Doctrine · The stance

Kamae構え

The Fourfold Stance

The eight virtues say who the practitioner is. Kamae says how they engage: four disciplines held at once, with the practitioner at the centre.

Perceive. Analyse. Protect. Remain aware.

The practitioner · 侍

At the centre: judgement, responsibility, decision. The seal is the eight virtues; the practitioner is who holds them.

The disciplines are not the doctrine. The practitioner is.

Where Kamae sits

The eight virtues: who the practitioner is
Kamae: how the practitioner engages
Controls and evidence: what the practitioner produces and relies on

The four disciplines

01 / 04 · PERCEIVE

Metsuke目付

The gaze

The question

What else must I see to understand this?

Metsuke directs attention beyond the immediate object: the relationships, dependencies and context around an event. It keeps seeing an event from being mistaken for understanding the situation.

Do not fix your gaze on the alert. Understand the field around it.

Core areas

Context and business impact
Relationships and dependencies
Attack surface
Identity relationships
Threat context
Adjacent activity

NIST CSF 2.0 reading

32 practices exercise this discipline

02 / 04 · ANALYSE

Katana刀

The blade

The question

What actually happened?

Katana is the ability to establish what happened. It turns observation into knowledge and knowledge into evidence. An investigation without evidence is only a story.

A detection without understanding is only an alert.

Core areas

Detection and telemetry
Investigation and correlation
Evidence collection and preservation
Incident reconstruction
Validation of claims and controls

NIST CSF 2.0 reading

36 practices exercise this discipline

03 / 04 · PROTECT

Tate盾

The shield

The question

What protects the realm?

Tate is the defensive posture: the controls that prevent, contain and recover. A shield that only resists is half a shield; it must also limit the damage when something gets through.

Resist compromise, and limit its consequences when prevention fails.

Core areas

Hardening and segmentation
Identity and access protection
Encryption
Containment
Resilience and recovery
Incident-response readiness

NIST CSF 2.0 reading

47 practices exercise this discipline

04 / 04 · REMAIN AWARE

Zanshin残心

The remaining mind

The question

What is happening now, and what may happen next?

Zanshin is awareness that continues after the action. The practitioner does not leave the field when the ticket closes: they watch for secondary activity, recurrence and changed conditions, and carry the lesson forward.

The engagement is not over because the alert is closed.

Core areas

Continued monitoring
Secondary and recurring activity
Post-incident observation
Changing conditions and drift
Lessons carried forward

NIST CSF 2.0 reading

45 practices exercise this discipline

The loop

The disciplines are complementary, not a sequence to finish. A practitioner moves between them continuously:

MetsukeSee an unusual relationship or anomaly.
KatanaInvestigate and establish what happened.
TateContain exposure and protect the environment.
ZanshinKeep watching for secondary or recurring activity.

Then reassess the wider field. The loop does not close.

Sources

Miyamoto Musashi, Gorin no Sho (The Book of Five Rings), Water scroll — on the gaze: perception (kan 観) strong, sight (ken 見) weak.
Zanshin 残心: in kendo, a strike without continued awareness after it does not score.
NIST Cybersecurity Framework 2.0 (2024) — category identifiers only.

The practitioner sees beyond the immediate, understands what happened, protects what matters, and remains ready for what comes next.