Security Brutalism

Most organizations have security programs that look complete. Tools, dashboards, audits, compliance reports. Attackers still get in through phishing, stolen credentials, and unpatched systems. The complexity wasn't protection. It was noise.

Security Brutalism cuts to what actually works. Every control has to justify itself by reducing susceptibility or limiting damage. If it doesn't do either, it's attack surface. There is no neutral complexity.

The model is built around survivability engineering, which evaluates every system across three dimensions: susceptibility (realistic attack paths through actual identities, data flows, and trust relationships as they exist, not as they're documented), damage (blast radius if compromised and what an attacker can actually reach), and recovery time (how fast you detect, contain, and restore, and whether that has been tested or just assumed).

The operating assumption is that entropy is inevitable. Security starts degrading the moment a system goes live. Teams change, integrations accumulate, controls drift. Survivability design accepts this and builds for it.

The four disciplines are Know, Harden, See, and Recover.

Know is a living inventory of every identity, every trust relationship, every data flow. You cannot measure susceptibility without it, and you cannot defend what you cannot see.

Harden is subtractive. Remove every tool, policy, and integration that doesn't reduce susceptibility or limit blast radius. The goal is deliberate simplicity, not accumulated control coverage.

See is detection that tells you a compromise is happening before it spreads. Behavioral monitoring, real-time anomaly detection, deception assets. The metric is how fast you know.

Recover is tested restoration under stress. Kill switches, immediate access revocation, practiced incident response, chaos engineering. Not annual pen tests that produce reports no one acts on. The metric is how long you stay failed.

Security Brutalism is not about building a program that satisfies stakeholders. The question it asks is different: when you get hit, and you will, do you survive it?