PRIVILEGE DISRUPTION
Doctrine of Record · v1.2

Privilege Disruption

DENY THE CONVERSION OF ACCESS INTO CONTROL.

Reshaping adversary behavior by disrupting the privilege and Execution Authority required to turn access into persistence, privilege escalation, lateral movement, operational control, and impact.

Explore the Doctrine ↓ Read Attack Stories →
Start here

The Doctrine in 3 Questions

A simple path from concept to operational meaning.

01 · PD-D01

What is Privilege Disruption?

Deny the conversion of access into control.

A cybersecurity doctrine focused on the privilege and Execution Authority a threat actor needs to advance an operation.

Operational meaning: Access is not the end state. Govern the privilege and authority required to turn presence into persistence, escalation, movement, and control.
02 · Strategic Problem

Why does it matter?

Threat actors may already have access. What authority remains?

Privilege debt increases the Execution Authority a successful compromise can inherit.

Example: One compromised identity may carry privilege the environment no longer needs. The intrusion earned the identity; the environment supplied the additional leverage.

AI-era implication: AI can accelerate the search for access. Privilege debt determines how much authority successful access inherits.
03 · PD-OC01–04

How does it operate?

Apply the doctrine continuously.

GovernHuntDisruptRetire
Govern known privilege and authority. Hunt for exposure and emerging authority paths. Disrupt illegitimate authority before it becomes control. Retire privilege that no longer has an operational purpose.

“Privilege Disruption is the doctrine that gives defenders the playbook to proactive cyber defense.”

State Agency Cyber Defender
Doctrine of Record

10 Foundational Principles

What must remain true regardless of technology, actor type, or implementation.

Core mechanics

The Authority Model

Privilege and Execution Authority are related, but not interchangeable. The model holds across human, non-human, automated, and agentic actors.

PD-C06IdentityWho or what is acting.
PD-C01PrivilegeThe entitlement attached to the actor.
PD-C07Capability / ToolThe mechanism through which privilege is exercised.
PD-C02Execution AuthorityWhat the actor can actually cause to happen.
ActionActionThe exercise of authority.
ImpactImpactThe resulting operational or mission consequence.
Privilege Debt Excess Privilege → Excess Inheritable Execution Authority Debt increases how much authority can be inherited when a debt-bearing identity is compromised.

“No more stops at the fuel pump to refuel, privilege disruption increases the cost to refuel.”

Federal Defense Contractor

“Disrupting privilege brings control to the agent chaos we seeing with AI-enabled cyberattack.”

State Agency CISO
Defender Intelligence Continuum

Move left of the attack story.

Connect known privilege exposure to runtime contact, warning, and response without waiting for adversary consequence to become the first useful signal.

Latent → Contact → Warning → Spent

IoPE tells you what the environment already makes possible.

Explore the canonical IoPE/WoPE catalog, see declared exposure-to-warning relationships, and understand where Contact Point and IoPC create a defender intelligence layer before authority is spent.

Explore Defender Intelligence →
Architectural relationship

Privilege Disruption + Zero Trust

Privilege Disruption extends the security question beyond the access decision.

Zero Trust

Should this actor be trusted to access this resource?

Zero Trust governs the decision to grant access under specific conditions.

Privilege Disruption

What authority remains after access is granted?

And can that authority be prevented from becoming adversary control?

Read the Prologue

See the Doctrine in the Wild

The doctrine explains the model. Attack stories show how privilege, debt, authority, and control appear in real campaigns.

“Every cyberattack has a prologue, hunting in it is responsive cyber defense.”

University IT Security Director
Doctrine → Evidence

Read the doctrine against real attack stories.

Cyber Prologue cases show what authority existed before compromise, how that authority was inherited or composed, where controls held, and where Privilege Disruption could have changed the story.

Explore the case collection →
Attack Story

Salt Typhoon

PD-P07 · DebtPD-P03 · Authority

Explore the conditions that existed before compromise and the privilege paths that made the operation consequential.

Read story →
Attack Story

Taiwan Agentic

PD-P05 · AIPD-P07 · Debt

See how AI-driven activity intersects with privilege, inherited authority, and attack progression.

Read story →
Attack Story

Hugging Face

PD-P09 · CompositionPD-P10 · Recurrence

Trace the Prologue, privilege conditions, and Execution Authority that shaped the attack story.

Read story →