logo
Defence blues
Measuring and trimming the cost
  • Red tradecraft
  • Privacy greenhouse
  • Purple crossroads
  • Indigo observatory
  • Contact
Initializing search
    • Blue team @Home
    • Servers without a security team
    • Honeytech for humans
    • Blue team for dev
    • OT and ICS security
    • Counter moves
      • Closing the doors just walked through
      • The machine at the point of impact
      • Traffic patterns as evidence
      • Inter-domain routing as a target
      • The surface designed to be accessible
      • The application layer as a target
      • Infrastructure you defend but do not own
      • Where the container meets the host
      • Systems that were never meant to be networked
      • The domain as an attack graph
      • The gap between access and authority
      • Harvesting stored secrets
      • Surviving the reboot
      • From target to target
      • Plausibility as cover
      • Memory corruption and its limits
      • Watching data being gathered
      • Watching the exits
      • Limiting the blast radius
      • Operational cost of security controls
        • MFA fatigue
        • Detection false positive economics
        • HVCI and performance overhead
        • Application control exclusion creep
        • CASB and DLP latency
        • Patch windows and the downtime tax
        • Segmentation and the rules that rot
        • Least privilege and the cost of asking
        • Log volume and the blind spots you bought
        • Backups are cheap, restores are not
        • Measuring and trimming the cost
          • Measuring a detection’s false-positive rate
          • Auditing application-control exception creep
          • Running a restore exercise
          • Reviewing standing entitlements
        • Measuring and trimming the cost
          • Measuring a detection’s false-positive rate
          • Auditing application-control exception creep
          • Running a restore exercise
          • Reviewing standing entitlements
    • Golem Trust Computing Ltd.
    • Civic Defence Establishment
    • The Circle Sea Arrangement
    • Office of Civil Surveys
    • Civil Observers’ Society
    • The Home for Bewildered Beasts of Legend
    • Campaigns, manoeuvres and scenarios

    Measuring and trimming the cost¶

    The friction pages explain what a control quietly costs. These runbooks turn that into a procedure: measure the cost, find where it has drifted, and trim it. They are the do-this-now register, one below the essays, and they pair with the pages of the same name.

    • Measuring a detection’s false-positive rate
    • Auditing application-control exception creep
    • Running a restore exercise
    • Reviewing standing entitlements
    2026-07-09 22:41
    © Copyright 2026, TyMyrddin.
    Created using Sphinx 7.2.6. and Sphinx-Immaterial

    Made with love by Ty Myrddin, 2026, with a forest garden fostered by /ut7