Cover art by MJ Gonzales, Book Design by Alan Hebel.

Inside the Book

Break the Chain follows the arc of a good response. It names the problem, designs the answer, shows you how to build it, and tells you where to start.

Read the Foreword
Page 1 of 2
Foreword: The Blueprint for a Planned Disaster, by Chadwick Smith — page ix

Tap the page to enlarge · Swipe or use the arrows to turn pages

I The four Parts · 1 of 4

Part 1 · The Crisis

“The words come first. Everything you build later depends on getting them right.”

Name the gap between fifteen-minute attacks and eleven-hour responses.

  • Build a shared vocabulary
  • Recognize ten patterns behind the gap
  • See why starting small now matters
Explore Part 1 · 6 entries

The Language of Survival

A shared vocabulary gives the team a common starting point.

  • Time-to-good-decision
  • Attack stages and cascade rings
  • The Trust Mesh

Chapter 0: The Clock Is Exponential

Four phases reveal how the threat changes through 2030 and beyond.

  • Targeted attacks to ambient breach
  • Three ways organizations fail
  • Three human truths

Chapter 1: The Rhythm Broke

A fifteen-minute attack breaks the defender’s familiar rhythm.

  • Attack complete at 9:15
  • First alert at 11:00
  • A toolkit for closing the gap

Chapter 2: The Rules Changed in Silence

Knowing your own network gives you an advantage the attacker must earn.

  • More resources aren’t enough
  • Response must come earlier

Chapter 3: The 10 Patterns That Explain the Gap

Ten patterns make exponential change useful for Monday’s decisions.

  • Why catching up fails
  • Where thresholds change outcomes
  • Why small, early bets matter

Chapter 4: The History of the Future

Twenty years of breaches reveal a widening gap between tools and culture.

  • Three generations of change
  • A fourth already emerging
Continue to Part 2

II The four Parts · 2 of 4

Part 2 · The Architecture

“Our digital fortresses are like sandcastles crumbling under the relentless tide of innovation.”

Replace static defenses with a continuously adapting Trust Mesh.

  • Four pillars of adaptive defense
  • How one compromise becomes many
  • From a reactive SOC to a Trust and Access Office
Explore Part 2 · 2 entries

Chapter 5: How One Becomes Many

A single compromise can cascade across sixteen systems before triage.

  • Attacker motive
  • Attack stages
  • Connected-system cascades

Chapter 6: What Adaptive Systems Actually Mean

Adaptive defense changes how systems work together.

  • Sensing
  • Sense-making
  • Decision intelligence
  • Learning, with deception as an early signal
Continue to Part 3

III The four Parts · 3 of 4

Part 3 · The Methodology

“You cannot solve an exponential problem with a linear process. You need a new machine, and this is how you build it.”

Build machine-speed defense within the constraints you actually have.

  • A three-phase approach and twelve-week roadmap
  • Map attack paths and make the budget case
  • Create the smallest viable victory
Explore Part 3 · 4 entries

Chapter 7: Mapping Your Cascade Pathways

Map the attack paths toward your most critical assets using tools you already have.

  • Find cascade pathways
  • Identify intervention points
  • Establish a measurable baseline

Chapter 8: Making the Case—From Analysis to Budget

Turn technical analysis into a proposal leadership can fund.

  • The Cascade Scorecard
  • The math of early intervention
  • A worked example of the 5 Cs

Chapter 9: What Technology Can't Fix

Build around trust before buying another platform.

  • People, process and governance first
  • Technology and data follow
  • Start with one free decoy

Chapter 10: Why Culture Eats Technology

A working platform can still fail when the culture rejects it.

  • Diagnose the culture
  • A sixteen-week change method
  • Scripts for four hard conversations
  • The Chief Resilience Officer
Continue to Part 4

IV The four Parts · 4 of 4

Part 4 · The Roadmaps

“Great transformation needs a beginning.”

(Yung Pueblo)

Choose your role, find your first move, and begin.

  • Paths for practitioners and leaders
  • Prove value with small wins
  • Build evidence for larger change
Explore Part 4 · 3 entries

Chapter 11: Practical Monday Actions

Each role gets a day-by-day plan for its first week.

