The Interdiction Model¶

"A kill chain is not broken by patching the worst thing on it. It is broken by cutting it. Those are different sets, they are usually different sizes, and only one of them is computable. Interdiction is the discipline of finding the cut, pricing it, and declining the work that is not in it."

This supersedes the operating model in Quantum Vulnerability Management. The philosophy in Book VII is unchanged and the four time budgets survive; what changes is the object being budgeted, the way it is selected, and the metric that says whether any of it is working. It is consumed by the Kill Chain Assessment app and by ORION.

Why "quantum" retires¶

The word was doing two jobs at once — naming the time budget (hours / days / sprint) and naming the unit of work (atomic, all-or-nothing, closes a path). Those are orthogonal. It also collides with quantum computing, which is not a hypothetical problem: the collision costs a reader a wrong turn through QAOA literature before they arrive at a framework that has nothing to do with it.

Was	Is	Why
quantum	cut	The unit is a cut in the graph-theoretic sense — the object that actually severs a path. Mathematically exact, one syllable, verbs.
critical / severe / standard quantum	hour-cut / day-cut / sprint-cut	Time budget becomes an adjective on the unit rather than a competing name for it.
dark quantum	dark	Unchanged in meaning: cannot be placed inside or outside the cut.
—	declined	New. Not in any cut, and the intervention is net-negative.
"did the kill chain get shorter?"	cut depth (κ)	A number, not a question.
the framework	interdiction	Names an existing body of operations research this is an instance of, rather than inventing a private vocabulary.

The problem in one paragraph¶

Prioritisation by severity fails because severity is a property of the vulnerability and the thing that kills you is a property of the estate. Prioritisation by kill-chain position — the previous model — is a large improvement and still wrong in one specific way: it ranks by membership on the cheapest adversary path, and removing a link from the cheapest path does not sever anything, it promotes the second-cheapest path. The set that actually severs is a cut, it is not the same set as "everything on the chain", it is usually smaller, and unlike the chain it is a thing you can compute, price, and argue about with a client.

1. The estate graph¶

Let G = (V, E) be a directed graph over one estate.

Object	Definition	Where it comes from
V	States. A state is an (asset, privilege) or (identity, scope) pair — "local admin on the jump host", "the Entra Connect sync account"	Capability templates, asset inventory, BloodHound
E	Adversary moves. `e = (u,v)` asserts from u an adversary can reach v	Consultant judgement, BloodHound paths, the coupling library
S ⊆ V	Entry set: internet-reachable services, phishable identities, supplier connections, physical access	External scan, perimeter capability
J ⊆ V	Jewel set: existential states — the estate cannot operate, or cannot recover, past this point	"What stops the business operating?"

Add a super-source σ with infinite-capacity edges into every member of S, and a super-sink τ with infinite-capacity edges out of every member of J. Everything below is then a single-source, single-sink problem regardless of how many entries and jewels exist.

Two weights, not one¶

This is the structural addition. The previous model carried one weight and it was the wrong side of the problem.

Weight	Meaning	Range	Used for
a(e)	Adversary effort — how hard is this single hop for the attacker	1 (trivial) … 5 (very hard)	Path finding: where the chain runs
d(e)	Defender cost — what it costs us to remove this edge	currency, or ordinal	Cut finding: what we should do about it

a(e) already exists. d(e) does not, and without it no cut can be selected, only enumerated.

d(e) is not a single number but the minimum over the interventions available on that edge:

d(e) = min  cost(i)   over i ∈ I(e)
I(e) = { patch, compensating control, architectural change, decommission }

and each intervention carries three attributes that the cost alone does not capture:

time_class      hours | days | sprint      → which budget it fits
reversibility   reversible | costly | irreversible
iatrogenic      P(this change breaks something) × outage cost

An edge removable by a firewall rule and an edge removable only by a vendor patch with a reboot are both "one edge" to the graph and nothing alike to the business. d(e) is where that difference lives.

