Track 1 · Digital Security

Intelligence-led cyber defense: from threat landscape to recovery

The digital track covers seven of the nine phases of the Doctrine Security framework. Each phase is continuous, feeds the next, and is grounded in intelligence about the specific adversaries most likely to target your organization.

Phase 1
Threat Landscape & Attack Surface
Know who is coming, what they can see, and where your real exposure sits — before you build a single detection.
Read deep dive →
Phase 2
Log Intelligence & Infrastructure
Field-level analysis, adaptability framework, pipeline integrity — managing logs as intelligence, not cost.
Read deep dive →
Phase 3
Detection Engineering & Automation
Summiting the Pyramid scoring, four gap types, SOAR automation, bespoke tooling, SIEM migration.
Read deep dive →
Phase 4
Intelligence-led Threat Hunting
Intel-driven hypothesis building — not calendar cadence. Hunt findings feed detection and log strategy.
Read deep dive →
Phase 5
Human Security
Executive threat profiling, digital footprint, continuous monitoring, OPSEC, surveillance awareness, foreign travel, family protection.
Read deep dive →
Phase 6
Validation
Purple team, BAS, red team — continuous validation scored using Summiting the Pyramid methodology.
Read deep dive →
Phase 7
DFIR — Investigation & Forensics
Forensic readiness before you need it. Preservation before restoration. DFIR findings feeding the program.
Read deep dive →
Phase 8
Intelligence-led Recovery
Crown jewel identification, adversary-specific DR, backup isolation, root cause before restoration.
Read deep dive →
Phase 9
The Integrator
The Executive Officer equivalent — synthesizing across all disciplines. The role enterprise security is missing.
Read deep dive →
Referenced frameworks — each linked to the source
MITRE ATT&CK
Adversary tactics, techniques, and procedures. The shared language for threat-informed defense.
attack.mitre.org ↗
Summiting the Pyramid
MITRE CTID methodology for scoring detection robustness against adversary evasion. December 2024.
ctid.mitre-engenuity.org ↗
MITRE D3FEND
Defensive techniques mapped to adversary techniques. Countermeasure framework.
d3fend.mitre.org ↗
MITRE ATLAS
Tactics and techniques for adversarial attacks on machine learning systems and AI-enabled threats.
atlas.mitre.org ↗
MITRE ENGAGE
Adversary engagement framework — denial, deception, and adversary manipulation.
engage.mitre.org ↗
Cyber Kill Chain
Lockheed Martin's intrusion kill chain — reconnaissance through actions on objectives.
lockheedmartin.com ↗
Unified Kill Chain
Extended 18-phase model unifying Kill Chain and ATT&CK for more complete attack modeling.
unifiedkillchain.com ↗
Diamond Model
Intrusion analysis framework mapping adversary, capability, infrastructure, and victim relationships.
activeresponse.org ↗
Deep dive articles
The Methodology
Intelligence-led enterprise security: the complete framework
Read →
 Phase 1
Before you build a single detection, know who is coming for you
Read →
 Phase 2
Your logs are telling you something. Are you listening?
Read →
 Phase 3
Close the gap between what you can detect and what you need to
Read →
 Phase 4
Threat hunting is not a calendar event
Read →
 Phase 6
Does your defense actually work? Here is how to find out.
Read →
 Phase 7
You will be breached. The question is whether you are ready.
Read →
 Phase 8
Recovery is not restore-from-backup. It is a security operation.
Read →
 Phase 9
The role enterprise security is missing
Read →