The Problem with the Old Model
CVSS scores severity in the abstract. It knows nothing about whether the vulnerable asset is internet-reachable, whether it sits on the kill chain, whether an exploit exists in the wild, or whether a compensating control already neutralises it. Sorting 40,000 findings by CVSS produces a list precisely uncorrelated with where an attacker will actually go.
The 2026 Verizon DBIR confirms vulnerability exploitation is now the leading initial-access vector — roughly twice phishing. This is not a maturity problem solved with more analysts. It is a model that has run out of road.
There is a subtler failure even in kill-chain thinking. Breaking the weakest link on the shortest attack path does not sever anything — it promotes the second-shortest path. The object that actually severs an estate is a cut: the set of interventions after which no mapped path from entry point to crown jewel survives. A chain is something you can point at. A cut is something you can compute, price, and close.
What It Delivers
Kill Chain Assessment
The Kill Chain Assessment app maps your environment as an attack graph — every state an attacker can hold, every move between them — and weights each move twice: what it costs the adversary, and what it costs you to remove. It then computes the minimum-cost cut: the cheapest set of interventions that severs every mapped path to the crown jewels. The cut routinely contains links the shortest-path view never surfaces, and omits links that view calls critical.
The ~90% Subtraction
Roughly 90% of "critical" vulnerabilities sit on no path to anything existential once compensating controls, reachability, and segmentation are mapped. For those, the remediation cost is real and the existential impact is zero — the arithmetic says net-harmful, not merely low priority. This subtraction turns "40,000 criticals" into the few interventions that actually sever mapped paths. It is the highest-leverage move in the programme and it is pure deletion.
Five Classes of Work
Hour-cut: In the cut set, reachable, exploit live. Response is a compensating control — sever reachability, block at the edge, isolate — not the patch. No vendor patch cycle meets a four-hour window.
Day-cut: In the cut set, material but not racing. One change window, verified before closure.
Sprint-cut: In the cut set, no urgency. Normal engineering rhythm — this is where patch velocity is the correct tool.
Dark: Reachability or exploitability unknown. Route to discovery — characterise before remediating.
Declined: On no path to a jewel. A documented, owned risk acceptance with a review trigger — not a backlog item quietly aging.
Zero-Budget Vulnerability Discovery
osquery deployed as a sovereign discovery platform alongside scripted checks for the findings scanners miss — service account privileges, unpatched firmware, container base image CVEs, exposed management interfaces. Discovery before scanner procurement is almost always sufficient to find the cut.
Cut Depth as the Metric
The programme does not measure MTTR. It measures cut depth (κ) — the number of independent successes an adversary needs. A κ of 1 means one compromised service account ends the business; the engagement target is 4 or better. κ is reported alongside kill-chain length and the count of unmapped edges, because a cut is only as honest as the graph beneath it. And every cut closes with a verification signal — an unverified removal is a ghost cut: fully traversable, and now invisible.
The Barbell
The antifragile TVM programme has two ends and a middle to avoid — and with costed cuts, the shape is derived rather than asserted. Fast end: hours-lane compensating controls — edge blocks, isolation, reachability cuts — that win the time race a patch cannot. Structural end: segmentation, least privilege, and T0 protection that make most vulnerabilities irrelevant before they are disclosed. The fragile middle to avoid: the aging critical-patch backlog that carries hours-lane urgency while moving at sprint-lane speed. It is not forbidden by doctrine — it simply never wins the arithmetic.
Scope and Prerequisites
| Duration | 45–90 days |
| Environment | Any (cloud, on-premises, hybrid) |
| Prerequisites | Module 0 (Diagnostic) to establish the estate graph and initial cut; asset inventory from Modules 1 or 6 |
| Natural follow-on | Module 10 (Red Team & Validation) to validate that severed paths stay severed |
Stop racing an attacker you cannot outrun
The winning move is not to patch the long tail faster. It is to make most of it not matter — and contain the few that do in hours, not weeks.