Defensive Choke Points — standing analysis
_Discovery Engine (Phase 3) · miner: graph-centrality · seed 1729 · source DB git_commit 92a83fc · generated from analysis/output/graph.json._
Candidates, not discoveries. Centrality on this attack→resource graph flags high-degree nodes; whether any has leverage beyond its degree/enrichment is a harness question. The headline "M1018/M1026/M1037 are cross-category choke points" was REFUTED (see §4) — read it.
Graph: 2,622 nodes (633 attack, 1,289 detection, 249 mitigation, 45 technique, 406 test), 5,483 edges. Directed betweenness is degenerate (resources are sinks), so centrality is computed on the undirected simple projection.
1. Mitigation coverage — ATT&CK M-IDs (attacks covered, category breadth)
| mitigation | attacks | breadth | betweenness |
|---|---|---|---|
| M1018 User Account Management | 46 | 6 | 0.057 |
| M1037 Filter Network Traffic | 44 | 6 | 0.023 |
| M1026 Privileged Account Management | 42 | 6 | 0.061 |
| M1017 User Training | 41 | 8 | 0.028 |
| M1047 Audit | 38 | 7 | 0.015 |
| M1042 Disable/Remove Feature | 29 | 6 | 0.023 |
2. Mitigation coverage — D3FEND classes
D3-NTF (63 attacks, breadth 8), D3-APCA / D3-CSPP / D3-NTCD (56 each, breadth 8). Caveat: the high D3FEND coverage partly reflects D3FEND's coarse artifact-to-technique mapping; an octet of D3FEND classes share identical scores, a mapping artifact rather than real leverage.
3. Betweenness leaders & technique hubs
Top attack-node bridges: lateral-movement-via-remote-services (0.065), lsass-memory-dumping (0.054), external-remote-services-edge-device-exploitation (0.050), unsecured-credentials (0.048). Top mitigation bridges: M1026 (0.061), M1018 (0.057).
Technique hubs (sub-technique parents covering the most children): dos-ddos (13 children), then phishing, whaling, adversary-in-the-middle-aitm-mitm, edr-killers-disable-security-tools (6 each).
4. Harness verdict on the choke-point claim — REFUTED
The intuitive finding "M1018/M1037/M1026 are disproportionate cross-category choke points" does not survive:
- Breadth is BELOW random. The ATT&CK-mitigation-enriched pool spans only 8/10 categories (crypto-hardware and ai-ml carry zero ATT&CK mitigation edges). A random same-size subset spans a mean of 7.6 categories; the triple's observed breadth of 6 is below random (P(null≥obs)=1.000). They are category-concentrated (identity + cloud + network), not cross-category.
- No leverage beyond degree. Under a degree-preserving configuration-model null (bipartite double-edge swaps), observed betweenness is at or below the null (M1018 0.100 vs 0.158, P=1.0; M1026 P=1.0; M1037 P=0.70) — the pre-registered falsification condition.
- Suboptimal even among ATT&CK mitigations. Greedy and brute-force set-cover pick M1018+M1037+M1017 (union 108, breadth 8), dominating the proposed triple (union 105, breadth 6) on its own diversity criterion.
Standing lesson for future runs: any centrality-based mitigation prioritization on this DB must control for degree AND enrichment coverage before asserting cross-category leverage. The only survivor is the trivial, non-novel restatement: these are three high-degree ATT&CK mitigations, and the D3FEND octet should be discarded as a coarse-mapping artifact.
Caveats (standing)
- Coverage is bounded by enrichment: an attack with no mitigation/detection edge cannot raise any node's centrality — 410/633 attacks carry no mitigation relation at all.
- CISA's top-10 pairs account-management controls with M1017 (User Training), not M1037; this DB's ranking diverges because the enriched pool is network-infrastructure-heavy — a selection effect, not a discovered truth.