Vauban’s Ricochet and the Math of Defense

A fortress designer had to protect every approach worth defending. The besieging army needed only one approach it could exploit.

In the 17th century, Vauban understood the difference.

Before attacking a fortress, engineers studied its geometry, surrounding terrain, fields of fire and opportunities for protected approach. They did not have to challenge the strongest defensive position. They could select ground and an approach of their choice.

This fact creates enormous mathematical consequence for modern cybersecurity.

The defender must make thousands of possible attack paths sufficiently resistant. The attacker needs only to find one that works.

Consider a hypothetical network with 100 possible paths toward valuable assets.

Suppose 99 are effectively blocked, but one remains open. The security team might report that 99% of the examined paths are protected.

The attacker sees something different. One available route. 

And if the attacker can discover it, the other 99 barriers may be irrelevant to that intrusion. This is not a probability calculation about randomly selected attacks. It is a problem of adversarial choice.

Historically, selecting the angle demanded scarce human expertise. Every unsuccessful attempt consumed human attention.

Autonomous AI changes those economics. Agents can investigate multiple paths, test assumptions, discard failures and use findings to select subsequent attempts.

The cost of discovering an exploitable route can decline dramatically, even when exploiting it remains difficult.

The attacker increasingly gets to search for the weakest condition rather than gamble against the average defense.

This exposes a weakness in how cybersecurity effectiveness is measured.

How many vulnerabilities were patched? How many devices have endpoint protection? How many alerts were investigated? What percentage of controls passed their tests?

These do not necessarily establish whether an attacker can still move from an accessible device to a critical asset.

The relevant question is whether the architecture itself prevents the discovery of a viable path.

Restrictions on unauthorized network reach, independently enforced access boundaries and constraints on lateral movement can deny routes that detection systems might otherwise permit. They do not require the defender to predict every possible malicious action. They restrict which actions can succeed. 

And they can be tested directly: Can this source reach that asset? Can a compromised device cross this boundary? Does unauthorized discovery trigger enforcement?

Vauban did not need to defeat the fortress everywhere. He needed a viable approach to the objective.

As autonomous reconnaissance makes the search for that approach cheaper, the measure of cyber defense must shift from how much we monitor to how much we make unavailable.

The attacker gets to choose the angle. The defender must change the geometry.