The threat section is written conservatively on purpose. Gartner’s guidance for this exact briefing is to temper the fear, uncertainty and doubtGTNR and to help the organisation “ignore sensational marketing hype.”GTNR A strategy that overstates the threat gets discounted the first time someone checks it.

What is established

• Deepfake-enabled social engineering is the dominant vector — 41% of organisations on audio calls, 35% on video, and one in five biometric fraud attempts.GTNR It is the highest-prevalence vector in the published evidence and the one with the cheapest available mitigation.
• The vulnerability-to-exploit gap has collapsed from days to minutes, because frontier models can autonomously reverse-engineer patches into working exploits.GTNR
• AI is mostly being used to scale existing tactics, not to invent new ones.GTNR And LLM-driven vulnerability discovery “predates” the named frontier releases.GTNR

What is not yet established

So where does the agentic scenario belong?

As a forward scenario used for validation, not as the operative threat model. The worked example in the companion document — a documented intrusion carried out by an autonomous agent collective — remains the most useful exercise input we have, because it is real, externally adjudicated, and it stresses exactly the processes Gartner says are structurally misaligned.GTNR It earns its place under D1 as a validation scenario and under D2 as scenario planning — not as the basis for a threat claim.

The counterweight evidence, stated so nobody has to find it themselves

Two threats worth adding to the watch list

• Cognitive attack. “The next breach will be cognitive: Threat actors will abandon purely technical exploits in favor of influence operations, utilizing cutting-edge AI models to manipulate employee decision making and bypass traditional cybersecurity controls.”GTNR This is the strategic extension of the deepfake finding.
• Rogue automation from our own estate. “The proliferation of AI agents operating with broad agencies will create severe risks. Traditional centralized IT and third-party vendor management will be unable to oversee these agents.”GTNR Which is why D4’s runtime enforcement outcome matters more than it looks.

The four-domain structure, the domain definitions and each domain’s core benefit are Gartner’s.GTNR Ours is the adaptation to the enterprise: the outcomes per pillar, the ODM formulation, the maturity assessment, and the sequencing.

Four adaptations worth knowing about

The disagreement inside the corpus, disclosed

Two Gartner teams write about this in materially different registers. The Emerging Tech team describes “an arsenal of unprecedented sophistication against unprepared enterprises” and warns of “ruinous business loss”GTNR; the CxO Leadership team writes that “today, true AI-powered attacks remain very rare in the real world.”GTNR

Gartner’s outcome-driven metric construct is the measurement system for this entire strategy. It is not a reporting style — it is a way of turning security work into investment decisions. The stated purpose of a metric is blunt: “The value of a metric is its ability to influence decision making. The decisions influenced are typically priorities and investments.”GTNR

The five steps, as we applied them

The seven characteristics, used as filters

• Metric value — ability to influence a decision. Anything that could not change a priority or an investment was cut.
• Above the line, below the line — “only above-the-line metrics should be shared with executives.” Hence a seven-metric committee set distinct from the fifteen.
• Leading indicators — they must “expose a problem before it leads to material loss.” This is why validation coverage beats incident counts.
• Direct line of sight — “A causal relationship should exist… If the technology metric changes, it indicates a change in the business outcome.” Every metric on the page states its line of sight.
• Metric changes drive action — green to yellow to red must trigger “changing a priority or an investment.”
• Discrete audiences — “The CFO needs different metrics from those required by the head of a business unit or a board of directors.”
• Limit the number — five to nine per audience, which sets the committee set below.

The prioritisation rule that follows from all of it

“If there is no clear line of sight to a business outcome, then the technology investment should not be prioritized as it will drive little value to the organization.”GTNR Applied honestly, this is a test the programme must keep passing — and it is the reason adversarial-ML tooling stays deferred while deception and SOP hardening move to tranche 1.

Measures we rejected, and why

Every recommendation across the corpus that this programme can act on, deduplicated and attributed. This is the operational substance beneath the architecture.

Actions Gartner recommends, mapped to our domains

C2M2 maturity levels, assessed independently per domain and cumulatively within one — a practice at a level counts only if every lower practice is also achieved.ARCH CSF Tiers are deliberately not used as a maturity scale, because NIST does not define them that way.ARCH

The four MIL0 findings, with evidence

What we could not assess

• Existing gateway control efficacy — what our AI gateway control actually detects and whether it alerts is unverified.MIC Tranche 1 action.
• Detection engineering capacity — not established with the CSOC. Foundation ODM F.1 creates the baseline.
• SEMI standards alignment — adoption status unconfirmed.SEMI

Three tranches, weekly sprint execution beneath them. The most important structural point: this is explicitly not a transformation. Gartner: “This situation is not a repeat of Y2K and does not require a transformational response.”GTNR

Dependencies — the programme’s real critical path

The single most decision-relevant assessment in the engagement: the enterprise’s strongest control sits on the plane the reference intrusion would not have crossed.

The governed model and tool plane

A registered directory non-human identity calls the AI gateway with its content-inspection layer, which routes to approved models and to MCP servers acting as mediated proxies. Policy actually enforced at that chokepoint: directory JWT and OAuth validation, scope and group authorisation, quotas and token caps, DLP and redaction, prompt-injection inspection, a model allowlist sourced from AI governance, and central logging to the SIEM. All MCP interactions are required to route through it, and direct MCP connections are prohibited for Tier 1 servers.MIC Assessed as stronger mediation than most enterprises operate.

The substrate plane

The same identities, a different path: artefact registry (the default package source, with development and production container registries) → object store → source repositories and CI → databases, wikis and ticketing. The only controls found were a package vulnerability scanner and write-group membership. No behavioural analytics, no provenance attestation, no inter-agent channel detection.MIC

The discriminator that makes the blind plane detectable anyway

A legitimate dependency has one writer, provenance, and a consuming build. A coordination channel has many writers, no provenance, and no consumer. That distinction is computable from access metadata alone, without inspecting content.MIC Which matters because in the reference case content inspection was never possible — the registry’s audit trail covered only user, group, permission and token events.MIC

The registry that exists but does not enforce

An the agent registry records owner, declared tools, declared write scope and autonomy tier. Nothing was found binding it to runtime enforcementMIC, which is why D4’s primary outcome — declared scope enforced at runtime — currently reads zero.

The case for self-hosted defensive models does not rest on a claim that they match frontier capability — that claim is indefensible and unnecessary. It rests on four independent legs.

