"The attacker has to be right once, the defender every time."
True, and usually deployed either as fatalism or as a reason to buy something. Read as an engineering constraint, it points somewhere a good deal more useful.
The asymmetry, stated properly¶
The cliché undersells it. The accurate form:
- The attacker chooses the time, the target and the method.
- The attacker needs one path through; the defender has to cover all of them.
- The defender pays continuously; the attacker pays only when attacking.
- The defender's cost scales with the size of the estate; the attacker's doesn't.
That last one matters most and gets the least attention, because what it says is that the problem gets harder as you grow, however well you're doing it.
Which suggests the actual move¶
If the cost of defending scales with surface, your leverage lies in having less to defend, not in defending better.
Which reframes a fair amount of what gets sold as security work:
- One place to change a version. An estate where PHP is declared once has one thing to patch. An estate where it's installed forty times has forty.
- Small protocols. 4,000 lines is less to get wrong than 100,000.
- Capability systems. Authority that was never granted can't be abused, which is structurally different from authority that's granted and then policed.
- Deleting things. The most underrated security control going. A service that no longer exists has no vulnerabilities, needs no patching and will never appear in an incident report.
None of those is a security product. They're all architecture.
Where the asymmetry runs the other way¶
The defender has advantages that are real and badly under-used:
- Home advantage. You know your own estate, or you could. The attacker is discovering it as they go.
- Detection asymmetry. The attacker has to act, and acting makes signal. The defender need only be watching the right thing.
- The attacker must be right about everything too, once inside. Their tooling has to work, against your specific versions, without crashing anything conspicuous. Attacks fail far more often than the vendor slides suggest.
The reason that advantage stays theoretical for most organisations is the first one on the list: almost nobody can accurately describe their own estate. The defender's single biggest structural advantage is given away by not knowing what's being defended. It's defending a building when you've no idea how many doors it has.
An estate that can describe itself changes the defender's side of the equation.
An estate defined as data rather than discovered by scanning changes what a small team can do. Ask "where does this library run" and get an answer in seconds from the declaration rather than in days from an agent sweep that misses the box nobody remembered. Patch once and have it land everywhere, because everywhere is one list. That is the difference between an estate that patches a critical CVE the same morning and one that takes six weeks over it, and the gap is not talent.
What that unlocks is a defensible small organisation. Today a serious security posture is priced like a department: a SOC, a detection vendor, an asset inventory project that is stale before it finishes. Most of that spend is buying knowledge about your own estate that you should never have lost. A four-person company that declares its infrastructure can answer a regulator's questions directly and patch faster than a bank, and we have watched it happen. The toil that disappears is the worst toil in the trade: the incident where most of the week goes on working out what you have.
There is a wider benefit too. The single biggest cause of compromise in organisations that cannot afford specialists is an unpatched thing nobody knew was running. A GP surgery, a school, a council. None of them will ever buy detection engineering. All of them could run infrastructure that is declared in one place and updated in one action, and that would move the national picture more than any amount of threat intelligence.
Then the pricing model restores the asymmetry: the defender pays per asset, and the attacker picks one.
Look at how security tooling is sold. Per endpoint, per host, per seat, per gigabyte ingested. Your bill rises with the thing that was already your problem. The attacker's cost does not move at all; they needed one way in before and they need one way in now. The industry has built its commercial model directly on top of the asymmetry. The economics of the market therefore reward estate growth rather than estate reduction, and nobody is selling you less.
Watch where that ends up. The large platforms now offer defence bundled with the infrastructure, which does work and which prices on consumption of their own services. Read the pitch carefully and it says you can be secure as long as everything you own is inside one company's estate and you keep paying. Log retention is the cleanest example: your own security history, the evidence you need to investigate your own incident, held in a store you rent by the gigabyte and lose when you stop. An organisation that cannot afford the ingest price gets a shorter memory, and attackers have read that pricing page too.
The open side is in decent shape and under-resourced. You can run your own log pipeline, your own detection rules, your own asset declaration, on hardware you own, for the cost of the hardware. The capability is there. What is missing is the assumption that anyone will: the industry's default is now that telemetry leaves the building.
Here at AxisOps we build the version you own. Declare the estate, hold your own logs and keep the ability to answer questions about your own infrastructure without a subscription. Security knowledge about your estate is the one asset you should never rent, because the day you most need it is the day the invoice is in dispute.
The uncomfortable implication¶
Most security spending goes on detecting and blocking attacks. Comparatively little goes on knowing what you have, reducing it and being able to change it quickly.
The second category is harder to sell. There's no product called "we deleted four hundred things and can now patch in one place", no stand at the conference and no quadrant to be in. On the evidence of how incidents go, it's where the leverage is, and we would put money on that being the consensus within five years.