The Defender's Dilemma

In 1779, a Scottish-born American captain sailed a converted French merchantman into British home waters and set fire to the idea that England’s coast was safe. John Paul Jones did not have a navy in any meaningful sense. The Royal Navy on the other hand had hundreds of ships of the line. The Continentals had a handful of frigates, the borrowed goodwill of the French, and so small amount of courage (read. stupidity). Open battle was suicide. So Jones did the only thing that arithmetic allowed: he raided. He hit Whitehaven, burned colliers in their berths, snatched HMS Drake off the Irish coast, and eventually lashed the Bonhomme Richard to HMS Serapis off Flamborough Head and refused to sink politely. The ship went down and he kept the Serapis. This battle is the origin of Jones’ famous quote “I have not yet begun to fight.”

The strategic logic looks insane until you notice it isn’t really about ships. Jones was exploiting a structural property of the situation: Britain had to defend a coastline, and he only had to find one undefended cove. The Royal Navy could not be everywhere. Insurance rates spiked. Coastal towns demanded protection. The cost of a single American raid was a few hundred pounds of powder and a willing crew. The cost of preventing the next one was a permanent redistribution of the world’s largest navy. He was not winning a war. He was inflating the price of the war Britain was already fighting.

Those comfortable with abstraction will notice this tune rhymes with a cybersecurity engagement. The blue team must protect every endpoint, every dependency, every misconfigured S3 bucket, every social engineering vector against every employee on every Tuesday at 4pm when they’re tired. The red team just needs to find one. Bruce Schneier’s compressed version is that attackers only have to be right once and defenders have to be right every time, which is true and useful and also, I think, slightly underselling what’s going on. The asymmetry is not a feature of cybersecurity. Cybersecurity is a venue where the asymmetry happens to be unusually legible.

The same shape shows up in immunology, where a pathogen needs one open mucosal surface and the immune system needs to surveil every cell. It shows up in sports, where the keeper covers a goal and the striker picks a corner. It shows up in counterterrorism, content moderation, fraud detection, software testing, marketing, and drug discovery. It shows up anywhere there is a space to be defended and an adversary, intelligent or otherwise, looking for a way through. The fact that it shows up in such radically different surfaces is the interesting part. It suggests the asymmetry is not a property of any of those domains. It is a property of something underneath them.

Combinatorics has a name for the underlying object, or rather two names, because the object has two faces. The defender is solving a set cover problem. Given a universe of elements (attack vectors, vulnerabilities, possible failures), choose a collection of defenses that together cover every element. The attacker is solving a hitting set problem. Find one element that no defense covers. These are formal duals of each other. They are the same problem viewed from opposite sides.

This duality is not metaphor. Set cover and hitting set are related by a well-known duality in combinatorial optimization, linked through the LP relaxation and visible in the structure of the problems themselves. Strengthen one side and you have, in a precise sense, constrained the other.

What the duality tells us is that the asymmetry between attacker and defender is not an accident of resource imbalance, where one side has more guns or more money. It is structural to the problem itself. Even with infinite budget, the defender’s task is harder, because the defender’s task is quantified differently.

This is the move that opens up the geometry. Defender wins if for all attack vectors, a defense exists. Attacker wins if there exists an attack vector such that no defense exists. Universal versus existential; ∀ versus ∃. These are not symmetric quantifiers. The cost of verifying ∀ scales with the size of the domain. The cost of verifying ∃ is constant in the best case and bounded in the worst. A single counterexample falsifies a universal claim. No finite collection of confirming examples ever fully establishes one.

This is also why Popper’s falsifiability criterion has the asymmetry baked in. A scientific theory is universal: for all observations of this kind, the prediction holds. To support it, you can run a million experiments and never be done. To refute it, you need one. The structural advantage of the refuter is identical to the structural advantage of the attacker: they live on the existential side of the quantifier.

It seems almost like a geometric primitive. The temptation at this point is to say: conjunction is fragile, disjunction is robust. That’s close enough to be memorable but wrong enough to be misleading. A disjunction of useless options is not robust. An OR over attack vectors that are all defended, all expensive, and all known is worth nothing to the attacker. The logical operator by itself is not the primitive.

The real primitive is one level up. It’s about where choice lives and what choice costs on each side.