2. A path is not a cut¶

The previous model's definition of P0 — "on the shortest chain; break any one link and the existential path is severed" — holds only when exactly one path exists.

        ┌──── a=2 ──── x ──── a=3 ────┐
   σ ───┤                             ├─── τ        shortest chain = 5, via x
        └──── a=3 ──── y ──── a=4 ────┘             second chain   = 7, via y

   Break the x-chain: the estate is not severed. It is now a 7 instead of a 5.
   You have bought the adversary two effort units and spent a change window.

Definitions¶

A set C ⊆ E is an (S,J)-cut if every directed path from S to J uses at least one edge of C — equivalently, G − C contains no S→J path.

Minimum cut: a cut minimising |C|.
Minimum-cost cut: a cut minimising Σ d(e) over e ∈ C.

Both are computable in polynomial time by max-flow / min-cut with edge capacities set to d(e). There is no NP-hardness here and no reason to reach for anything exotic.

Node removal — remediating a host or an identity rather than a single hop — is handled by the standard node-splitting transformation: replace each v with v_in → v_out carrying capacity equal to the cost of remediating v, leave original edges at infinite capacity, run the same algorithm. Most real remediation is node removal, so this is the common case, not the exception.

Menger's theorem, and why it matters commercially¶

The maximum number of edge-disjoint S→J paths equals the cardinality of the minimum S→J edge cut. So the minimum cut is not merely a set of things to do — its size is the number of independent successes the adversary needs.

That is a number you can put in front of a board:

Your estate has a cut depth of 1. One compromised service account ends it. The programme takes you to 4.

Compare with a CVSS distribution, which says nothing and cannot be moved.

Worked example¶

Eight edges, three routes to the domain controller. Adversary effort in the first number, defender cost in the second.

                    ┌── web ──────── app ───────┐
              (a2,d9)│        (a3,d6)     (a2,d8)│
                     │                           ▼
   entry ────────────┼── vpn ──── jump ────────► dc
         (a3,d7)     │      (a1,d5)     (a2,d4)  ▲
                     └── phish ────────┘         │
              (a1,d9)         (a4,d6)            │

Shortest chain: entry → vpn → jump → dc, adversary effort 6.
Old P0 rule — break the weakest link on that chain, vpn → jump: the estate is still connected, now via entry → phish → jump → dc. A change window spent, nothing severed.
Minimum-cost cut: { web → app , jump → dc }, defender cost 10. The estate is disconnected.
Note that web → app is not on the shortest chain at all. The cut routinely contains edges the chain-position model never surfaces, and omits edges it flags as critical.
κ̂ = 2, matching the two edge-disjoint routes — Menger, as expected.

The general lesson: the set you must act on is not a subset of the chain you can see.

3. The cut — the unit of work¶

A cut (the unit) is one atomic remediation that:

Removes at least one edge of the selected cut set — not a finding in the abstract, an edge on a mapped path.
Fits a declared time budget — hours, days, or a sprint.
Ends in a verifiable signal — a test proving the edge is gone. An unverified removal is a ghost cut: fully traversable and now invisible.

The properties that made "quantum" a good word survive intact. A cut is atomic — a control applied to 80% of the fleet has not removed the edge, it has removed it from the part of the graph you were looking at. A cut is discrete — work is packetised into units that fit the time available rather than smeared across a backlog with no front.

The five classes¶

Class	Budget	Condition	Response
hour-cut	Hours	In the selected cut set; reachable; exploit live; uncompensated	Sever reachability by the cheapest reversible control available. Not the patch — the patch may not exist and cannot meet the budget.
day-cut	Days	In the selected cut set; material but not racing	One change window, batched, verified before closure
sprint-cut	Sprint	In the selected cut set; no urgency	Engineering rhythm; this is where patch velocity is the correct tool
dark	Unsized	Cannot be placed inside or outside the cut — reachability or exploitability unknown	Route to discovery. Not remediation work.
declined	—	In no S→J path; intervention is net-negative (§5)	Documented risk acceptance with an owner and a review trigger

The membership rule — and why the old rule over-included¶

Membership is a property of the selected cut, not of the vulnerability.

