The eight virtues

Let your code be true and your actions provable.

Domain: Non-repudiation and ethical conduct

Failure mode: Logs that can be edited by the people they incriminate.

Do not wait for the arrow. Go and find the archer.

Domain: Threat hunting and incident response

Failure mode: A SOC that only ever responds to alerts it configured itself.

Wield the power to restrict as a duty to protect.

Domain: Usable security and human-centred design

Failure mode: Controls so hostile that the workaround becomes the real process.

Grant only what duty demands. Surplus privilege invites disorder.

Domain: Least privilege and access control

Failure mode: Standing admin rights granted once and never reviewed.

Report what is, not what is comfortable.

Domain: Data integrity and truthful reporting

Failure mode: A dashboard tuned until it shows green.

Your auditor is not watching. Do it correctly anyway.

Domain: Accountability, governance, audit

Failure mode: Compliance theatre performed for the audit window.

Guard the clan you belong to, and be worth guarding.

Domain: Security culture and insider risk

Failure mode: Loyalty enforced by fear, which manufactures the insider it fears.

Every change deliberate. Every deployment reversible.

Domain: Change and configuration management

Failure mode: The Friday hotfix nobody wrote down.