The defender’s success condition is an AND across the attack surface. Vector 1 must be defended AND vector 2 AND every vector you haven’t thought of yet. The attacker’s success condition is an OR. Vector 1 succeeds OR vector 2 OR the one nobody patched. But the decisive fact isn’t the shape of the operators. It’s that the attacker chooses where in the disjunction to spend effort, and the defender must spend effort everywhere in the conjunction. Concentration of effort under the ∃, distribution of effort under the ∀. That is the asymmetry. The operators are the framing; the cost structure is something like the “engine”.

You can see why by trying to invert it. Could you build a system where the defender wins on a disjunction? Sure…but that’s just offense. American privateers during the Revolution were defenders of American commercial interests, and they only needed one capture per cruise to make the ledger work. The privateer was on the existential side. Britain’s merchant marine was on the universal side, needing every convoy to arrive. The roles invert because the quantifier structure of the goal inverts, and the side with the ∃ gets to concentrate its effort. It is the locus of choice, not the uniform, that determines the asymmetry.

This is why “attacker versus defender” can mislead. What matters is whether your win condition lets you pick your battle or forces you to win all of them. A startup pitching investors gets to pick: they need one yes from a long list, and any single rejection is survivable. The investor evaluating a portfolio doesn’t pick on fraud (every company must not blow up) but does pick on returns (one unicorn is enough). A drug discovery program picks at screening (one promising compound out of ten thousand) and doesn’t pick at trials (every safety endpoint must hold).

The geometry doesn’t care what kind of game you’re playing. It cares who gets to choose and who has to cover.

There’s a second property worth noticing. Imagine the defended thing as a volume in some abstract space the defender must enclose/protect. The cost of enclosure scales with the surface area of the boundary, because every square inch of surface is a place a puncture could happen. The cost of the puncture is roughly constant: one good attempt at one weak spot.

This means the ratio of defense cost to attack cost degrades as the volume of what you’re defending grows. A bigger company has a bigger attack surface. A bigger codebase has more lines that could contain the next CVE. A larger empire has more frontier. A more capable AI system has more behaviors to align. The asymmetry isn’t fixed. It widens with scale, because the surface of an n-dimensional volume grows faster than its interior in many natural geometries, and even in the ones where it doesn’t, the absolute surface still grows.

This is why centralization tends to be brittle in adversarial environments and why distributed systems can be more resilient even when individual nodes are weaker. A single fortress concentrates value behind a single boundary, and the boundary’s surface area is the perimeter of the fortress. A distributed network spreads the value across many boundaries, but no single puncture is catastrophic. The defender’s AND-chain becomes shorter per node, even if there are more nodes overall. You’re trading conjunction-depth for disjunction-redundancy.

This is also, incidentally, why the Royal Navy had such a hard time with Jones and his successors. The British Empire had become a volume; the sun never set on its commercial and naval interests. Its surface area was the entire coastline of every territory it touched. American privateers and the French navy did not have to defeat that surface. They had to find a weak point on it. The number of weak points grew with the empire. The cost of patching them grew faster than the empire itself.

Empires die from the surface inward. So do companies. So do codebases.

Before going further it’s worth separating two things that have been running together. The attacker pays two different kinds of cost, and defenders who blur them end up defending the wrong thing.

The first is search cost: finding a vector the defender hasn’t covered. This is Jones’s problem. He had to locate an undefended stretch of coast, a harbor without guns, a convoy without escort. Most of his effort was navigation and reconnaissance, not direct combat. For the red team in cybersecurity, it’s scanning, fingerprinting, enumerating, reading source code. For the pathogen, it’s random contact with mucosal surfaces until one takes. Search cost is about the geometry of the attack surface: the bigger the surface, the cheaper the search.

The second is execution cost: getting through once you’ve found the vector. This is the pathogen’s problem after landing on a mucosa: past the mucus, past the innate response, past the macrophages, into a cell. This is the exploit developer’s problem after finding the bug: writing shell code, bypassing ASLR, escalating privilege. Execution cost is about the depth of the defense, not the area of the surface. Defense in depth, zero trust, compartmentalization, rate limiting, canaries: these don’t shrink the surface (they often expand it), they deepen every point on it.

These cost axes are orthogonal. A system can have a small surface and shallow depth (a house with one door and no locks), a large surface and shallow depth (a corporate network with flat privilege), a small surface and deep depth (a bunker), or a large surface and deep depth (a mature adversarial system, biological or otherwise). The defender’s real strategic question is which axis is cheaper to extend. Most real defenders are over-indexed on surface reduction and under-indexed on depth.