1. Availability — the tool must work at 3am on the worst day

2. Confidentiality — the guardrail and the retention pipeline are the same system

The classifier that refuses a request is also the event that flags the session for retention and human review. So the payload you most need help with is retained longest and seen by the most third parties — and mid-incident, the credentials in it are still valid. Gartner records that 69% of organisations are concerned about maintaining control over AI models, and that “due diligence alone is insufficient; technical controls are essential.”GTNR

3. Legal and export exposure — an open question, not a settled one

The safe harbour at 15 CFR § 734.18 covers encrypted transit; inference decrypts and processes. No BIS or DDTC guidance exists on whether inference over controlled technical data constitutes a deemed export. That it is open is the argument — against an enforcement climate that has produced penalties of roughly $213M and $252M against two US critical-manufacturing-sector companies.LAW For a manufacturer whose crown jewels are process technologyFTD, this is a board-relevant consideration rather than a technical one.

4. Forensic defensibility

ISO/IEC 27037 requires repeatability and reproducibility of forensic process, and hosted models update and reroute silently.LAW

What runs in it, and the risk it imports

Every question the reference incident raises is an inventory question first. What could one stolen credential reach? Nobody had asked — and the answer took one second to demonstrate once an adversary did.

Week one, building nothing

• Define critical assets in the exposure-management platform and read the attack paths that appear. the enterprise almost certainly already holds the licences, and first-class connectors exist for the vulnerability scanner and the service-management CMDB — a day of integration materially improves the graph.MS The gating input is a business workshop to say what matters, not an engineering build — without it the page may simply be empty.
• A Kubernetes attack-path run against one production-representative cluster, and an identity graph across the tenant — an afternoon of open tooling, aimed at the surface that actually carried the kill chain.
• Switch on directory activity logs while you are there. They are frequently off, and they are the read half of the strongest identity signal available.
• Pull automated critical IT, OT and cloud asset inventories from the exposure assessment platform — Gartner’s explicit recommendation, in order to prioritise where to change architecture first.GTNR

The inventory that detection joins to

Self-declaration is not the defect — being unreconciled is. The only published discovery methodology puts attestation fourth of four: tag scan → six-signal heuristics → CMDB reconciliation → developer attestation of the residue, with a deadline and an escalation path.MS the enterprise’s registry is step one of one.MIC

The digital twin, honestly

The published exemplar did not build a twin from telemetry: a sanitised natural-language specification was supplied, an agent-assisted workflow built an isolated environment, and sensors were installed into it. The engineers write “representative test environment”, never “digital twin”. The bar is far lower than the marketing implies. And Gartner explicitly permits validation against “a simulated digital twin to reduce potential impact”GTNR, which is consistent with the cloud-first cyber-range MVP the team chose over a full production-environment twin.FTD

There was no published vulnerability identifier for either way into the victim. A scanner-driven programme would have matched nothing, because what made it an intrusion was the path — and no severity score rates a path.MIC

The five phases, and the one that matters

The one experiment to run first

Security chaos engineering against the admission tier. Admission-controller fail-open is the upstream recommendation, not a misconfiguration — and setting the policy to fail closed does not save you, because of a hard 30-second admission-chain budget. The architectural fix is in-process CEL policy evaluation.RES That is a complete, bounded, week-one experiment with a real finding either way.

Why “patch faster” is not the answer

The defenders’ hard part succeeded. The easy part failed.

So measure escalation latency separately from detection latency

Almost every programme reports mean time to detect and folds escalation into it, which makes this class of failure structurally invisible. Separating them requires no new tooling and no new data — only a decision about how existing numbers are cut. And the related failure mode produces no alert at all: “Nothing on any screen tells you that a finding failed to appear.”PEER

Why there is no external help for the agentic case

Attribution is a proved impossibility from logs alone

The detection primitive, and two approaches to rule out

• Do not build strict-sequence detection. MITRE: “the complexity and cost of such implementations often outweigh the benefits, and adoption… has been limited in practice.”STP Order-independent convergence counting survives retries and parallelism, which is how agents behave.
• Do not detect automation by tempo. It fails at 99.8% or worse against a competent adversary and fails confidently — mean confidence above 0.993 when wrong, with a formal zero-mutual-information result.ARX Enrich an alert with tempo; never raise one.

The highest-value detection nobody ships

An agent invoked a tool it never declared. No baseline needed. Eleven published queries exist and none joins the inventory to runtime activity; all are hunting queries rather than analytics rules, so none raises an incident.MS And the join key is not guaranteed — in the runtime schema the agent identifier is merely recommended and the tool name optional, so a compliant event can carry no agent identity at all.MS Make its presence a source-onboarding acceptance criterion.

Almost everything else in this programme is harder against an autonomous adversary. This is the exception, and the evidence is unusually clean.

Why precision is structurally high

A decoy has no legitimate consumer, so any interaction with it is by construction either an error or an intrusion — the same structural argument as the coordination-channel discriminator, and the reason both work without a behavioural baseline.MIC The honest limit: no published false-positive rate exists for any canary vendor, and no recall data exists anywhere. Use the structural argument rather than inventing a number.IND

Two things to get right before anyone buys anything

What deployed deception actually achieves

• One published deployment reported 83% exploitation at around 30 minutes.IND
• A vendor detected a real 2025 intrusion within seconds using canaries placed in source-control secrets at both organisation and repository level, running tens of thousands of tokens.IND
• An MCP-configuration canary detects agents routing around organisational MCP restrictionsIND — directly relevant to our own Tier 1 direct-connection prohibition, whose enforcement point is otherwise unclear.MIC
• A caution worth carrying: in the defensive challenge environments, hardening decoys produced only a “slight advantage” because probing for deception is itself observable — but elsewhere decoys blocked up to 94% of privilege-granting exploits. Not evidence that decoys stopped working.RES

Prevention is the easier half. This is the half that decides whether an intrusion costs two days or two quarters — and the half most organisations have not engineered.

The three tiers

Revocation alone is not a containment strategy

If the adversary holds signing material it can mint valid credentials faster than we withdraw them — which is what happened. So the catalogue must include authority-level actions, not only credential-level ones.

Recovering the agent estate itself

Disaster recovery covers data and applications. It rarely covers agent definitions, system prompts, tool registries, MCP configuration, vector-store contents, memory stores or gateway policy. Two consequences: without a known-good configuration you cannot prove an agent is clean, and the fastest route back to service is therefore to redeploy the compromised one.

