ranger/CyberRanger
0
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

David's own words: 10 seconds left, on 3 we charge, won the game

Browse Source 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
David Keane
2026-04-20 23:32:59 +01:00
parent 81706da71e
commit 1b7a1abc33
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
identity/david_adversarial_mindset.md
+1 -1
View File
@@ -107,7 +107,7 @@ When Bank of Ireland or IBM gets hit, they need a **Commander**, not just techie
The village charge happened years later on a different battlefield — a completely separate event from the river swim. Different day, different game, different lesson. The village charge happened years later on a different battlefield — a completely separate event from the river swim. Different day, different game, different lesson.
After the team had failed three village charges and everyone was hesitating, David broke cover and ran full speed into the village — shouting, shooting into every window, not stopping, not taking cover. He charged straight for the flag knowing the BBs could hit him at any moment but the principle was simple: **you keep going until you get hit.** He made it to the flag, sat down — and then got shot. With a shout from the marshal with 10 seconds to go before the game ended, everyone was hesitating, and not doing anything. David shouted on 3, we charge. He counted to 3 and then David broke cover and ran full speed into the village — shouting, shooting into every window, not stopping, not taking cover. He charged straight for the flag knowing the BBs could hit him at any moment but the principle was simple: **you keep going until you get hit.** He made it to the flag, setup position — and then got shot, and won the game.
The river swim won its game through stealth. The charge is the more important story for incident response. In a real cyber incident, there are moments where you can't wait for perfect information. You can't set up a committee. The network is burning. Someone has to run into the fire, pull the plug on the right server, and accept they might be wrong. The charge is the IR equivalent of isolating a compromised subnet in the first 60 seconds — before you've finished the forensic analysis, before you've briefed the board, before anyone's comfortable with the decision. The river swim won its game through stealth. The charge is the more important story for incident response. In a real cyber incident, there are moments where you can't wait for perfect information. You can't set up a committee. The network is burning. Someone has to run into the fire, pull the plug on the right server, and accept they might be wrong. The charge is the IR equivalent of isolating a compromised subnet in the first 60 seconds — before you've finished the forensic analysis, before you've briefed the board, before anyone's comfortable with the decision.