Two criticals on the same path need one intervention between them, not two. Under the old rule ("on the kill chain → do it now") both were hour-quanta. Under the cut rule the cheaper one is selected and the other is deferred or declined. At client scale this is the difference between a remediation plan that gets executed and one that gets filed.

4. Labelled cuts — where the leverage actually is¶

One remediation usually removes several edges at once. Patching a CVE removes every hop that CVE enabled; disabling NTLM removes a class of relay edges across the estate; deploying one CA policy removes every edge that depended on an unmanaged device.

Formally, let ℓ : E → L map each edge to the remediation that removes it. The problem becomes: find the minimum-cost set of labels whose removal disconnects S from J. This is Minimum Label Cut (also studied as hedge connectivity), and unlike the unlabelled case it is NP-hard and hard to approximate in general.

That is less of a problem than it sounds and more of an opportunity than it looks:

At estate scale it does not bite. Hundreds to a few thousand nodes yields an ILP that solves in seconds.
A greedy heuristic is serviceable — repeatedly take the label with the best edges-severed-per-unit-cost, recompute, stop when disconnected. Treat this as a heuristic with no approximation guarantee, and verify the result by recomputing the cut on the reduced graph rather than trusting the greedy trace.
Label multiplicity is convexity. A label sitting on six cut edges is a small, bounded cost against a large, structural payoff — Pillar 5 made arithmetic. Ranking candidate labels by multiplicity is the single cheapest piece of analysis in the model.

No quantum computer is required, or useful, anywhere in this. Min-cut is polynomial; label cut yields to an ILP at the sizes that occur. The word "quantum" in the previous model never referred to quantum computing, which is part of why it had to go.

5. Pricing the cut — and the iatrogenic rule¶

Patching is a change, and changes break things. A model that treats remediation as costless is not a security model, it is a wish. For an intervention i removing edge e:

EV(i)  =  P(adversary traverses e) × Impact(e)  −  P(i breaks something) × OutageCost(i)

Two consequences follow immediately.

The ~90% subtraction gets a stronger argument. The previous model said most criticals are not exploitable, therefore deprioritise. The correct statement is harder: for an edge lying on no S→J path, Impact(e) ≈ 0 existentially, while the iatrogenic term stays strictly positive. EV is negative. The patch is net-harmful. That is not "low priority" — it is do not do this, and it is via negativa with an arithmetic behind it instead of a slogan.

This creates the declined class. A declined cut is a deliberate, owned, documented refusal — not a backlog item that quietly ages. It carries an owner, the reasoning, and a review trigger, exactly like any other decision.

⚠️ The declined class is technically defensible and politically expensive. Under NIS2, ISO 27001, or a regulated utility's own standard, "we computed that patching this is net-negative" may simply not be an available answer regardless of the arithmetic — and an obligation edge (coupling type 6) can force the work anyway. Establish per-client, in writing, whether the declined class exists at all before it appears in a deliverable. Where it does not, those items return to the sprint-cut backlog and the honest framing is that compliance is buying insurance at a price the model says is above fair value. That is a legitimate thing for a client to choose. It is not a legitimate thing for a consultant to hide.

6. Cut depth (κ) — the metric¶

Define κ̂ = |C*|, the cardinality of the minimum cut computed on the mapped graph. The hat is not decoration; §9 explains why it can never come off.

κ̂	Reading
1	A single point of existential failure. One success ends it.
2–3	The adversary needs independent successes, but a competent operator chains them in one campaign.
≥4	Compromise requires a sustained campaign with multiple independent footholds.

Depth and width are different numbers¶

Kill-chain length ℓ measures depth — how many hops to the jewel. κ̂ measures width — how many independent routes exist. The previous model tracked only ℓ, and ℓ alone is misleading:

   ℓ = 7, κ̂ = 1     long and brittle — one link carries everything.
                      Looks healthy on a chain-length report. Is not.

