01 — Transit
The threat crosses whatever nobody is watching.
Lateral movement rarely looks like an attack. It looks like ordinary use of an access path that has existed for years and that nobody claims as theirs.
Unmarked
Containment is deciding where failure stops.
Defense and containment run as a programme, not as a call rota.
System 02 — GUARD
Continuous protection · Stabilises
Perimeter · active
Mechanism — five states
Illustrative schematic. Not telemetry, not a client, not a real incident.
02 — Detection
The system stops treating the deviation as routine.
The GUARD executive cadence exists so that someone with a name and a mandate looks at the deviation before it becomes a board matter.
Marked
03 — Encirclement
Before anything is removed, the edge is drawn.
What may be touched, what must be preserved as evidence and what keeps operating are three different answers. They have to be given at the same hour.
Perimeter closed
04 — Containment
The isolated area stops being a path.
Isolation costs operation. That is why the decision is executive before it is technical: someone has to authorise what stops and own what that interrupts.
Route severed
05 — Hold
The perimeter stays up after the urgency passes.
What GUARD changes is permanence. The control becomes routine with an owner, evidence and review — not a project that ends when the alarm ends.
Perimeter held
Standing perimeter
GUARD keeps risk visible, action moving and decisions on the record.
What stands
- 01vCISO leadership
- 02Monthly executive scorecard
- 03Risk and action register
- 04Secure architecture reviews
- 05AI and data governance
- 06Readiness exercises
What stays up between one incident and the next.