The Canon, No. 1: The Colonel Who Never Wrote a Book.

This is the first issue of The Canon, a monthly format. One strategist from history discussing one problem sitting on your desk right now, and one number you can use. Strategy is a 2,500 year old discipline, and most of it was written by people who never saw a SOC and understood your job better than your vendors do.

The slide says Operate Inside the Adversary's Loop. Four arrows in a circle, a lap time, a promise that the platform cycles faster than the attacker. You have seen this slide so many times you could present it yourself, and this week, somewhere between the badge scan and the third espresso, a vendor will show it to you again.

The man who drew the loop never sold anything in his life.

John Boyd, the original author, published no book. His entire written output was a sixteen-page essay called "Destruction and Creation" and a stack of briefing slides. The ideas spread the hard way, through a marathon Pentagon briefing called Patterns of Conflict, delivered hundreds of times over two decades to anyone who would sit still for it. Before that he was a fighter pilot at Nellis with a standing bet: starting from total disadvantage, opponent locked on his tail, he would reverse the positions inside forty seconds or pay forty dollars. They called him Forty Second Boyd. By every account in Robert Coram's biography (Amazon book link), he never paid.

His energy maneuverability math helped build the F-15 and the F-16 fighter jets. The Marine Corps rebuilt its entire fighting doctrine around his thinking and wrote it into a manual called Warfighting. And the acronym that escaped into every industry on earth, Observe, Orient, Decide, Act (OODA), now sells a version of the idea Boyd spent his life arguing against.

The popular version goes like this. Combat is a race around a circle, and whoever laps it faster wins. Cycle through the four stages quicker than the adversary and you are operating inside his loop. Victory through velocity.

Vendors love this reading, and you will notice why. Speed is a product feature. Speed has a SKU. If OODA means faster, then the answer to OODA is a purchase order for a new shiny tool, and the pitch you sat through last quarter was actually selling you a shorter lap time.

Boyd drew it differently (see below and if you have the time and interest, read his original thesis). In his own sketch, the four stages are not equal boxes on a circle. Orient is the big box in the middle, feedback arrows running into everything else, and he filled it with the things that shape how a person sees: cultural traditions, genetic heritage, previous experience, new information, and the analysis that fuses them into a picture of what is happening. Orientation is the model of reality you carry into the fight. Observation feeds it. Decision and Action come out of it. Which gives the loop a failure mode no platform can patch. Run bad orientation faster and you lose faster, with more confidence to boot!

Now put this season's two numbers side by side. CrowdStrike's latest Global Threat Report spells out that the average eCrime breakout, initial access to lateral movement, is at 29 minutes, down from 48 a year earlier, with the fastest observed case at 27 seconds. IBM's Cost of a Data Breach report, released last week, puts the average time to identify and contain a breach at 247 days. And this is what should bother you: that figure went up! A year ago the same metric was being celebrated as a nine year low. Now it has reversed for the first time in five years, while the attacker's side accelerated 65 percent in a single cycle. Attackers got faster. Defenders got slower. And nearly every dollar in this industry is chasing the half that was already moving and winning.

Walk your own incident OODA loop and look for where the time actually pools. Not in Observe. Telemetry is the one thing you own in embarrassing abundance. Not in Act. Your tools can isolate a host in milliseconds. The days pool in the middle two letters, and they pool for organizational reasons.

Orient stalls because the model of reality your team carries was assembled from the wrong sources. Count honestly. How much of your threat model came from your own incident history, and how much arrived through vendor briefings, analyst quadrants, and keynote stages? Boyd himself ranked what matters in war as people first, ideas second, hardware third. Most security programs invest in exactly the reverse order, then wonder why the expensive hardware keeps observing things nobody was oriented to understand.

Decide stalls because the authority pools at the top. I have sat in tabletop exercises where the technical containment was a five minute action and the decision to take it was a multi hour negotiation, because isolating that segment of the network meant stopping production, and stopping production needed a call, and the call needed another call. The attacker's decision cycle involved one person. Ours involved a committee that had never rehearsed. You have your own version of this story. Every executive reading this does., you know you do.

Here is the part the speed merchants leave out. Boyd's answer to tempo was never a faster general. It was removing the general from the loop. The maneuver warfare the Marines built on his ideas runs on two components, commander's intent and decentralized execution. Leadership defines what must be achieved and what may be sacrificed. The people closest to the fight decide how, without phoning home, because they already share the commander's orientation. Tempo comes from the decisions you no longer have to make in the moment, and nobody sells those.

Russia proved this in Ukraine. An army with no tradition of junior initiative had to send its generals forward to make decisions a sergeant should have made, and Ukrainian snipers and strike cells killed them at a rate no modern army has sustained.

Instead, you should write the intent down. One page max. What we protect first, what we are willing to lose protecting it, who can pull which trigger at 2 a.m. without a phone call while you are unreachable over the Atlantic. If your incident response plan is mostly a contact tree, you own a phone directory, not an incident response doctrine.

Then audit where your orientation actually comes from. Set a ratio, the share of your threat model derived from your own environment against the share that arrived on someone's marketing budget, and move it every quarter. Your last three incidents will teach you more than your next three briefings, and unlike the briefings, they are already paid for.

And pre-decide the expensive calls. Isolating the plant network. Killing remote access. Engaging counsel. Notifying. These are brutal at 2 a.m. and uncomfortable on a Tuesday afternoon with everyone who could later veto them sitting in the room. Make them on that Tuesday afternoon. The fastest decision cycle is the one you already executed in daylight.

That will carry you much further than the renewal you are about to sign. The hard part, and I will be honest here, is the political engineering underneath. Getting legal, operations, and the board to pre-commit to those trigger rights. Keeping the commitment alive through leadership turnover and budget season. I would love to tell you there is a template. I have never seen one survive in the real-world. Inside a global manufacturing environment, that work has taken me many moons, and it is not finished. If you are in the middle of the same fight, my inbox is open, and I suspect your scar tissue looks like mine.

Boyd used to pull his protégés aside for a speech Coram reconstructs, about a fork in the road. One path leads to being somebody. Promotion, title, the corner office. The other leads to doing something that outlasts you, and you rarely get both. Security leadership stands at the same fork. You can be the somebody every incident routes through, the indispensable bottleneck the whole loop waits on. Or you can build an organization oriented well enough to decide without you.

Boyd chose so completely that he died a colonel. Passed over for promotions, no book, no company, no fortune. At his funeral at Arlington, a Marine stepped forward to the casket of an Air Force officer and placed the eagle, globe, and anchor on it.

Nobody ordered that. Nobody had to.

Where does your loop stall, Orient or Decide? Send me an email and let me know.