Attack-and-recovery engineering

Engineering disciplines specify an outcome, instrument the system, attack the assumption, measure what happens, and improve. This pillar applies that sequence to cyber resilience and collects the evidence needed before any composite score can honestly be defined.

The intervals that decide the loss

Prevention determines whether an intrusion starts. Detection, understanding, containment, and recovery determine how much it costs. Most programs report heavily on the first and thinly on the rest.

The clock an attack actually runs on

An intrusion moves from first action through detection, understanding, containment, recovery, and verification. Each interval can be measured and tested.

The candidate scorecard

These are the measurements the pillar is collecting evidence about. Inclusion here is a proposal, not a finding. Several are likely to prove weak once compared against real outcomes.

Table 1. Candidate measures under study. No weighting is proposed yet.
Measure	Definition	How it is demonstrated
Mean time to detect	First attacker action to first accurate alert	Injected activity in production, measured against the alert record
Mean time to understand	Alert to a correct account of scope and path	Timeline reconstruction after exercises and real events
Mean time to contain	Understanding to the point spread stops	Timestamped containment actions during drills
Mean time to recover	Containment to validated service restoration	Timed restore into a clean environment with business sign-off
Demonstrated RPO	Data loss actually incurred in a tested restore	Comparison of restored state against the last known good state
Demonstrated RTO	Elapsed time in a tested restore, not the target	The clock on the drill
Blast radius	Systems and data reachable from one compromised identity	Attack-path analysis, confirmed by attempt
Repeat vulnerability rate	Share of findings of the same class recurring	Longitudinal finding records
Finding to verified remediation	Time from discovery to retested closure	Retest evidence, not ticket closure
Tested restoration coverage	Share of critical systems with a passed restore in period	Restore register
Tested containment coverage	Share of critical identities with a rehearsed containment path	Drill register
Machine-verifiable evidence	Share of controls with automated evidence	Evidence pipeline inventory

A Measured Attack-and-Recovery Resilience Score

A fair comparison may eventually be possible. There is no formula yet because the underlying measures have not been validated. Publishing weights now would give guesswork a tidy number.

The open questions are which measures carry independent signal, how to normalise for size and sector, how to treat unknowns so they cannot be scored as neutral, and whether a single composite is even useful compared with a small dashboard of four or five numbers.

Measures that may belong in a resilience score

The research is testing detection time, containment time, recovery, identity reach, repeated findings, and the share of controls checked by machines. No weights have been set.

What would prove us wrong?

The pillar assumes these intervals are measurable, comparable, and predictive.

Evidence that measured detection and containment times vary more with attacker sophistication than with defender capability, making cross-organisation comparison meaningless.
Results showing that organisations optimise the measured intervals at the expense of unmeasured harm, for example containing quickly by destroying evidence needed for notification.
Outcome data where recovery capability, not detection speed, explains nearly all the variance, which would justify collapsing much of the scorecard.