Every defence, the domain it serves, the outcomes it moves, and its current state. A capability that moves no measured outcome fails Gartner’s prioritisation test and should not be funded.GTNR

Three framings the evidence settled

The gap the mapping exposes

D2 is covered by one defence, and nothing in the seven addresses deepfake-enabled social engineering — the highest-prevalence real AI attack at 41% of organisations on audio calls and 35% on video.GTNR They were designed against an infrastructure intrusion. The SOP-hardening work Gartner specifies — password reset, partner and supplier interactions, financial transactions — closes it in tranche 1 at essentially no cost.GTNR

The structural change is not that attacks are cleverer. It is that the interval between a vulnerability becoming known and being weaponised has collapsed from days to minutes, because frontier models can autonomously reverse-engineer a patch into a working exploit.GTNR

What speed actually defeats

The number that ends the human-paced-escalation argument

Gartner’s assessment of what AI is actually doing for attackers today: “threat actors leveraging and abusing widely available AI tools to scale and enhance existing tactics, not the invention of net-new attack methods.”GTNR The consequence is a volume problem, and volume breaks controls that were tuned for plausible attempt counts.

What scale looked like in the reference case

The detection consequence, and the approach that survives it

Sequence-based detection fails because parallel agents retry and reorder constantly. MITRE is explicit that strict sequencing “can be challenging to implement effectively… adoption of these types of analytics have been limited in practice.”STP What survives is order-independent convergence counting:

Fifty-four attack vectors across ten layers of the estate: agents and models, gateways, identity, cloud and compute, network and egress, data and knowledge, software supply chain, endpoints and collaboration, observability and recovery, and manufacturing. Four have no named owner.

The layer nobody owns, and why it matters most at the enterprise

SEMI E188 explicitly excludes the manufacturing execution system, the material-control system and factory-provided host systems; E187 addresses supplier-provided equipment.SEMI Neither standard covers the factory-software layer that actually holds write authority into the tools — and that layer is the one reachable from IT. Gartner describes the same gap from the infrastructure side: “Fragmented IT/OT convergence creates severe risks, as current systems lack unified governance and struggle to support the downtime required for constant patching.”GTNR

Two layers our own defences did not cover

Gartner reproduces the 2026 Verizon breach dataset under a heading that is itself the finding: “The Majority of Breaches Still Do Not Exploit Vulnerabilities.”GTNR

What this changes in our allocation

• Identity is the highest-leverage surface, not vulnerability management. Credential abuse appears in 39% of breach chains, and machine identity is where our maturity is lowest.
• The human-facing surface earns real investment. Phishing is stable at 16% and deepfake-enabled social engineering is measured at 41% and 35%GTNR — and the mitigation is process change, not technology.
• Vulnerability work shifts from patching to exposure. CVSS-led prioritisation drives “efforts to address only critical and high CVSS scores rather than prioritizing those riskiest to the organization.”GTNR

This is the claim our strategy is most exposed on, so it is stated conservatively and sourced precisely.

What Gartner says

• “Uses of LLMs to assist in malware creation, as part of the malware workflow, or to orchestrate automated attacks are emerging with unclear impact so far.”GTNR
• Threat actors integrating models into malware show a “lack of sophistication” and are “more experimental than mature”.GTNR
• “today, true AI-powered attacks remain very rare in the real world. Rather, adversaries are using AI to scale traditional phishing, automate tasks, and compensate for skill gaps.”GTNR
• AI-augmented attacks are classified in the “unpredictable threats” section of the 2026-2027 ThreatScape, which maps threats by signal quality and threat-actor advantage.GTNR

What has nonetheless been observed

The most reassuring finding in the corpus, and the one most likely to be misread as a reason to do nothing.

And alongside it: “This situation is not a repeat of Y2K and does not require a transformational response.”GTNR

What “foundational controls still work” does not mean

Gartner’s definition: “tooling to test for vulnerabilities, assess how they expose your organization to breach activity, and evaluate the security controls you have in place to ascertain their effectiveness. These offerings simulate real-world attacks… against extant security controls.” The stated benefit is visibility into “where and why they fail prior to an actual attack.”GTNR

The technology categories Gartner places here

• Adversarial exposure validation (AEV) — the core capability
• Breach and attack simulation (BAS)
• Automated security control assessment
• Autonomous exposure remediation — noting Gartner’s caution that organisations are “extremely rare[ly]” willing to auto-remediateGTNRGTNR

The five-phase discipline beneath it

Where validation runs

Against real controls, or — in Gartner’s words — “in some cases, a simulated digital twin to reduce potential impact.”GTNR That is the narrow, defensible version of a twin, and it matches the cloud-first cyber-range MVP the team chose over a full production-environment twin.FTD The published exemplar for building such an environment used a sanitised natural-language specification, not telemetry replication — the engineers call it a “representative test environment”.

Gartner: “using data and context to understand likely trends from adversaries… TTPs that are in use and increasing as well as targets.” And the qualification that shapes how we fund it: “On its own, adversary management allows for scenario planning… It is of most value when combined with one of the other pillars to provide actionable enforcement.”GTNR

There is no feed to buy for this

No vendor-neutral, standards-body TTP catalogue for autonomous attackers exists beyond MITRE ATLAS and the OWASP Top 10 for Agentic Applications. The US government AI-ISAC remains policy-mandated but pre-decisional with no launch date, so interim AI-threat intelligence should route through an existing sector ISAC.IND So D2 is a built pipeline, not a procurement.

The pipeline, and what it produces

And the vector D2 must cover that our defences did not

Deepfake-enabled social engineering, at 41% of organisations on audio calls and 35% on video.GTNR Gartner names the processes: password reset, partner and supplier interactions, and financial transactions.GTNR This is a D2 scenario feeding a process control, not a technology purchase — and it is the cheapest item on the roadmap.

Gartner: “accepting that attacks will occur and working to delay or misdirect such attacks… deception and honeypots that provide a clear signal of an attack when triggered, conducting proactive threat hunting… and operationalizing threat intelligence in other controls.”GTNR Three stated purposes: slow the attacker, give a clear signal, and feed attacker TTPs back into other controls.

