Security Brutalism

Most organizations have security programs that look complete, with tools, dashboards, audits, and compliance reports covering every angle on paper. Attackers still get in through phishing, stolen credentials, and unpatched systems, because that complexity never protected anything. It produced noise instead.

Security Brutalism rests on a single requirement, that every control has to justify itself by reducing susceptibility or limiting damage. A control that does neither expands the attack surface, since no complexity stays neutral.

The model runs on survivability engineering, which evaluates every system across three dimensions. Susceptibility covers the realistic attack paths through actual identities, data flows, and trust relationships as they exist, not as they're documented. Damage defines the blast radius if a system is compromised, and what an attacker can reach from there. Recovery time measures how fast a team detects, contains, and restores, and whether that speed has been tested or only assumed.

The operating assumption is that entropy stays constant. Security starts degrading the moment a system goes live, as teams change, integrations accumulate, and controls drift. Survivability engineering accepts this pattern and designs for it instead of against it.

Four disciplines carry the model. Know is a living inventory of every identity, trust relationship, and data flow, since susceptibility can't be measured without it. Harden works by subtraction, stripping out every tool, policy, and integration that doesn't reduce susceptibility or limit blast radius, aiming for deliberate simplicity rather than accumulated control coverage. See is detection that reveals a compromise while it's still happening, before it spreads, built on behavioral monitoring, real-time anomaly detection, and deception assets, with speed of awareness as the real measure of success. Recover is tested restoration under stress, using kill switches, immediate access revocation, practiced incident response, and chaos engineering, judged by how long a system stays stuck in a failed state.

Security Brutalism asks a sharper question than whether a program satisfies stakeholders: when you get hit, and you will, do you survive it?