Research program
Attack-and-recovery engineering
Engineering disciplines specify an outcome, instrument the system, attack the assumption, measure what happens, and improve. This program applies that sequence to cyber resilience and collects the evidence needed before any composite score can honestly be defined.
Which measurements actually predict whether an organisation survives an attack?
The intervals that decide the loss
Claim: observation
Prevention determines whether an intrusion starts. Detection, understanding, containment, and recovery determine how much it costs. Most programs report heavily on the first and thinly on the rest.
The candidate scorecard
Claim: hypothesis
These are the measurements the program is collecting evidence about. Inclusion here is a proposal, not a finding. Several are likely to prove weak once compared against real outcomes.
| Measure | Definition | How it is demonstrated |
|---|---|---|
| Mean time to detect | First attacker action to first accurate alert | Injected activity in production, measured against the alert record |
| Mean time to understand | Alert to a correct account of scope and path | Timeline reconstruction after exercises and real events |
| Mean time to contain | Understanding to the point spread stops | Timestamped containment actions during drills |
| Mean time to recover | Containment to validated service restoration | Timed restore into a clean environment with business sign-off |
| Demonstrated RPO | Data loss actually incurred in a tested restore | Comparison of restored state against the last known good state |
| Demonstrated RTO | Elapsed time in a tested restore, not the target | The clock on the drill |
| Blast radius | Systems and data reachable from one compromised identity | Attack-path analysis, confirmed by attempt |
| Repeat vulnerability rate | Share of findings of the same class recurring | Longitudinal finding records |
| Finding to verified remediation | Time from discovery to retested closure | Retest evidence, not ticket closure |
| Tested restoration coverage | Share of critical systems with a passed restore in period | Restore register |
| Tested containment coverage | Share of critical identities with a rehearsed containment path | Drill register |
| Machine-verifiable evidence | Share of controls with automated evidence | Evidence pipeline inventory |
A Measured Attack-and-Recovery Resilience Score
Claim: unknown
A fair comparison may eventually be possible. There is no formula yet because the underlying measures have not been validated. Publishing weights now would give guesswork a tidy number.
The open questions are which measures carry independent signal, how to normalise for size and sector, how to treat unknowns so they cannot be scored as neutral, and whether a single composite is even useful compared with a small dashboard of four or five numbers.
What would prove us wrong?
Claim: unknown
The program assumes these intervals are measurable, comparable, and predictive.
- Evidence that measured detection and containment times vary more with attacker sophistication than with defender capability, making cross-organisation comparison meaningless.
- Results showing that organisations optimise the measured intervals at the expense of unmeasured harm, for example containing quickly by destroying evidence needed for notification.
- Outcome data where recovery capability, not detection speed, explains nearly all the variance, which would justify collapsing much of the scorecard.
Experiments for this program
- Measure the real detection interval How long does it take to notice activity that a deployed control claims to detect?
- Timed restore into a clean environment What is the demonstrated recovery time and data loss for a critical system?
- Blast radius of one ordinary identity What can be reached from a single compromised workstation account?
Patterns and anti-patterns
- Score unknown as red (pattern)
Evidence for this program
- NIST Cybersecurity Framework 2.0 Organises outcomes across govern, identify, protect, detect, respond, and recover. Used here as a requirement source, not as evidence of effect.
- NIST SP 800-61, computer security incident handling guide The reference model behind the detection, containment, and recovery intervals this area measures.
- MITRE ATT&CK The behaviour catalogue used to select techniques for detection and containment measurement.
- Operational Truth The intended, reported, recorded, inferred, observed, and verified distinction used throughout this area.
Research notes
Put the last demonstrated RTO beside the target
A recovery objective is a statement of intent written during planning. The useful number is the one produced by the last real restore, with the date attached.
Do not publish a resilience formula yet
People often ask for one weighted score. Publishing it before the measures are validated would give an untested formula the look of certainty. This note recommends publishing the measures and the unanswered questions until results show which measures tell us something on their own.
Measure the time between each response step
The note recommends measuring the time between response steps rather than counting incidents, because intervals can be generated on demand and compared quarter to quarter, which incident counts cannot. Incident counts depend on how hard an organisation looks. Detection, containment, and recovery intervals can be generated on demand and compared over time.