The Art of War endures because it treats victory as a product of preparation, knowledge, position, and adaptation—not theatrical force. In cybersecurity, the lesson is immediate. Defenders do not choose when every encounter begins, but they can shape the terrain on which it unfolds.
Know the mission, then know the terrain
An inventory is not paperwork; it is terrain intelligence. Identity paths, internet exposure, dependencies, privileged accounts, data flows, third parties, recovery time, and operational technology define where an attacker can move and what the mission cannot afford to lose. A risk register without this map is a list of anxieties.
NIST CSF 2.0 turns that knowledge into an enterprise language: Govern the risk, Identify what matters, Protect critical capabilities, Detect adverse activity, Respond with coordination, and Recover the mission. MITRE ATT&CK adds the adversary view by organizing observed behaviors. One describes outcomes; the other helps us reason about hostile movement.
Win by removing cheap options
Good architecture changes the economics of attack. Phishing-resistant authentication removes a class of easy identity compromise. Segmentation reduces lateral movement. Secure defaults eliminate forgotten exposure. Tested recovery takes extortion leverage away. Logging and behavioral detection make stealth more expensive. These controls do not promise invulnerability; they reduce the adversary’s freedom while preserving ours.
Deception, uncertainty, and disciplined truth
Attackers conceal intent. Defenders must not answer uncertainty with fiction. Separate confirmed evidence from hypothesis. Label attribution confidence. Use threat intelligence to guide collection and priorities, not to decorate a briefing. Strategic clarity depends on leaders who can say both “this is what we know” and “this is what would change our assessment.”
Command intent, decentralized action
Incidents move faster than approval chains. Teams need a clear mission, bounded authority, prepared playbooks, tested communications, and known escalation thresholds. Executive command intent should be simple: preserve life and safety, contain harm, protect evidence, sustain essential services, communicate honestly, and recover deliberately.
- Observe: maintain current terrain and threat awareness.
- Position: place controls where they remove adversary options.
- Rehearse: test decisions under incomplete information.
- Adapt: convert every incident and exercise into changed practice.
Superior cyber leadership is not the loudest response. It is the condition in which the organization can act clearly while the adversary loses room to maneuver.
Weekend action
Pick one crown-jewel service. Draw the attack path from external identity to privileged control to data or operations. Mark every point where detection, denial, or recovery changes the outcome. Fund the control that removes the largest number of adversary choices.