The second half of D3: raising cost through revocation

A stolen credential that dies in ten minutes is worth very little. Machine identities are the reversible asset class — revoking one breaks a workload rather than a person’s day, and it can be reissued — which is what makes pre-authorisation defensible here and nowhere else yet. Mechanisms: issue-time cohort revocation, lease revocation by prefix, signing-authority taint, and continuous session signals.RES

Two procurement traps

Gartner: “Successful attacks often take advantage of failures in the configuration of your environments… As the number of vulnerabilities organizations have to manage increases due to the effect of LLM-driven vulnerability discovery… hardening configurations is even more vital than before.” The benefit: it “reduces the attack surface and minimizes the impact of an incident that does compromise a hardened device.”GTNR

The technology categories, including one we do not have

CNAPP — cloud security posture management, cloud infrastructure entitlement management, Kubernetes security posture management, and AI security posture management — plus data security posture management, network security posture management, unified endpoint management and endpoint protection.GTNR

The segmentation journey, and why it usually fails

Gartner’s recommendation is “the journey from macrosegmentation to network security microsegmentation to limit lateral movement.”GTNR The published failure pattern is organisational, not technical:

Gartner’s model puts the four domains on a foundation, and is direct about why: “many organizations will require vendor- or third-party-led managed services to realize significant value from these offerings unless they have large and high-level security teams.” And: “With all preemptive cybersecurity offerings, many organizations will also benefit from a managed or supported service.”GTNR

The three foundation outcomes

The sequencing risk this layer creates

Gartner warns that preemptive offerings may be “limit[ed] to detecting, rather than fixing issues, thereby increasing, rather than reducing overhead.”GTNR If validation and posture assessment stand up before the accountable resolvers exist, the programme manufactures a findings backlog nobody owns. That is the single most likely way this creates work rather than protection — which is why the ownership decision is sequenced first.

“By 2030, preemptive cybersecurity solutions will account for 50% of IT security spending, up from less than 5% in 2024, and replace traditional ‘stand-alone’ detection and response solutions as the preferred approach to defend against cyberthreats.”GTNR

Three corroborating signals

“Many capabilities promoted as preemptive exist in current platforms. Combining them, however, has the potential to add resilience.”GTNR And the instruction that follows: CISOs “must ensure that they do not already have a similar capability being delivered as part of their existing product and service portfolio.”GTNR

Gartner’s own mapping of domains to existing technology categories

Two things we already hold that are under-used

• The exposure-management platform. Critical-asset definition generates attack paths, and first-class connectors exist for the vulnerability scanner and the service-management CMDB. The gating input is a business workshop to say what matters, not an engineering build.MS
• The gateway. It already enforces directory authentication, scope authorisation, quotas, DLP and prompt-injection inspection, with central logging.MIC What it does not yet do is mint a delegation identity — which is the one thing no product will supply and the fix for an otherwise unsolvable attribution problem.ARX

Gartner’s shorthand for the same model: “Deny intruders access to your global attack surface grid through advanced obfuscation techniques. Deceive bad actors through automated cyber deception and moving target defense. Disrupt attacks via predictive threat intelligence and automated exposure management.”GTNR

How the verbs map to our domains

“Current detection and response and application security methods aren’t sufficient to keep up with the speed, sophistication and scope of emerging AI-enabled threats.”GTNR The preemptive model “adds focus beyond prevention, detection, and response and seeks to improve foresight capabilities to limit an attack’s impact early, optimally preventing initial access.”GTNR

The evidence from our own estate

“AI-washing, both as a threat and as a capability, is prevalent in cybersecurity product marketing today.”GTNR Gartner is blunt about the cause: “Preemptive cybersecurity is being applied as a label to both new and existing technologies by vendors… there is AI-washing both in creating demand for and in labeling these technologies as preemptive.”

Three specific claims to interrogate

“The immediate danger is the CISO attempting to own the solution in a silo. If the CISO promises to simply ‘patch faster’ without the backing of the CIO, they will fail. In most organizations this is neither attainable nor sustainable.”GTNR

Why it is not attainable

The programme asks for autonomous action in exactly one place — machine-identity revocation — and stops there deliberately. Three reasons, all sourced.

1. It erodes the capability it depends on

“fully automating fixes will eliminate practical learning ground required to develop experienced Level 3 analysts.”GTNR The senior analysts a programme like this needs in three years are produced by the work it would be most tempting to automate now.

2. The defender’s own disruption is a real cost

The only serious published evaluation of autonomous containment prices collateral damage into an availability-weighted reward — a restore action carries a negative score.RES A containment action that halts production is not a successful containment, which is why the automation decision is taken separately per asset class rather than once for the estate.

3. Organisations do not actually do it

“it is extremely rare for organizations to be willing to automatically remediate discovered issues due to the concern over potential disruption, and this may limit preemptive cybersecurity offerings to detecting, rather than fixing issues, thereby increasing, rather than reducing overhead.”GTNR

“CISOs Must Focus on the Outcomes of Preemptive Cybersecurity”, 5 August 2026, nine pages plus a technology appendix. It supplies the four-domain structure, each domain’s definition and core benefit, the foundation layer, and a mapping of domains to technology categories.GTNR

Its three stated challenges, all of which we inherit

• Cultural shift required, because “predicting cyberthreat activity accurately is largely aspirational” and organisations are “extremely rare[ly]” willing to auto-remediate.GTNR
• AI-washing is prevalent in both the demand creation and the product labelling.GTNR
• Much of it already exists in current platforms — “Combining them, however, has the potential to add resilience.”GTNR

What we added to it

“Outcome-Driven Metrics for the Digital Era”, 11 July 2025, twenty-one pages. It supplies above-and-below-the-line structure, the five-step derivation method, and — in Note 1 — seven characteristics that decide whether a metric is worth reporting at all.GTNR

The definition of an ODM, which is also a filter

The five steps, as applied

The other five characteristics, used as filters

• Metric value — “its ability to influence decision making… typically priorities and investments.” Anything that could not change one was cut.
• Leading indicators — must “expose a problem before it leads to material loss.” This is why validation coverage beats incident counts.
• Direct line of sight — “If the technology metric changes, it indicates a change in the business outcome.” Every metric on the page states its line of sight.
• Metric changes drive action — green to yellow to red must trigger a change of priority or investment.
• Discrete audiences — “The CFO needs different metrics from those required by the head of a business unit or a board of directors.”

Step 5 of the method: “Create the business enablement risk scale with, at one end, no investment or technology stack to enable the business outcome; at the other, investment in leading-edge technologies that would elevate the current technology stack to drive the most positive outcome for the business.”GTNR

Readiness, defined

“technology that operates the way it is designed, fully supports a business process, meets compliance requirements and is not unreasonably at risk of failure” — and separately, “Readiness describes the state of investments and capabilities to manage [the risk].”GTNR So a low position is a statement about investment, not about competence.

Reading our five positions

All three measure the same underlying question in different registers: do we know what we have, and have we tested whether it holds?

The outline above is not the specification. Each metric’s unit of count, denominator, pass test and fail modes are in its own panel, reachable from the Definition and pass test link beside it on the programme set.

Intelligence only counts once it becomes enforcement. Gartner: adversary management “is of most value when combined with one of the other pillars to provide actionable enforcement.”GTNR

The outline above is not the specification. Each metric’s unit of count, denominator, pass test and fail modes are in its own panel, reachable from the Definition and pass test link beside it on the programme set.