Given all this, you might wonder exactly how in the hell defenders ever win anything. They do, frequently. The reason is that the abstract geometry is not the whole picture. Attackers carry their own AND-chain: they must find a vector, develop the exploit, execute without being caught, extract value the defender hasn’t planned around. Every stage is a conjunction. The defender’s real job is to make the attacker’s chain longer than the defender’s own, not to seal every hole. The cost of finding and exploiting any hole must exceed the value of doing so.

This shifts the game from “cover everything” to “raise the price.” It is the same move Jones was making, in reverse. He raised the price of British coastal security to a level Britain could not pay without redistributing its fleet. A good blue team raises the price of attack to a level no attacker will pay without state-level resources, then accepts that state-level attackers will get through and plans for detection and recovery instead of prevention.

The defender converts the asymmetry from “I must cover, you must hit” into “we both must conjoin many things, and mine are cheaper.” That is the entire content of defense in depth, of zero trust, of compartmentalization, of canary tokens and honeypots and rate limiting and every other idea in the security canon. None of them eliminate the underlying asymmetry. They just lengthen the attacker’s chain until it costs more than the defender’s.

This is the same logic behind biological immunity. Skin is a covering, but skin is not the whole defense. Beneath skin is mucus, beneath mucus is innate immunity, beneath innate immunity is adaptive immunity, beneath adaptive immunity is inflammation and fever and a hundred other things. The pathogen that gets through skin still has nine more conjunctions to satisfy before it can replicate freely. The immune system loses the cover-everything game and wins the lengthen-the-attacker’s-chain game.

Once you see the duality, you start seeing it everywhere, and the uncomfortable part is that you are not standing outside it.

You are Jones and you are the Royal Navy, hundreds of times a day, usually on the losing side. Every headline is a disjunction optimized against your attention: the publisher needs one story to hook you, you need every story to not waste your time. Every ad is a puncture looking for a gap in your skepticism. Every recommendation algorithm is running a hitting-set problem against your preferences, needing one video out of a thousand to keep you on the platform. Every product you buy has been A/B tested against a universal quantifier you were implicitly carrying: all my objections satisfied, all my needs met. The seller only had to clear one of them well enough.

The scale of this is what makes it hard to feel. A single ad is trivial. The ambient pressure of a civilization’s worth of adversarial disjunctions, pointed at the conjunction of your attention and judgment, is not. You are the defender of a coastline you did not choose to own. The surface area is your waking hours.

The same geometry shows up in the things you try to build. An unhackable system is a fence around an infinite plane. A market position defended on every axis is a coastline waiting for one good captain. An AI system aligned against every possible misbehavior is a covering problem of the worst kind, because the space of behaviors is enormous and the attacker only needs one. The interesting techniques never cover. They lengthen the chain: interpretability plus behavioral evals plus deployment constraints plus monitoring plus circuit breakers, none of them sufficient, all of them raising the price.

The only real defense, at any scale, is to notice which side of the quantifier you are standing on, and either move or accept the price.

What John Paul Jones understood is that the asymmetry between attacker and defender is not a problem to be solved. It is a structural feature of every adversarial situation, and it is running on you right now, through this essay, through the next notification, through the coastline of every decision you are trying to defend. You cannot choose to abolish it. You can sometimes choose which side of it you stand on. Usually you can’t. A hospital cannot decide that patient confidentiality is a disjunction. A parent cannot decide that their child’s safety is an existential quantifier with one hit needed. For most defenders, most of the time, the quantifier is given. The only real move is to make the attacker’s chain longer than yours.

The American Revolution was won, in a real sense, by a strategic class that intuited this from the other side. They could not defeat Britain. They could make Britain pay more for the war than what it was worth. They placed themselves on the existential side of every quantifier they could find: one decisive battle was enough, one foreign ally was enough, one good privateer cruise was enough, one captain willing to attack British home waters with a converted merchantman was enough. Britain, on the universal side, had to suppress every rebellion in every colony with every available regiment, and could not. Britain’s defender’s chain was shorter than the Americans’ attacker’s chain. The geometry did the rest.

The lesson isn’t “find the disjunction.” That’s available to Jones and to the startup but not to the hospital or the parent. The lesson is that coverage is the wrong goal, and depth is the right one. Raise the price. Make the attacker conjoin more than you do. Make their chain longer than your own.

That’s the whole game.