Stopping the tank -RST Cloud-pic1

Stopping the tank: centre of gravity analysis for cyber threat prioritisation

Oct 13, 2026

Why the most powerful system is rarely the one everything depends on, and a three-question method for finding the one that is.

Yury Sergeev and Alex Gould – Based on our talk at the Australian Cyber Conference (CyberCon) Melbourne 2026. 

You have probably sat in this meeting. The budget is finite, every system owner is asked what matters most, and every one of them gives the same answer: my area cannot go down. They are all telling the truth. From where each of them sits, their system is critical. 

So the decision gets made on something else. Who has been there longest, who argues hardest, what broke most recently. The order that comes out is one nobody can defend six months later, when the incident lands somewhere nobody argued for. 

What is missing is not conviction. It is a method for choosing between competing true claims without falling back on rank. Military doctrine has one, and it is easiest to see on a tank. 

Start with a tank

Ask how to stop a main battle tank and the instinct is to go after the armour and the gun: what everyone sees, and the hardest thing in the whole problem to attack. 

But a tank is a mobile weapons platform. Take away its mobility and you have a very expensive pillbox that the other side can simply drive around. Mobility is the critical function. Not the most powerful attribute, but the one every other function depends on. 

Mobility needs fuel, and fuel does not sit behind the armour. It arrives on a truck. Destroy one vehicle’s fuel and you stop one vehicle. Go after the supply chain that fuels all of them and you stop the fleet without engaging a tank at all. 

This has happened. At Alam Halfa, Egypt, in 1942, the British made Rommel’s fuel tankers the first priority for air attack and the offensive against his shipping was guided by Ultra, their codebreaking intelligence. In the second half of August that offensive destroyed 41 per cent of the fuel sent to him. Harry Hinsley, the official historian of British wartime intelligence, put it plainly: the British did not defeat Rommel in the field at Alam Halfa. He was forced to abandon the battle on 2 September. Alexander’s own despatch also points to his minefields, but Hinsley ties the decision to abandon the battle to the losses at sea. 

What made it possible was intelligence: knowing which ships carried the fuel, and when. 

Three questions 

The method comes down to three questions. What must this thing be able to do? What does that function require, with no substitute? And where is that requirement exposed, and does denying it scale? For the tank the answers are mobility, fuel, and an unarmoured supply chain shared across the fleet. 

The three questions, worked through on the tank.
The three questions, worked through on the tank.

Doctrine calls these the critical capability, critical requirement and critical vulnerability, and the tank itself the centre of gravity. The direction matters. You do not attack the capability directly. You go down the chain to the vulnerability, deny the requirement, and the capability falls away with it. 

The discipline is in question one. Most people answer with an asset, because assets are what we inventory and budget for. If your answer is a system name, you have not answered yet. 

Alex once ran this as an exercise with his team during covid, shortly after empty supermarket shelves showed how quickly things turn. The question was what would stop Australia functioning. The first answers were farmers, water and power. Reasonable, and wrong in an instructive way: Australian production is spread across a continent and thousands of independent operators. Keep going and you reach the part that is not resilient, which is distribution. Ports, rail, road freight, cold chain and the fuel that moves all of it. The powerful thing was not the critical one. 

Run it on yourself: Marks and Spencer

Marks and Spencer’s chairman, Archie Norman, told a UK Parliament committee in July 2025 that the company had trebled the number of people working on cyber security, to 80, and doubled the spend. This was not a company ignoring security. 

Run the three questions. What must it keep doing? Trade. Online orders were paused from 25 April to 10 June 2025, and Norman put the cost at about £10 million in profit for every week it was not trading online. What does that depend on, with no substitute? Knowing who is really asking for access, across staff, contractors and third parties. Where was that exposed? People. In his words, the initial entry came through social engineering, it was “sophisticated impersonation”, and part of the point of entry involved a third party. 

The armour was real. It was not where the attack came in. His own advice was to map how your systems connect and who can reach them: “it is not the fancy stuff”. 

The same three questions, run on a defender and on an adversary.
The same three questions, run on a defender and on an adversary.

Run it on the adversary: LockBit 

The same questions work pointed the other way. LockBit, which the UK’s National Crime Agency called the world’s most harmful cyber crime group, ran as a service: affiliates carried out the attacks and LockBit took a cut. What must it keep doing? Recruit affiliates; the NCA identified 194 using its services. What does that require, with no substitute? Trust. Affiliates must believe the platform will keep them anonymous and pay them. 

In February 2024, Operation Cronos, led by the NCA, took control of LockBit’s systems and used its own leak site to post information exposing LockBit, including that it did not routinely delete stolen data after victims paid. The NCA’s director general said they had damaged “the capability and most notably, the credibility of a group that depended on secrecy and anonymity”. Australia’s Signals Directorate and Federal Police worked with international partners on it; LockBit had 119 reported Australian victims. 

