An adversary mind map, one of many¶

A network is not a collection of hosts. It is positions, identities, dependencies, trust relationships, and the paths between them. The useful question is not only what exists, but what can become reachable, what can be changed, what will be observed, and how the environment will respond.

An adversarial approach begins with uncertainty. A foothold provides a place to look. Observation becomes information. Information becomes findings. Findings become paths. Paths become positions. Each move changes the terrain and updates the map used for the next decision.

The process is not a march from access to outcome. A new position may reveal more questions than answers. A costly move may return the operation to observation rather than progress. A finding may become valuable only after another relationship is discovered. A defensive response may close one route while changing the value of another.

Every action rewrites two maps. One records the changing understanding of the environment: what is reachable, what is valuable, what remains possible. The other records the changing understanding of the operation: what has been observed, what patterns have become suspicious, and where future activity may attract attention.

The techniques vary across the terrain: enterprise networks, industrial environments, cloud platforms, and applications. The reasoning remains consistent. An adversarial process is a continuous cycle of observation, movement, consequence, and revision.