Three metrics, matching Gartner’s three stated purposes for the domain minus the one that does not survive against agents.GTNRARX

The outline above is not the specification. Each metric’s unit of count, denominator, pass test and fail modes are in its own panel, reachable from the Definition and pass test link beside it on the programme set.

Reduce what is reachable, and make declared scope mean something at runtime.

The outline above is not the specification. Each metric’s unit of count, denominator, pass test and fail modes are in its own panel, reachable from the Definition and pass test link beside it on the programme set.

Gartner rests the four domains on managed services and capabilities, noting most organisations need partner support “unless they have large and high-level security teams.”GTNR

The outline above is not the specification. Each metric’s unit of count, denominator, pass test and fail modes are in its own panel, reachable from the Definition and pass test link beside it on the programme set.

Four objectives, all owned outside CDR. Roughly 20% of the relevant controls sit with usFTD, so writing these as FTD deliverables would produce a plan that reports as late against work the programme was never able to do.

One design consequence that is not a control choice

“if an LLM is supplied with untrusted input, it will produce arbitrary output.”PEER Indirect prompt injection is a property of the technology, not a defect awaiting a patch. That makes the untrusted-input tier an isolation requirement rather than a filtering one — cheaper and more durable than any inspection tier, and consistent with Gartner’s related position that the future of AI security is in securing agent actions rather than prompts.GTNR

The centre of gravity, for a specific and checkable reason: MITRE has adjudicated the reference intrusion as a formal case studyATL and publishes no detection guidance for it — no detection field, no data-source field, and one generic mitigation.ATL

The sequencing that is not optional

The four things to build, in order

The enterprise has nothing defined for machine-identity revocation — no named authority, no target time, no rehearsal. Combined with the fact that it costs nothing to fix, that makes this the cheapest material improvement available to the programme.

The three tiers

Why the automation ask is narrow, and what makes it safe

Gartner: organisations are “extremely rare[ly]” willing to auto-remediate, and “without a cultural shift, many CISOs will be unable to fully utilize preemptive cybersecurity approaches.”GTNR We are asking for that shift, scoped to the reversible asset class only — and the safeguard is structural: the Tier A list is changeable only by the Security Committee, so the scope of autonomy cannot be widened by those exercising it.

Four objectives. One of them cannot be acquired mid-incident, which is why it sits in tranche 1.

The four arguments for our own capability, none of which is a capability claim

• Availability — the tool must work at 3am on the worst day.ARX
• Confidentiality — the classifier that refuses is the same system that flags the session for retention and human review, so the payload you most need help with is retained longest. 69% of organisations are concerned about control over AI models.GTNR
• Legal and export exposure — the safe harbour covers encrypted transit, but inference decrypts and processes, and no regulator has ruled on whether that is a deemed export.LAW
• Forensic defensibility — standards require repeatability, and hosted models update and reroute silently.LAW

The seven defences were designed against a real agentic intrusion, before the Gartner frame was adopted. Mapping them onto the four domains is therefore a genuine test of whether the technical work serves the strategy — and it mostly does.

What closing that gap actually involves

Not detection tooling. Commercial deepfake detectors lose 45-50% of their accuracy on realistic in-the-wild contentARX, liveness certification structurally excludes the injection attacks actually used against identity verificationREG, provenance metadata is destroyed by any screenshot or re-encodeREG, and untrained humans catch deepfakes almost never.IND What works is procedural: callback to a pre-registered channel rather than one the caller supplies, a passphrase that never travels over the channel being verified, and dual authorisation above a value threshold.IND

Three measurements and one piece of good news. All four are chosen because they cannot be flattered.

Seven actions. Four are decisions or process changes rather than purchases — which follows from Gartner’s observation that many preemptive capabilities already exist in current platforms.GTNR

Seven actions, and this is where instrumentation spend starts. Gartner is candid that some measurement “may require instrumenting parts of the infrastructure to gather new types of data.”GTNR

Seven themes. The test of this tranche is whether the programme stops being a programme — coverage measurement becoming a standing CSOC function rather than a project activity.

Ordered by what they unblock rather than by size. Decisions 01 and 02 cost nothing and gate almost everything else.

The document carries over 400 citation markers against a registry of 173 entries across 21 source classes. Every marker opens the verbatim quotation and its locator. Nothing rests on an unattributed assertion.

The evidence base, by layer

The most prevalent AI-augmented attack in the published evidence, and the one our defences did not cover. 41% of surveyed organisations have experienced a deepfake and social-engineering attack on an audio call to an employee, 35% on a video call, and deepfakes now account for one in five biometric fraud attempts.GTNR

Two incidents that frame the problem

Why detection tooling is not the answer

What actually works — and it is procedural

The controls that hold do not depend on detecting a fake:

• Callback to a pre-registered channel — never a number or address supplied by the caller. This single control defeats the Arup pattern entirely.IND
• A passphrase that never travels over the channel being verified. If the code word is spoken on the call being authenticated, it authenticates nothing.
• Dual authorisation above a value threshold for payment changes, vendor bank-detail changes and privileged access grants.
• Help-desk hardening for password and MFA reset — the MGM vector. This is the highest-value single process in scope.IND

Gartner sets the ceiling: “You only need five to nine metrics for each target audience. Do not report everything you know. Prioritize the top five to nine technology dependencies and the top audiences to receive only the highest-value information that drives above-the-line decisions.”GTNR Combined with “only above-the-line metrics should be shared with executives”GTNR, that is why fifteen run the programme and seven reach the Security Committee.

The selection test each of the seven had to pass

• Does it cover a distinct domain? Two from D1, one each from D2, D3 and D4, one from the foundation. No domain is unrepresented and none is over-represented.
• Is it a leading indicator? It must “expose a problem before it leads to material loss.”GTNR This is why validated coverage is on the list and incident counts are not.
• Can it be computed honestly today? Anything needing a denominator we do not have was excluded — which is why reconciliation is on the list and inventory completeness is not.
• Does moving it change a decision? “The value of a metric is its ability to influence decision making. The decisions influenced are typically priorities and investments.”GTNR

Thresholds and the action each triggers

Each metric’s exact unit of count, denominator and pass test is in its own specification panel, reachable from the Definition link beside it on the committee set and the programme set.

The outcome the Security Committee is protecting, stated in the business’s own terms: production output is not interrupted by a cyber event. It is first because it is the only one of the three with a precedent in this industry and a published number attached to it.