   ℓ = 3, κ̂ = 5     short and wide — nasty, but survives single failures
                      and gives detection five chances instead of one.

Report the pair (ℓ, κ̂), never either alone. Lengthening a chain by a hop while twelve parallel paths remain is cosmetic work that reports beautifully.

7. Antifragility, formally¶

The previous model asserted antifragility and measured it with a question. With κ as a state variable it becomes a condition that can be false.

Let Λ be adversary pressure — the arrival rate of events that test the estate: exploited-or-near findings, incidents, red-team results, disclosed vulnerabilities landing on mapped nodes.

Regime	Condition	What it looks like
Fragile	`E[Δκ \\| event] < 0`	Each event is absorbed by patching the specific edge. Structure unchanged; the next CVE on the same node reopens it. κ drifts down under pressure.
Robust	`E[Δκ \\| event] = 0`	Events are survived. Nothing is learned.
Antifragile	`E[Δκ \\| event] > 0`	Each event yields a structural cut removing more paths than the event exploited. Pressure makes the estate harder.

A remediation programme is antifragile if and only if the expected gain in cut depth per unit of adversary pressure is positive.

That is gain from disorder stated so it can be falsified, and it is the same claim Pillar 3 makes in prose.

Measuring it without fooling yourself¶

κ̂ can rise for two entirely different reasons, and conflating them makes the metric worthless:

The estate improved — a path was severed. This is the signal.
The map improved — discovery found an edge, or resolved a dark one. This is not progress in security, though it is progress in knowledge, and it can move κ̂ in either direction.

So every edge mutation carries a cause: discovery | remediation | drift | disclosure. The antifragility coefficient is the slope of κ̂ against cumulative events computed over remediation-caused changes only. Discovery-caused change is reported separately, as map completeness.

This also satisfies the process-liveness rule: the κ̂ slope goes bad the moment the feedback loop stops running, and there is no way to improve it by relabelling.

8. The barbell, derived rather than asserted¶

The barbell was previously a doctrine. It is in fact the shape a cost-minimising cut takes, which is a much stronger position to argue from.

  CHEAP / FAST / REVERSIBLE                          SLOW / STRUCTURAL / DURABLE
  low d(e), reversible                               high d(e), but ℓ(e) covers many edges
  → selected by min-cost cut directly                → lowest amortised cost per edge cut
            ◄────────────  NEVER SELECTED WHILE ALTERNATIVES EXIST  ────────────►
            mid-to-high d(e), label multiplicity 1, alternatives
            available on the same path. The fragile middle is not
            forbidden by doctrine — it simply never wins the argmin.

Both ends are convex. The middle is concave. The algorithm reaches this on its own, which means the barbell survives a client who does not accept Taleb as an authority.

9. The completeness problem — a cut claims more than a path¶

This is the model's most serious weakness and it must be stated wherever κ̂ is reported.

A shortest path is an existential claim: "here is a route." One counterexample proves it. An incomplete map understates the danger but never invents one.

A cut is a universal claim: "there is no route." It is falsified by a single unmapped edge. On an incompletely mapped graph, a min-cut produces confident, specific, wrong assurance — which is worse than the vague discomfort the path model left you with.

Four constraints follow, and none are optional:

Conservative closure. Unknown edges are present until disproved. A node pair with unknown reachability contributes an edge. Dark is not absent.
κ̂ is an upper bound. Report it with the dark-edge count beside it, always. A κ̂ of 4 over a graph with 30 unresolved edges is an assertion, not a measurement.
Language discipline. Never "the path is severed". Always "every mapped path is severed, over a map of stated completeness". The qualifier is the honest part of the sentence.
Edges need falsifiers. An edge asserted absent is a claim, and a claim without a falsifier and a test is an opinion. This is the same discipline the claim ledger already imposes on everything else; edges get no exemption.

