Security Brutalism

Most organizations have security programs that look complete. Tools, dashboards, audits, compliance reports. Attackers still get in through phishing, stolen credentials, and unpatched systems, because the complexity was never protection. It was noise.

Security Brutalism is built around a single requirement: every control has to justify itself by reducing susceptibility or limiting damage. If it does neither, it expands the attack surface. There is no neutral complexity.

The model runs on survivability engineering, which evaluates every system across three dimensions. Susceptibility covers the realistic attack paths through actual identities, data flows, and trust relationships as they exist, not as they're documented. Damage defines the blast radius if a system is compromised and what an attacker can actually reach from there. Recovery time measures how fast you detect, contain, and restore, and whether that speed has been tested or only assumed.

The operating assumption is that entropy is constant. Security starts degrading the moment a system goes live, as teams change, integrations accumulate, and controls drift. Survivability engineering accepts this and designs for it rather than against it.

The four disciplines are Know, Harden, See, and Recover. Know is a living inventory of every identity, trust relationship, and data flow, because susceptibility can't be measured without it. Harden is subtractive: remove every tool, policy, and integration that doesn't reduce susceptibility or limit blast radius, with deliberate simplicity as the goal rather than accumulated control coverage. See is detection that tells you a compromise is happening before it spreads, through behavioral monitoring, real-time anomaly detection, and deception assets, with speed of awareness as the metric. Recover is tested restoration under stress, through kill switches, immediate access revocation, practiced incident response, and chaos engineering, with time in a failed state as the metric.

Security Brutalism is not about building a program that satisfies stakeholders. The question it asks is: when you get hit, and you will, do you survive it?