Changing the physics of cyber defense

In Changing the physics of cyber defence, John Lambert explains that threat actors build attack graphs to map ways into a target and pivot within an environment, a concept Microsoft argues defenders should mirror to see how risks propagate. He describes how defenders at Microsoft use graph-based thinking, with Azure Data Explorer and Kusto Query Language aiding the shift from relational tables to graphs and other data representations, termed the algebras of defence.

The piece stresses building difficult terrain through proactive hygiene, including endpoint protection, network segmentation, threat modelling, and especially multifactor authentication to curb attacker movement. It also highlights the need for strong asset management, removal of orphaned elements, and ongoing collaboration with peers to share breach details and coordinate incident response.

Lambert argues that with vast data, advanced AI, and the algebras of defence, defenders can reduce noise, improve detection, and accelerate remediation, effectively rewriting the physics of defence. According to Microsoft Deputy CISOs, this shift embodies turning complexity into clarity and reclaiming the advantage against threat actors.