The uncomfortable implication is worth stating plainly: the model is only as good as the graph, and the graph is always incomplete. What it buys is not certainty but a specific, checkable place to put the uncertainty — the dark-edge count — instead of spreading it invisibly across a backlog.

10. Running it¶

Map. Nodes, edges, entries, jewels. Unknown reachability becomes an edge, not a blank.
Weight twice. a(e) for the adversary, d(e) for us, with time class, reversibility and iatrogenic risk on each intervention.
Label. Which remediation removes which edges. Rank candidate labels by multiplicity before anything else — this is the cheapest analysis in the engagement and it usually reorders the plan.
Cut. Min-cost cut over d. Node-split where remediation removes a host or identity.
Classify. Every edge in the cut set into hour / day / sprint. Everything in no S→J path into declined — subject to the obligation check. Everything unresolvable into dark.
Decline explicitly. Owner, reasoning, review trigger. A declined cut that is not written down is not a decision, it is an omission.
Execute and verify. Each cut closes with a signal. No signal, no closure — a ghost cut is worse than an open one.
Recompute. New κ̂. Tag each edge change with its cause.
Close the loop. After every exploited-or-near event, ask what structural cut it bought. Chart κ̂ against cumulative events over remediation-caused changes. That slope is the programme.

11. What would falsify this¶

Stated as tests, because a model whose failure conditions are unspecified is a belief.

Does the computed cut match what actually worked? Run it backwards over two completed engagements. If the min-cost cut names five interventions, the engagement did five different ones, and the estate demonstrably improved — the cost model is wrong, or the graph was.

Is d(e) estimable? Have two consultants independently price the same estate. If they disagree by more than a factor of two, the min-cost cut is noise and only the unweighted κ̂ survives. This is the most likely failure and it should be tested before any of this reaches a client.

Does κ̂ move when it should? A completed segmentation project that does not move κ̂ means either the graph does not represent segmentation or the metric does not capture it. Either way, something is broken.

Does the declined class survive contact with a regulator? Needs a legal read, per client, before it appears in a deliverable. If it never survives, the class is theoretical and the model should say so rather than carrying it as decoration.

Is a single (S,J) cut the right object? An estate with several jewel classes of differing impact may need a weighted multi-terminal formulation; a single cut may over-invest on a cheap jewel or under-invest on an expensive one. Resolve empirically on one real estate before generalising.

Honest uncertainty¶

The mathematics is settled and not in doubt — max-flow/min-cut, Menger, node-splitting and the hardness of label cut are textbook. What is unvalidated is every part where this model meets an estate: whether consultants can price d(e) consistently, whether the coupling library projects into a graph that reproduces real attack paths, whether κ̂ behaves as a programme metric over a multi-year engagement rather than a quarter, and whether the declined class is usable in a regulated entity. Treat the formalism as sound and the application as a hypothesis under test.

One thing not in doubt: the previous model's P0 definition was wrong, and every remediation plan built on "break any one link on the shortest chain" promoted a second path instead of severing anything. That correction stands independently of whether the rest of this survives.

References¶

Wood, R.K. (1993). Deterministic network interdiction. Mathematical and Computer Modelling 17(2), 1–18. doi:10.1016/0895-7177(93)90236-R — the canonical formulation: minimise an adversary's network performance subject to a defender budget.
Israeli, E. & Wood, R.K. (2002). Shortest-path network interdiction. Networks 40(2), 97–111. doi:10.1002/net.10039 — the shortest-path variant, closest to the kill-chain framing.
Menger, K. (1927). Max-flow/min-cut duality; see any graph theory text for the modern statement.
Zhang, P. et al. Minimum Label Cut / hedge connectivity — hardness and approximation landscape, arXiv:1908.06541.

Companion documents: Book VII — Vulnerability Management for the philosophy; Kill Chain Assessment app for the instrument; AI-Assisted TVM for hour-cut automation; Antifragile Manifest for the pillars this derives from.