Which programme metrics have line of sight to it

• Metric 06 — critical IT, OT and cloud assets under continuous posture assessment, because the OT estate is where continuity is lost.
• Segmentation maturity under D4 — Gartner names microsegmentation specifically to “limit lateral movement” between converged IT and OT.GTNR
• Metric 01 — validation, because an untested containment path is an assumption.

Process recipes, yield data and design files are the assets that determine whether the enterprise’s technology lead survives. This goal is second because the threat to it is documented in court records, not inferred.

Why this goal changes the machine-identity metric’s weighting

Metric 04 — credential classes revocable within ten minutes — is weighted so that any class with reach into recipe or design data must be in scope. A revocation catalogue that covers the easy classes and omits the crown-jewel ones would improve the number while leaving the goal unprotected. That is precisely the failure Gartner’s “direct line of sight” test is meant to catch.GTNR

The third goal is the one CISOs usually leave off the slide, and the one that makes the programme an enabler rather than a tax. Gartner’s own final step in deriving outcome-driven metrics is to express readiness as a risk to business enablement — not as a security score.GTNR

The argument in one line

If we cannot say what an agent is permitted to do, the business cannot safely say yes to it. Runtime enforcement of declared scope (metric 05) is therefore an adoption control as much as a security one — it is what allows a high-autonomy use case to be approved at all.

The diagram is not a presentational device. It is the output of a defined method, and the method is what makes the fifteen programme metrics defensible rather than assembled.GTNR

What makes something an outcome-driven metric and not just a number

• It is a continuous outcome of an identifiable investment — fund it and it improves, defund it and it degrades.GTNR
• It sits on a sliding scale, so the committee is choosing a protection level rather than passing or failing.GTNR
• It takes the canonical form “% of X”, which is why every metric on the executive set is written that way.GTNR
• It has direct line of sight to a business outcome — and if it does not, “the technology investment should not be prioritized as it will drive little value.”GTNR

The change being asked for

From “how many days do we take to patch?” to “what is our tolerance to be exploited by a known vulnerability?” — set by asset class.GTNR

Why the first question cannot be answered usefully any more

The interval between disclosure and working exploit has compressed from days to minutes for some classes of vulnerabilityGTNR, so a days-to-patch target is a statement about our process rather than about our exposure. Gartner is blunter still: we are “not patching our way out of vulnerability exposure”, and mitigation and compensating control must carry the load where patching cannot.GTNR Only 36% of organisations even have infrastructure teams actively engaged.GTNR

The ask, in the words the board should hear

“cybersecurity teams can only guide vulnerability prioritization. IT operations, product teams and business system owners must be held accountable by the board to fix exposures in their own systems.”GTNR

Why this is the critical path and not an administrative preference

Roughly 80% of the controls this programme depends on sit outside Cyber Defense & Resilience.FTD Gartner states the consequence directly: “without widespread business engagement most exposure management functions… are unable to function effectively”GTNR, and warns that preemptive tooling can end up “limit[ed] to detecting, rather than fixing issues, thereby increasing, rather than reducing overhead.”GTNR

What is being ratified

Gartner’s four core preemptive domains as the programme’s structure — exposure management, adversary management and threat intelligence, adversary disruption, and posture and policy management — on a foundation of managed services and capabilitiesGTNR, with the fifteen outcome-driven metrics as the definition of success.

Why adopt an external frame rather than write our own

• It is additive, not a replacement: preemptive security “adds focus beyond prevention, detection, and response”GTNR, so prevent–detect–contain–respond remains the delivery method underneath.
• Much of it is already bought: Gartner notes many preemptive capabilities already exist in current platformsGTNR, which is why tranche 1 needs no new money.
• It gives the committee a defensible external reference for the structure, so debate can be about sequencing and funding rather than about taxonomy.
• It carries its own anti-hype discipline: focus on “how the tools support these outcomes, not on the hype around AI.”GTNR

The specific authority requested

Revocation of machine-identity credentials without prior change approval, for an enumerated Tier A list, with the list changeable only by the Security Committee and every action logged and reviewed.

Why speed is the whole point

Average adversary breakout time is 29 minutes; the fastest observed was 27 seconds, and the median hand-off to a second-stage operator 22 seconds.IND A containment action gated on a change window is not a containment action.

Why machine identity and nothing else

• It is the reversible asset class — revoking a credential breaks a workload, not a person’s day, and it can be reissued in minutes.
• It is the class the reference incident actually abused, and where the adversary held signing authority and could mint credentials faster than they were withdrawn — which is why the catalogue must include authority-level taint, not only credential revocation.RES
• No human-account, endpoint-isolation or production-network authority is being requested. Those are not reversible in the same sense and are not in scope for this decision.

The finding

“outdated systems and unused code are no longer just operational problems, but significant cyberthreat liabilities.”GTNR

Why frontier models change the calculus specifically

The capability that has genuinely shifted is the speed and scale of finding and weaponising known weakness, not the invention of new attack classes.GTNR Legacy and unused code is exactly the surface that rewards cheap, patient, automated review — and unused code is the worst case, because nobody is watching it and nobody will notice it being probed. Gartner’s medium-term observation cuts both ways: models “will enable defenders to inspect an unprecedented volume of source code”GTNR — and attackers first.

The proposition

Approve tranche 1 now — it requires no new money, because three of its seven items are governance or process and the rest use capability already licensed.GTNR Then gate tranche 2 on what tranche 1 finds, rather than approving a full-programme budget against assumptions.

The two tranche-1 items that may change tranche 2’s scope

Why sequencing disruption before detection is deliberate

Because it is where we are weakest and where the cheap wins are. Deception needs no inventory, no gateway change and no new telemetry pipeline; SOP hardening is process change; revocation authority is a decision. Gartner notes disruption “provides a clear signal of an attack” and feeds other controls.GTNR

Every other number on the baseline is unflattering. This one is not, and it is worth understanding why it matters more than it looks.

Why this is the scarce asset

What it means for the maturity assessment

Programme governance is assessed at MIL2 today and targeted at MIL3 — the highest starting point of anything on the baseline. Six of the fifteen assessed capabilities sit at MIL0. The gap is not governance; it is execution capacity and delegated authority, and both are things this committee can grant.

The baseline is assessed against the Cybersecurity Capability Maturity Model (C2M2), published by the U.S. Department of Energy.ARCH Its Maturity Indicator Levels (MILs) are cumulative and are assessed per capability, not as a single organisational score.

Why not the NIST Cybersecurity Framework Tiers

Because the CSF Tiers are not a maturity scale. They describe the rigour of an organisation’s cybersecurity risk-governance and risk-management practices, and NIST’s own Organizational Profile guidance frames them as a characterisation to inform a target profile — not a ladder to climb.ARCH Using them as one produces a number the committee will reasonably read as a score, and which cannot be tied to a specific investment.

