Tempo Is a Weapon: Dislocating the Adversary in Incident Response
In the boardroom, we discuss cybersecurity as if it were a construction project. We speak of "architectures" and "perimeters." We allocate budget to build walls higher and moats deeper. The prevailing mental model is medieval: we are the castle, static and fortified; the hacker is the barbarian at the gate.
This metaphor is dangerous because it is static. It ignores the fundamental reality of the conflict. Cyber warfare is not a siege; it is a race. It is a contest of speed, maneuver, and adaptation. The winner is not the side with the thickest walls, but the side that can cycle through the OODA Loop—Observe, Orient, Decide, Act—faster than the other.
Right now, the attacker is winning the race. They move with the fluidity of water, while corporate defenses move with the viscosity of molasses. To change this dynamic, we must stop thinking about security as a state of being and start thinking about tempo as a weapon.
The Anatomy of an Attack: A Series of Decisions
We tend to mythologize the adversary. We imagine a hooded genius who types a single command and—poof—the database is gone. The reality is far more mundane and bureaucratic. A sophisticated attack is a project plan. It requires a sequence of logical steps, each demanding a specific decision.
Consider the ransomware operator. They do not just "hack." They:
Observe: Scan your network for vulnerabilities.
Orient: Analyze the scan results. Is this a test server or a production payment gateway? Is there a patch missing?
Decide: Choose the exploit tool that matches the vulnerability.
Act: Launch the payload.
Then they wait. They see if it worked. If they get in, the loop restarts. They observe the new internal environment. They orient themselves to the network topology. They decide where to move laterally.
This process takes time. It generates noise. And crucially, it requires the attacker to make assumptions about the reality of your network. This is where the defender's opportunity lies. If we can disrupt their orientation—if we can change the network's reality faster than they can understand it—we induce confusion. We force them to slow down, to second-guess, to make mistakes.
Dislocation: The Art of Breaking the Loop
Colonel John Boyd, the father of the OODA Loop, argued that the ultimate goal of conflict is not just to be faster, but to "dislocate" the enemy. You want to present them with a sudden, unexpected change that renders their previous decision irrelevant.
In a cyber context, dislocation means creating an environment hostile to the attacker's cognitive processes. It means moving the furniture while the lights are out.
Most organizations operate with static infrastructure. IP addresses rarely change. Admin credentials remain valid for months. Servers run for years without being wiped. This stasis is a gift to the attacker. It allows them to build a perfect map of your territory. They can take their time orienting because they know the ground won't shift beneath their feet.
To seize the initiative, we must introduce dynamic friction.
1. The Moving Target (Ephemeral Infrastructure)
Why does a server need to exist for three years? In the age of cloud computing, a server can live for three hours.
Imagine an attacker spends two days quietly mapping your payment processing cluster. They identify a specific server, IP 10.0.0.5, as their target. They Orient, they Decide. Just as they are about to act, the server is destroyed. The application is redeployed to a fresh instance at IP 10.0.0.98.
The attacker strikes empty air. Their map is obsolete. They are forced to restart their OODA loop from the beginning: Observe again, Orient again.
By aggressively rotating credentials, "rehydrating" servers from known-good images daily, and randomizing memory layouts, we strip the adversary of their most precious asset: certainty. We turn the network into a kaleidoscope.
2. Deception as a Tempo Breaker
Speed isn't just about how fast we move; it's about how slow we can force them to move. We can drag down the adversary's tempo by polluting their observation phase with garbage data.
This is the domain of deception technology. We plant "honeytokens"—fake credentials, fake database entries, fake servers—throughout the environment.
When an attacker scans the network (Observe), they don't see 50 servers; they see 500. Which ones are real? They cannot know. This forces them to pause (Orient). They must tread carefully. Every door they kick open might be a trap that alerts the security team.
The psychological impact is profound. When an intruder knows the environment is rigged, they become hesitant. Their decision cycle elongates. They spend hours verifying targets that used to take minutes. That delay gives the defenders the one thing they rarely have: oxygen.
Compressing the Defender's Loop: The "Decide" Bottleneck
While we work to slow the adversary, we must ruthlessly accelerate our own cycle. The bottleneck in most corporate defense programs is not technology; it is the "Decide" phase.
We have great tools for "Observing" (SIEMs and EDRs). We have decent capability for "Acting" (firewalls, isolation scripts). But connecting the two usually requires a human analyst to stare at a screen, interpret a graph, and ask permission to press a button.
This manual bridge is too slow.
To win on tempo, we must pre-authorize machines to make low-risk decisions. If a laptop attempts to connect to a known command-and-control server in North Korea, why does a human need to review that alert? The risk of blocking the connection is near zero. The risk of allowing it is catastrophic.
Automated containment—the machine-speed execution of the "Act" phase—is the only way to close the loop faster than a computerized attack script. It requires a shift in leadership mindset. We must accept the occasional operational hiccup (a legitimate laptop briefly gets isolated) as the cost of doing business, rather than the alternative of a successful breach.
Governance in a High-Tempo World
For Board members and senior risk officers, this shift requires a new vocabulary of success. The metrics currently filling dashboard slides—"Patches Applied," "Training Completed," "Alerts Closed"—are artifacts of a static, medieval mindset. They measure effort, not efficacy.
To govern for tempo, you must ask different questions:
"What is our Mean Time to Disruption?" Don't just ask how fast we detect. Ask how fast we can break the attacker's stride once they are inside.
"What is the Adversary Dwell Time?" How long can a stranger live in our house before we find them? If this number is measured in months (and it often is), we have already lost the tempo war.
"How much of our infrastructure is immutable?" Are we patching sick servers and nursing them back to health (slow, risky), or are we shooting them and replacing them with healthy clones (fast, decisive)?
The Final Analysis
We cannot build a wall high enough to keep everyone out. The complexity of modern software guarantees that vulnerabilities will exist. If we accept that the enemy will eventually enter the perimeter, the strategy must shift from "prevention" to "maneuver."
We must become a moving target. We must create a maze of shifting corridors and false doors. We must decide and act at machine speed.
Tempo is not just a tactical advantage; it is the primary determinant of survival. In a fight between a bear and a viper, the bear has all the strength, but the viper has the tempo. Corporate security has spent forty years trying to be a bigger bear. It is time to become the viper.
