerabilities surface or threat actors strike.

            The Problem with Patching

            Patching never ends. There’s always another round of updates, another CVE, another “critical” bulletin. The challenge isn’t just time, it’s motivation.

            • It’s endless. You finish one cycle only to start another.
            • It’s invisible. No one notices the breach that never happened.
            • It’s easy to delay. “We’ll patch later” often becomes “we wish we had.”

            In cloud environments, the pace is faster. Systems scale dynamically, microservices update constantly, and the attack surface grows by the minute. Skipping one patch cycle is like skipping a week of prep: you won’t feel it right away, but the fallout is inevitable.

            The Solution: Treat It Like Meal Prep

            The way through is rhythm and habit, small, consistent actions that compound into resilience.

            • Automate Where Possible
              Just like batch cooking, automation saves time and reduces errors. Use tools like AWS Systems Manager Patch Manager, Azure Update Management, or Google Cloud OS Config to deploy updates automatically across fleets. Automate notifications and reporting as well, so visibility remains high without incurring manual overhead.

            Pro tip: If you’re new to automation, start small by piloting auto-patching in a test environment before rolling it out everywhere.

            • Schedule Cycles and Stick to Them
              Create predictable patch windows: weekly for endpoints, monthly for servers, rolling updates for cloud workloads. Align these cycles with CI/CD pipelines to ensure updates integrate seamlessly with development. Repetition builds trust in the process and limits downtime surprises.
            • Make It a Habit
              The goal isn’t to be a hero, but to be consistent. Prep your meals each week, patch your systems on schedule, and review your process every month. Eventually, these steps just become part of your routine.

            The Payoff: Prepared Beats Panicked

            When a zero-day hits, the teams that patch regularly move smoothly through the chaos. Their systems are up to date, their dependencies are tracked, and their processes are tested. The rest scramble for emergency fixes while downtime bleeds into dollars.

            Routine patching does more than fix vulnerabilities. It helps you stay calm when things get stressful. This steady discipline keeps your operations running smoothly, even when others are scrambling.

            Final Thoughts

            Security, like nutrition, doesn’t come from sudden bursts of inspiration. It comes from doing the same things regularly. The calm, controlled and protected environment you want later depends on the boring discipline you practice now.

            Stay consistent, use automation thoughtfully, and patch your systems the way you meal prep: always ahead of time. This is how you keep both your systems and your peace of mind when things get tough.

            The Cloud’s Silent Killer: Misconfigured Defaults

            shannon cloud security

            In 2023, a single misstep by a Fortune 500 company left millions of customer records exposed simply by making a storage bucket public. This wasn’t an isolated incident. Misconfigurations like this are now the leading cause of devastating cloud data breaches, costing companies their reputation, customers’ trust, and millions in losses.

            When you think of a data breach, you might envision elite hackers executing sophisticated attacks. However, the reality is far more alarming and preventable. Most breaches are the result of basic, avoidable misconfigurations, such as open buckets and overly broad permissions. These are mistakes anyone can make, and attackers are counting on it.

            It’s tempting to trust default settings, they feel safe, like the standard path everyone takes. But most cloud defaults are built for quick setup, not lasting security. If you let them go unchecked, you’re leaving the door wide open for disaster.

            The Usual Suspects

            Let’s talk specifics. Over and over again, these defaults show up in post-mortem reports:

            • Open storage buckets and blobs: Data storage left publicly accessible, sometimes with read and write permissions wide open. Attackers do not need to guess. They simply scan and find these vulnerabilities.
            • Overly permissive IAM roles: The infamous *:* permission set (which allows access to all resources), granting far more access than necessary. It only takes one compromised credential to turn this into a complete takeover of the environment.
            • Unrestricted security groups: Allowing traffic from “anywhere, any time” because it worked during testing… and then nobody locked it down.

            These aren’t rare oversights. They’re everywhere, so common that attackers make a living scanning the internet for them. If you don’t fix them, it’s only a matter of time before someone else finds them first.

            Why Defaults Are So Dangerous

            1. They lure you into a false sense of security, making you believe all is well until it’s far too late.
              Teams assume that “default” means “safe enough.” But in reality, cloud vendors prioritize usability over airtight security.
            2. They scale the wrong way.
              What seems harmless in one instance becomes catastrophic when duplicated across dozens of accounts, regions, and services.
            3. They’re hard to spot once deployed.
              Without deliberate reviews, defaults blend into the noise. They look “normal,” even when they’re wide open.

            Breaking the Cycle

            So how do you stop defaults from turning into disasters?

            • Audit your configurations against standards. Frameworks like CIS Benchmarks exist for a reason. They help ensure your usual settings are not leaving the door wide open.
            • Enforce least privilege from the start. Treat it as your default stance. Add access only when necessary, and remove it just as quickly.
            • Build guardrails into Infrastructure as Code. With tools like Terraform, CloudFormation, or ARM templates (methods for defining infrastructure settings in code), you can embed security policies that prevent dangerous defaults from being introduced unnoticed.
            • Automate reviews and alerts. Cloud-native tools (such as AWS Config, Azure Policy, or GCP Security Command Center services) and third-party scanners can flag risky defaults before attackers do.

            The Martial Arts Parallel

            In martial arts, the stance you start with can determine the fight. A weak stance means you begin off balance before your opponent moves.

            Cloud defaults work the same way. If you start with insecure settings, attackers already have the upper hand before you realize there’s a problem.

            Closing Thoughts

            The cloud makes it easy to move quickly, but speed without careful planning can be risky. Default settings may save you time, but they also make things much easier for attackers. Cloud security is not about dramatic battles or brilliant hackers. It is about consistently following basic best practices. Never assume that default means secure. Take responsibility and set your own standards.

            Don’t wait for a wake-up call. Spend just 30 minutes this week: review one bucket, one IAM role, and one security group. Fix even a single misconfiguration. Share what you learn with your team. Every small action strengthens your cloud’s defenses and protects what matters most: your customers, your business, and your reputation.