Objective
Visible hardening, a deception grid, and a stated attribution posture.
Joint meaning. Deter.
Discussion
Deter raises the adversary’s cost before contact. Its three instruments are visible hardening, a deception grid across the data terrain, and a stated attribution posture — the last being a governance artifact rather than a technical one.
It is the only phase whose product is partly intended for the adversary to see, and that is also its honest limit. Deterrence is unmeasurable in the individual case: an attack that did not happen leaves no evidence, and no program should claim credit for it. What is measurable is cost imposition — decoy interactions, re-tooling forced, reconnaissance that stopped when it met something instrumented.
Deter is not a stronger version of Shape. It is a different bet: that an adversary choosing among targets can be made to choose elsewhere. Against an adversary that has already chosen this target, the phase buys nothing and the correct declaration is Seize Initiative.
What the Main Effort Typically Is
Deterrence in cyber cannot rely on the adversary believing a threat. It can rely on the adversary paying for uncertainty. A data terrain seeded with decoys imposes a cost on every reconnaissance step and produces detections with essentially no false-positive budget — which is the one detection class a small team can actually action.
Typical, not prescribed. The main effort is designated per campaign against the decisive points the terrain analysis produced; what this phase does is narrow the field of sensible answers.
Dominant Forms of Maneuver
- M3 EnvelopmentMake identity, not network location, the decisive plane — surround the adversary with policy. Indicator: A stolen credential, on its own, yields no movement.
- M4 Obstacle / CanalizationForce the adversary onto ground you own and watch. Indicator: Observed lateral attempts land in instrumented segments.
- M5 AmbushTrade space for information and time, and impose cost. Indicator: The adversary interacts with a decoy, producing a detection with no false-positive budget.
Entry and Exit Conditions
A phase is declared on an observable condition and ended on one. Declaring on a feeling produces a phase nobody can argue with and nobody can end.
Declare This Phase When
- Shaping is far enough along that the hardening being advertised is real. Advertising incomplete hardening is an invitation rather than a deterrent.
- Sector, partner or government reporting indicates targeting of this kind of estate without confirmed contact against it.
- A deadline, filing season or public event creates a window in which the estate is more attractive than usual.
Leave This Phase When
- First observed activity against a declared avenue of approach — declare Seize Initiative.
- The window closes without contact — return to Shape, and record the cost-imposition evidence rather than claiming the absence of attack as a result.
What Changes in Cadence and Authority
These are the two operational consequences of the declaration. A phase change that moves neither has changed a word on a slide.
- Cadence
- Compressed from the standing cadence, typically monthly to fortnightly. The cycle cadence control takes the phase declaration as an input for exactly this reason — a phase change that does not move the cadence has not changed anything operational.
- Authority
- Pre-authorization begins to widen, and it widens along one axis: reversibility. Blocking, throttling and step-up authentication become pre-authorized; anything that degrades a statutory service or is hard to undo stays with the Authorizing Official. Widening by reversibility rather than by severity is what keeps the widening defensible after the fact.
How It Differs from the Phases Beside It
Against Shape
Shape prepares; Deter signals. The technical work overlaps almost entirely — the difference is visibility and the attribution posture, both of which are decisions rather than deployments.
Against Seize Initiative
Deter is pre-contact. Once an adversary is on a declared avenue, deterrence has failed for that adversary and continuing to invest in it is spending on an audience that has already left.
The Controls Most Active in This Phase
- CG-2 Phase DeclarationThe declaration itself, which is what makes the deception investment a phase decision rather than a project.
- SM-2 Maneuver AssignmentDeception maneuvers are sited on specific data terrain, not deployed as a general capability.
- TA-4 Pre-authorized ResponseThe pre-authorization set widens here, along the reversibility axis.
- CE-2 Priority Intelligence RequirementsIntelligence requirements re-point at the campaign being deterred, not at the estate in general.
- CE-1 Cycle CadenceCadence compresses on the strength of the declaration.
The Failure Mode Particular to This Phase
Claiming deterrence as a result.
- The tell
- The brief reports that no attack occurred and attributes it to the phase.
- The correction
- Report cost imposition, which is observable: decoy interactions, reconnaissance that terminated in instrumented terrain, re-tooling forced. The absence of an attack is not evidence and should never be written as though it were.
Caveats That Hold Across Every Phase
- A phase is declared against a scope, not against an agency. An estate can be in Dominate on one mission service and Shape on everything else. The phase declaration control is written to carry a scope for exactly this reason, and a declaration without one is a statement nobody can act on.
- Phases are not maturity. Being in Phase III is not progress. It means an adversary is on or adjacent to key terrain. A program that reads the phase list as a ladder will start reporting phase advancement as achievement, which inverts the meaning of the entire model.
- Regression must be declarable without embarrassment. Campaigns go backwards. An eviction that turns out to be incomplete returns the campaign to Dominate from Stabilize. If declaring that costs someone their credibility, it will not be declared, and the campaign will be fought in the wrong phase.