The word “ownership” usually produces a workshop and a matrix. This ask is narrower and harder: a board instruction naming a single accountable owner for each of five dependency areas, with the obligation to accept or reject exposure findings on a defined clock.

Why a named owner and not a shared responsibility

Gartner measured the engagement problem: only 36% of organisations have infrastructure teams actively engaged on remediationGTNR, and exposure management functions without business engagement are “unable to function effectively.”GTNR It also observes that the obstacles here are predominantly non-technical.GTNR The segmentation evidence is the starkest version: of fourteen organisations attempting even limited segmentation, eleven failed — mostly for want of an executive champion and application-owner buy-in.IND

The strategy is built on two of the twelve reports and corroborated by the other ten. It is worth being explicit about which, because it determines what is load-bearing and what is supporting.

How it was read

• Every report extracted in full and analysed page by page; dossier 27 carries verbatim quotes with page locators for every claim that appears in this document.
• The two base reports were read end to end before anything was built on them — which is how the five-to-nine metric ceiling and the five-step derivation method came to shape the outcomes tab rather than being retrofitted.GTNR
• Where Gartner’s position is more conservative than the prevailing narrative, Gartner’s position is the one used — including that true AI-powered attacks remain rareGTNR and that current offensive use is largely experimental.GTNR
• Where Gartner and a primary source disagree on a number, both are shown and the primary source is preferred. The Verizon report is currently secondary-sourced and flagged as such.BM

1 · What exactly one item is

One object, where an object is either an AI asset or a machine identity, deduplicated on a stated join key.

2 · The denominator, and where it comes from

The union of all discovery signals, deduplicated. Five signals, in descending order of trustworthiness: S1 resource-tag scan across all cloud subscriptions; S2 six-signal heuristics over application registrations and identities (permission shape, naming pattern, redirect URI, credential type, sign-in pattern, absent owner); S3 gateway and egress telemetry showing traffic to an inference endpoint; S4 a service-management platform record; S5 registry self-declaration. An object is discovered if it appears in at least one signal.

3 · The test that puts an item in the numerator

4 · How a pass gets wrongly claimed

• Reconciled against the registry alone — which only proves the object declared itself, not that it exists as declared.
• An owner field populated with a distribution list, a team, or a person who has left.
• Partial reconciliation counted as a pass. All four tests must hold; three of four is a fail.
• Silently dropping unjoinable objects instead of publishing the count.

5 · How it is computed

Computed monthly by the discovery pipeline, not by hand. Each signal is a scheduled query; the union and the dedup are scripted so the number is reproducible from the same inputs. Owned by CDR with Identity as the data provider for S1 and S2.

6 · The arithmetic, worked through

7 · How this number could lie

Why self-declaration is the wrong first step, not the wrong idea

The only published discovery methodology for this problem puts developer attestation fourth of four — tag scan, then heuristics, then reconciliation against the configuration management database (CMDB), then attestation of whatever residue remains, with a deadline and an escalation path.MS Our registry is step one of one. Invert the order and the same registry becomes a trustworthy join key rather than the population itself.

Why this metric is first to fund

Metrics D1.2, D3.2, D4.1 and D4.2 all need a scoped population before they can be computed at all. Gartner recommends pulling automated information technology, operational technology and cloud inventories from the exposure platform rather than maintaining them separately.GTNR The three-layer asset data model in the service-management platform is the intended join point.SNOW

1 · What exactly one item is

One technique on the versioned priority technique list. Not one control — controls are not countable objects, because no two people enumerate them the same way.

2 · The denominator, and where it comes from

The priority technique list — named, versioned and published with the metric. Version 1 is built from the techniques MITRE mapped in ATLAS case study AML.CS0068ATL set within the 78-technique coordination-and-tool-use set used for the coverage baselineSAF, minus documented exclusions. Re-ratified quarterly; the version number travels with every published figure.

3 · The test that puts an item in the numerator

4 · How a pass gets wrongly claimed

• Counting a technique as covered because an analytic exists. Existence is not evidence. That is metric D2.3, which is a different and easier test.
• A lab pass promoted to a production pass without re-running it in production.
• An alert that fires but cannot be attributed to the emulated action — common when the test runs during normal change activity.
• An alert outside the claimed time budget recorded as a pass because it eventually arrived.
• Shrinking the technique list to raise the percentage, without publishing the exclusions.

5 · How it is computed

Run continuously by the validation and purple-team function; the figure is recomputed at each publication from the run log rather than maintained as a spreadsheet. Evidence for each pass is the run identifier, the target, the timestamp and the attributed log line.

6 · The arithmetic, worked through

7 · How this number could lie

Why this is the single most important number on the page

It is the direct measure of Gartner’s stated benefit for this domain: visibility into “where and why they fail prior to an actual attack.”GTNR It is also the only metric in the set that cannot be improved by buying something. It moves when a defence is executed against and holds.

And the reporting discipline that must travel with it

1 · What exactly one item is

One data store on the crown-jewel register. A store is a named, addressable repository of data — not a system, not a team, not an application.

2 · The denominator, and where it comes from

The crown-jewel register: a business-owned, Security-Committee-ratified, versioned list. Inclusion test — a store is crown-jewel if loss, corruption or disclosure would (a) halt or degrade production output, (b) disclose process-recipe or design intellectual property, or (c) allow trusted code or artefacts to be published in the enterprise’s name.

3 · The test that puts an item in the numerator

4 · How a pass gets wrongly claimed

• Using the access-control list as written rather than effective permissions. This is the usual failure and it understates the radius by an order of magnitude.
• Mapping human principals only and omitting machine identities — the second usual failure, and the one that matters most here.
• A map with no egress element, which answers who can read it but not where it can go.
• A map with no named detection source, which answers the exposure question but leaves no way to notice abuse.

5 · How it is computed

Generated monthly by query against the identity graph and exposure platform. CDR owns the generation; the business owns the register and its ratification date.

6 · The arithmetic, worked through

7 · How this number could lie

Why this is the scoping metric for the whole programme

Gartner is explicit that exposure scoping should follow potential business impact rather than threat severity alone.GTNR The crown-jewel register is that scope, and four other metrics inherit it: deception placement (D3.1) is scoped to crown-jewel environments, revocation classes (D3.2) are weighted by crown-jewel reach, posture assessment (D4.2) defines critical by crown-jewel path, and the validation target set is chosen for blast radius. Get this register wrong and four other metrics measure the wrong things accurately.