  • Practitioner actions
  • Technical-leader actions
  • Business-leader actions

Chapter 12: Practitioners: Start Small, Prove Value, Scale (6-Month Roadmap)

Turn daily ground truth into evidence that earns permission to scale.

  • A six-month roadmap
  • Small wins that prove value

Chapter 13: The Question That Decides Everything

The final question is whether to begin now or wait for a breach.

  • The coming autonomous adversary
  • The case for defending together
  • A return to 180 seconds
Explore the book

+ Keep at hand

Field references
& closing

Nine practical appendices and the people behind the book.

Appendices · Nine field references

These are field references for doing the work, written to be used alongside the chapters.

  • A: Complete Cascade Pathway Mapping Methodology. Find the chain of reasonable steps that adds up to a catastrophe, using a spreadsheet, before an AI finds it.
  • B: Deception Grid Implementation Guide. The cheapest control there is: a free decoy that catches an intruder before they reach anything that matters.
  • C: Board-Level Metrics Dashboard. Four questions and four numbers for directors who need to govern resilience without managing it.
  • D: CRO Role Definition & Hiring Guide. What the Chief Resilience Officer owns and how to hire one.
  • E: Golden Path Automation Playbook. Remove standing access, and you remove the fuel every cascade runs on.
  • F: TAO Organizational Model. How a security operations center becomes a Trust and Access Office.
  • G: TTGD Measurement Toolkit. How to measure time-to-good-decision, from today's baseline to the twelve-month target.
  • H: Grassroots Influence Playbook. No budget, title or mandate required. Start with one small win that's impossible to deny.
  • I: Agentic AI Threat Profile & Attacker Dossier. A profile of the adversary that found a seven-hop path through a hospital network that human testers had missed for three years.
Closing · Acknowledgements & backers

Acknowledgements

The people and ideas that made the book. Chris calls them a Trust Mesh of their own.

Kick Ass Kickstarter Backers

Collective defense starts with someone going first. These are the people who did.

Successfully funded on

Kickstarter

Backed by the community

View the campaign

Campaign ran to

Kickstarter campaign
126%funded!
Total book community
225+backers!
03

The book

A field manual for resilience

You can
out-decide
one

Cybersecurity. Response. Human judgment.

An AI-driven attack now runs from reconnaissance to impact at machine speed. Human response is still measured in hours, and the gap is widening.

Break the Chain is a field manual for the move that still works: inserting judgment where progression has become automatic. It reframes the job from cybersecurity to resilience—collapse Time-to-Good-Decision below the attacker’s time to finish.

You will not out-prevent an autonomous adversary.
You can out-decide one.

  • Where can a decision still interrupt the chain?
  • What makes containment possible in time?
  • How do people, systems, and shared architecture work together?
Chris Perkins standing with the RBA community

A doorway off the hallway · Room 01

There’s more
inside

Judgment, agency, and what we build into machines.

A small light. An open invitation.
A stippled mechanical figure holds a small yellow flower in its outstretched hand.
The InteriorUnexploredEnter
04

Praise for the book

Praise for
Break the Chain

05

The method

Before the next link

Three verbs turn a threat into a response: Sense, Decide, Contain. Each one has to arrive in time.

Time-to-Good-Decision connects the whole path: detecting a threat, deciding what to do, and executing the response. The goal is to shorten that path so action arrives before impact.

Recognize progression early

See the next link
while it can still be interrupted

Detection earns its value through what it makes possible next. The useful signal is the one that reaches a person or system with the context to act.

The question to take back to your team

How early can we see progression—and who receives that signal?

Some chains are aimed at you.
Others you inherited.
They break in the same place.

Break the Chain · Chris Perkins

06

The author

Cybersecurity architect · Writer

Chris
Perkins

Las Cruces, New Mexico

Chris Perkins beside the New Mexico state flag

Working where security, data, and human judgment meet.

Chris Perkins is a cybersecurity solutions architect and writer based in Las Cruces, New Mexico. His work spans security operations, data analytics, and the decisions that connect them.

Author of Kinetic Trust Protocol Co-founder and Chair of New Mexico Cyber Intelligence & Threat Response Alliance (NMCITRA)

Break the Chain brings those concerns to a practical question: how do we build the capacity to recognize a threat, make a good decision, and contain its effects before the damage spreads?

I’d like to hear about
Map
01 / 05Opening