PRIVILEGE DISRUPTION
Doctrine of Record · v1.2

Privilege Disruption

DENY THE CONVERSION OF ACCESS INTO CONTROL.

Reshaping adversary behavior by disrupting the privilege and Execution Authority required to turn access into persistence, privilege escalation, lateral movement, operational control, and impact.

Explore the Doctrine ↓ Read Attack Stories →
Start here

The Doctrine in 3 Questions

A simple path from concept to operational meaning.

01 · PD-D01

What is Privilege Disruption?

Deny the conversion of access into control.

A cybersecurity doctrine focused on the privilege and Execution Authority a threat actor needs to advance an operation.

Operational meaning: Access is not the end state. Govern the privilege and authority required to turn presence into persistence, escalation, movement, and control.
02 · Strategic Problem

Why does it matter?

Threat actors may already have access. What authority remains?

Privilege debt increases the Execution Authority a successful compromise can inherit.

Example: One compromised identity may carry privilege the environment no longer needs. The intrusion earned the identity; the environment supplied the additional leverage.

AI-era implication: AI can accelerate the discovery and exercise of available authority. Privilege debt determines how much authority a successful compromise can inherit.
03 · PD-OC01–04

How does it operate?

Apply the doctrine continuously.

GovernHuntDisruptRetire
Govern known privilege and authority. Hunt for exposure and emerging authority paths. Disrupt illegitimate authority before it becomes control. Retire privilege that no longer has an operational purpose.

“Privilege Disruption is the doctrine that gives defenders a playbook for proactive cyber defense.”

State Agency Cyber Defender
Doctrine of Record

10 Foundational Principles

What must remain true regardless of technology, actor type, or implementation.

Core mechanics

The Authority Model

Privilege and Execution Authority are related, but not interchangeable. The model holds across human, non-human, automated, and agentic actors.

PD-C06IdentityWho or what is acting.
PD-C01PrivilegeThe entitlement attached to the actor.
PD-C07Capability / ToolThe mechanism through which privilege is exercised.
PD-C02Execution AuthorityWhat the actor can actually cause to happen.
ActionThe exercise of authority.
ImpactThe resulting operational or mission consequence.
Privilege DebtExcess Privilege → Excess Inheritable Execution AuthorityDebt increases how much authority can be inherited when a debt-bearing identity is compromised.

“No more stops at the fuel pump to refuel. Privilege disruption increases the cost to refuel.”

Federal Defense Contractor

“Disrupting privilege brings control to the agent chaos we’re seeing with AI-enabled cyberattacks.”

State Agency CISO
Architectural relationship

Privilege Disruption + Zero Trust

Privilege Disruption extends the security question beyond the access decision.

Zero Trust

Should this actor be trusted to access this resource?

Zero Trust governs the decision to grant access under specific conditions.

Privilege Disruption

What authority remains after access is granted?

And can that authority be prevented from becoming adversary control?

“Shaping adversary behavior, introducing costs and consequences into this mix.”

Sean Cairncross, National Cyber Director · Source
Read the Prologue

See the Doctrine in the Wild

The doctrine explains the model. Attack Stories show how privilege, debt, authority, and control appear in real campaigns.

“Every cyberattack has a prologue. Hunting in it is responsive cyber defense.”

University IT Security Director

“These Attack Stories build on the MITRE ATT&CK knowledge base by helping defenders see what can be done before IoCs emerge and adversary techniques are realized. The opportunity to build resilience against adversary behavior often exists in the Prologue.”

Kevin E. Greene
Doctrine → Evidence

Read the doctrine against real Attack Stories.

Cyber Prologue cases show what authority existed before compromise, how that authority was inherited or composed, where controls held, and where Privilege Disruption could have changed the story.

Explore the case collection →
NEW IN ATTACK STORIES · R2.1

The Prologue expands into OT and new attack research.

Explore CP-004 Risevatnet, the collection’s first operational technology case, and CP-006 QTFY Infrastructure Quartermaster.

Explore the new stories ↓
CP-001 · Attack Story

Salt Typhoon

PD-P07 · DebtPD-P03 · Authority

Explore the conditions that existed before compromise and the privilege paths that made the operation consequential.

Read story →
CP-002 · Attack Story

Taiwan Agentic

PD-P05 · AIPD-P07 · Debt

See how AI-driven activity intersects with privilege, inherited authority, and attack progression.

Read story →
CP-003 · Attack Story

Hugging Face

PD-P09 · CompositionPD-P10 · Recurrence

Trace the Prologue, privilege conditions, and Execution Authority that shaped the attack story.

Read story →
CP-004 · Attack Story NEW

Risevatnet | OT

OT · Water ControlPD-P07 · Debt

A weakly held credential stood directly in front of remote valve-control authority, producing an unusually shallow path from access to physical consequence.

Read story →
CP-006 · Attack Story NEW

QTFY Infrastructure Quartermaster

Campaign InfrastructureAuthority Boundaries

Separates campaign-scale infrastructure, concealed reach and victim-side authority without collapsing multiple estates into one kill chain.

Read story →