PRIVILEGE DISRUPTION
The Cyber Prologue

Doctrine Lens · CP-003

What Hugging Face makes visible

The canonical case record remains governed by its CP identifiers, evidence bands, ownership boundaries, and source discipline. This layer connects those findings to the Privilege Disruption Doctrine of Record without changing the evidence.

PD-P05

AI Accelerates

The agent increased the speed, autonomy, and persistence with which available authority could be discovered and exercised.

PD-C04

Composite Execution Authority

Reachability, catalogue disclosure, shared credentials, and highest-privilege bindings combined into cross-cluster control.

PD-P07

Debt is Leverage

Standing and credential debt concentrated downstream authority that became available after compromise.

PD-P09

Composition

No single connector setting was catastrophic. The combination of legitimate capabilities became consequential.

PD-P10

Reach + Recurrence

A reusable mesh enrollment key enabled repeated enrollment and turned one stolen secret into a renewable position.

CASE AUTHORITY PATHEvaluation → Launchpad → Processing → Cluster → Mesh / Cloud → Supply Chain
PD-C04 Composite Execution AuthorityPD-P05 AI AcceleratesPD-P09 CompositionPD-P10 Reach + Recurrence
View Foundational PrinciplesBrowse Attack Stories

The case spans multiple estates. The Doctrine Lens preserves those ownership boundaries rather than assigning all pre-existing conditions to the target.

← All Attack Stories
Case thesis

The prologue is what was already true. The attack story is the adversary spending it. The boundary is what was there when it tried.
Evidence discipline

The band reflects the source, not the stakes

Band describes how strongly the source establishes that a condition exists. Realization describes whether its consumption is documented. They are independent axes and are never collapsed.

No anchor is a valid state. It is counted, not filled in.

“Every cyberattack has a prologue, hunting in it is responsive cyber defense.”

University IT Security Director
Evidence family 1

Prologue catalog

Conditions that supplied latent execution authority before the campaign consumed it. Admission is supply-side only: a condition qualifies if, when exploited or consumed, it supplies authority the adversary can acquire, retain or propagate. Controls that withhold authority are in the boundary family, not here.

IDBandRealizationConditionDebtPlaneSpent by
Evidence family 2

Attack story catalog

Adversary behavior documented by the source, each pointing back to the prologue conditions it spent, with the relationship typed. Records with no source-supported anchor are marked and counted rather than assigned one.

IDBandBehaviorPD QTacticATT&CKAnchors
Invariant analysis

The three questions

Case-invariant. Every case answers these.
Privilege debt

Six categories, always rendered

Every total carries the evidence composition that produced it.

Case-specific rendering

Privilege planes and plane jumps

Select a plane to see the records that touch it.

Plane jump. A case-specific visualization of execution authority changing domains as the adversary converts one form of inherited authority into another. It is a rendering of execution authority geometry, not a doctrinal entity. A cloud, SaaS, OT or agentic case renders its own geometry against the same invariant spine.

Defender operating cycle

Govern, hunt, disrupt, retire

Each phase names the prologue records it acts on.
Govern the acceptable prologue. Hunt the actual one. Disrupt at the crossing. Retire the debt that wrote it.
Method

Bands, states, relationships and rules

Prologue evidence bands
Attack story evidence bands
Standing rules
    Source families
    Continue the collection

    Related Cyber Prologue stories

    CP-002Taiwan AgenticA near-autonomous campaign where AI changes speed and parallelism.CP-001Salt TyphoonA nonlinear authority graph across network, identity and control domains.