1 · What exactly one item is

One named procedure. A procedure is countable because it has a written trigger, a sequence of steps and a named execution owner. Not a department, not a policy, not a training course.

2 · The denominator, and where it comes from

The high-risk procedure register. Gartner names the areas to start from: password reset, partner and supplier interaction, and financial transactionsGTNR. Version 1 is expected to hold on the order of a dozen procedures — help-desk password reset, help-desk MFA reset, privileged access grant, new supplier onboarding, supplier bank-detail change, payment release above threshold, purchase-order amendment, contract signature, employee data change, physical access grant.

3 · The test that puts an item in the numerator

4 · How a pass gets wrongly claimed

• The callback number taken from the caller. This is the single most documented failure mode and it defeats the control entirely.IND
• The passphrase spoken on the same call it is meant to verify.
• A threshold described as “significant” or “unusual” rather than stated as a number.
• Refusal authority that exists in the security policy but not in the procedure the agent is reading at the time.
• Counting the procedure because the text was updated, without an exercise. Manufactured urgency causes staff to bypass procedures they know — only the exercise tests that.

5 · How it is computed

Procedure owners attest the text; CDR runs the exercises on a rolling schedule so every procedure is tested within 180 days. The exercise result, not the attestation, sets the value.

6 · The arithmetic, worked through

7 · How this number could lie

Why this is on the committee set at all

Because it is the most prevalent real AI-augmented attack and the cheapest to mitigate. 41% of organisations have experienced deepfake-enabled social engineering on an audio call and 35% on video; deepfakes account for one in five biometric fraud attempts.GTNR And the investment is process redesign and training — no technology purchase.

Why detection tooling is not the control

• Commercial detectors lose roughly 45 to 50% of their area under the curve (AUC) on realistic in-the-wild content compared with laboratory benchmarks.ARX
• Liveness certification structurally excludes injection attacks — the technique actually used — so a certified product can be fully exposed to it.REG
• Content provenance is destroyed by any screenshot or re-encode, and the absence of a credential is not evidence of fakery.REG
• Untrained people identify deepfakes in roughly 0.1% of trials.IND

1 · What exactly one item is

One scenario on the scenario register. A scenario is a named adversary objective plus the sequence of techniques used to reach it against a named the enterprise asset. It is countable because it is a register entry with an identifier.

2 · The denominator, and where it comes from

The scenario register, derived from the programme’s priority intelligence requirements (PIRs) and re-ratified quarterlyIND.

3 · The test that puts an item in the numerator

4 · How a pass gets wrongly claimed

• An owner recorded as a team or a function. Teams do not convert scenarios; people do.
• A requirement written as an intention (“improve coverage of credential abuse”) rather than as something an engineer can build.
• A scenario marked converted with no forward traceability, so nobody can tell whether the analytic was ever built.
• Declines recorded without a compensating control, which turns the escape hatch into a way of clearing the register.

5 · How it is computed

Computed from the requirement tracker at each quarterly scenario review, joined on scenario identifier. Owned by threat intelligence, with detection engineering as the receiving function.

6 · The arithmetic, worked through

7 · How this number could lie

Why this metric exists rather than a threat-intelligence volume measure

Because intelligence that does not change a control is overhead. Gartner puts it plainly: adversary management “is of most value when combined with one of the other pillars to provide actionable enforcement.”GTNR This metric is the join between D2 and everything else — it measures whether the intelligence function produces work the rest of the programme can act on.

1 · What exactly one item is

One technique — the same versioned priority technique list used by D1.2. Same denominator, different test: D2.3 asks whether the evidence would exist; D1.2 asks whether we proved we would catch it.

2 · The denominator, and where it comes from

The priority technique list, version-matched to D1.2. The published coverage baseline uses the 78-technique coordination-and-tool-use setSAF.

3 · The test that puts an item in the numerator

4 · How a pass gets wrongly claimed

• Counting a source because the vendor documents it. Verify by sampling events; documentation is not data.
• Counting a schema field that is defined but empty in practice — the most common false pass in agent telemetry today.MS
• Counting a technique as covered by a generic source that would contain the event in principle but has no field distinguishing it.
• Reporting a single coverage percentage with no robustness dimension, which implies techniques are equally covered when they are not.STP

5 · How it is computed

Recomputed monthly from the coverage matrix, with the field-population check run as a scheduled query. Owned by detection engineering.

6 · The arithmetic, worked through

7 · How this number could lie

What the 16-versus-69 gap actually means

It is not a gap in analytics. It is a gap in where the telemetry is taken from: gateway-level observation sees a fraction of what runtime instrumentation sees, because the interesting behaviour happens between an agent and its tools rather than at the network boundary.SAF That makes the gap a collection-architecture decision with a cost attached — which is why decision 06 gates the tranche-2 telemetry line on establishing this number with our own estate rather than a reference one.

1 · What exactly one item is

One environment — a network or platform boundary containing at least one store from the crown-jewel register. Environments are countable because the boundary is a configuration object.

2 · The denominator, and where it comes from

The set of environments derived from the crown-jewel register (D1.3). It inherits that register, so it inherits its ratification date too.

3 · The test that puts an item in the numerator

4 · How a pass gets wrongly claimed

• Decoy deployed, alert unrouted. This is the most common failure and it produces a metric that looks healthy and detects nothing.
• A decoy that is fingerprintable, which turns it into a signal to the adversary that they are being watched.RES
• A stale decoy whose metadata no longer matches the environment around it.
• A decoy placed off the path, where it is safe but never encountered.

5 · How it is computed

Computed from the deployment inventory monthly; the C4 test is scheduled so every decoy is exercised within 180 days. Owned by CDR.

6 · The arithmetic, worked through

7 · How this number could lie

Why this is in the first thirty days rather than FY27

Because it needs no inventory, no gateway change and no new telemetry pipeline — and because disruption is where we are weakest. Gartner’s stated benefit for the domain: it “may slow down an attack as an attacker spends time… on a target of no value” and it provides “a clear signal of an attack.”GTNR

And why the evidence supports it more strongly than most controls

• In a controlled study of language-model agents, bait was taken at roughly 78% against a human baseline of about 37% — agents are more susceptible to deception than people, not less.ARX
• The same work found a recognition-action gap of 73.4%: agents frequently identified a lure as suspicious and interacted with it anyway.ARX
• Attention diversion was statistically absent — decoys did not distract agents from real objectives, so the control adds signal without adding risk.ARX
• National-level trials across 121 organisations and 14 vendors give the operational counterpoint: the control fails on routing and response, not on placement.REG