By May 2024, active affiliates were down to 69 and monthly LockBit attacks in the UK were down 73 per cent. Be honest about the ending, though: LockBit came back. Check Point counted 163 LockBit victims in the first quarter of 2026, fourth place globally. Servers can be rebuilt in days. Trust takes much longer. 

Assume they are doing this to you 

There is a less comfortable implication. A capable adversary is running the same three questions on you. They are not working out how to breach your most defended system. They are looking for the function you cannot operate without, and the cheapest place it is exposed. 

The axios compromise is a clean example. axios is, in Google’s words, “the most popular JavaScript library used to simplify HTTP requests”, with over 100 million downloads a week. About two weeks before 31 March 2026, its lead maintainer was hit by a targeted social engineering campaign that left a remote access trojan on his computer and gave the attackers his npm credentials. They published two new versions with one added fake dependency whose install script quietly dropped a remote access tool on Windows, macOS or Linux. The axios code itself was untouched. It was live for about three hours. Google and Microsoft both attribute the activity to North Korea. 

Our own drawing. The block labels are jokes; the figures are not.
Our own drawing. The block labels are jokes; the figures are not.

The reporting does not say how the attackers chose axios. But they did not go after the organisations using it one at a time. They went for the block underneath all of them. The maintainer’s own post-mortem said it: “Publishing directly from a personal account was a risk that could have been avoided.” 

A real hospital

Ask a room what a hospital must be able to do, and then what it depends on, and most people name the electronic patient record: biggest system, biggest budget. In June 2024 the attack in south east London landed somewhere else, on Synnovis, the pathology provider for major hospitals and GP practices across the area. 

Pathology fell back to paper, but in the first week it ran at about 10 per cent of normal capacity. Hospitals could not match blood as often as usual, and NHS Blood and Transplant appealed for O type donors. By late September, NHS England’s figures showed 10,152 acute outpatient appointments and 1,710 elective procedures postponed. King’s College Hospital later said a patient died unexpectedly during the attack, and that the contributing factors included a long wait for a blood test result. 

South east London, June 2024.
South east London, June 2024.

The critical requirement was not the biggest system. It was trustworthy results, on time, and it sat with a supplier. 

Three ways this goes wrong 

Stopping at the powerful answer. Colonial Pipeline’s CEO told the US Senate in 2021 that Mandiant had not confirmed any evidence the attackers reached the pipeline’s control systems. The pipeline stopped anyway. The way in was a legacy VPN account with only single-factor authentication. 

Seeing the risk and stopping there. The British Library’s own review says multi-factor authentication was left off a server “for reasons of practicality, cost and impact on ongoing Library programmes”. The risk had been raised. The consequences, in its words, were “perhaps under-appraised”. 

Running it once and filing it. UnitedHealth’s policy was multi-factor authentication on externally facing systems. UnitedHealth told the US Senate in May 2024 that Change Healthcare had joined the group a little over a year and a half earlier, and its CEO told a House subcommittee the same day that a Citrix portal inside it “did not have multi-factor authentication”. The dependency map changed when the company was bought, and the analysis did not change with it. 

Three failure modes, each with a real case.
Three failure modes, each with a real case.

A fair challenge is that this is critical asset identification with new words. There is real overlap; NIST’s criticality analysis model also ranks systems by their importance to an organisation’s goals. What the method adds is a stopping rule: keep going until you reach something with no substitute, and treat the first confident answer as the start, not the result. 

Take a decision, not a funding request 

Put the two analyses side by side: where the money and effort currently go, and what your own analysis and the adversary’s both point at. The distance between them is the finding. It is not a measurement, and you should be sceptical of anyone who puts a number on it. It is a clearly stated position someone can examine and disagree with. 

Take it upstairs as a decision with two options, not as another funding request: here is the function we cannot stop performing, here is where we spend, here is the gap. We can close it, or we can accept it. Accepting a gap deliberately, with a name against it, is a legitimate executive call. Accepting it by never surfacing it is not. 

Where to start 

You do not need a programme of work or anyone’s permission. Name one function: one thing your organisation cannot stop doing, written as a sentence a non-technical person would recognise. That sentence is harder to write than it sounds, and it is most of the work. 

Then run the three questions with the people who own the systems. Give it an hour, and when the group lands on its confident first answer, go one more round. Finally, take the gap to someone who can decide: the distance, and the two options. One function is enough to find out whether this is useful in your environment. 

It was not the armour, it was the fuel. It was not the farmers, it was distribution. And in the hospital it was not the biggest system, it was wherever the fallback ran out first. Prioritise the function, not the asset. 

Reading each of these incidents through centre of gravity analysis is our own analysis, not a finding of the sources cited. 

Sources