Why Maneuver Calculus exists

Useful measures can lose their referent

An alert count measures alerts. A vulnerability count measures recorded vulnerabilities. A control completion rate measures completion against an assessment. Each can be useful for the question it was designed to answer. Difficulty begins when it becomes a stand-in for a different question: whether a particular harmful behavior remains possible, whether a defender could observe it, or whether an intervention would change its outcome.

Proxy measures are necessary when the underlying reality is difficult to observe. They become misleading when their assumptions disappear. A low count can reflect effective defense, sparse collection or a narrow scope. A completed control can coexist with a behavior the control never addressed. The measure needs a traceable relationship to the world it is supposed to describe.

Security disciplines see different parts of the same world

A SOC works with events and alerts. Vulnerability management works with affected assets and remediation. Threat intelligence works with reports and attributed behavior. Detection engineering works with observable patterns and rules. Governance, risk and compliance work with obligations, evidence and controls. Security validation asks what happens under a test.

These abstractions serve different tasks; their differences are often appropriate. Yet a decision may cross all of them. A reported procedure depends on an environmental condition, produces an observable effect, interacts with a control and changes a risk judgment. If each discipline describes that relationship differently, the handoff relies on an analyst reconstructing the missing connections.

A common identifier can connect records. It cannot by itself make their meanings compatible. Two records referring to the same technique may describe different conditions, different populations, different time intervals or different evidence strengths.

More data does not settle meaning

Reconciliation can reduce duplicates, improve custody and help people locate evidence. Those are valuable capabilities. It still leaves the question of what follows from the evidence. A report may describe a capability without showing it occurred here. A test may demonstrate an effect under one configuration without showing it transfers. A missing observation may expose an evidence gap rather than an absent event.

Collapsing those distinctions into one score makes the result easy to compare and difficult to challenge. The alternative is to carry the conditions with the claim: who could observe it, when it applies, what source supports it, what was inferred and which assumptions would change the conclusion.

The proposed foundation is behavioral

MC starts from a bounded description of behavior: the conditions it requires, the mechanism that changes the world and the result it produces. Defensive reasoning can then ask which condition or mechanism an intervention affects, which result it addresses, and whether the defender can actually make that change.

A shared model should allow different views for different work while preserving those relationships. An analyst needs a readable explanation; a validator needs explicit constraints; a researcher needs the counterexample that could overturn a definition. None should have to accept a polished summary at the expense of the underlying qualifications.

This is a research direction, not a claim that a universal security model has been completed. The current implementation has a bounded path and documented failures. Its wider architecture includes responsibilities that have not been established as implemented or validated.

Disagreement should improve the object being measured

If two analyses disagree, the model should help locate the disagreement. Is the source disputed? Is a condition actually required? Does the observation apply to this context? Does the defense address the shared mechanism or only one variation? The answer should permit a targeted test or a scoped revision.

A counterexample is useful when it changes what the model claims. Failed experiments and withdrawn results should remain visible in the research history, with their consequences stated. The earlier Results pages were withdrawn for flawed methodology; they cannot be made credible by a new presentation.

Empirical disagreement is therefore a mechanism for improving the foundation. It places limits on definitions and implementations rather than asking evidence to conform to them.

A shared foundation needs durable openness

If a common model becomes useful across disciplines, teams need to inspect, implement, question and fork it. Dependence on one author or vendor would make that foundation harder to test and less durable.

The intended direction is open specifications, practical conformance tools, free use and implementation, and governance able to outlast its original author. Commercial products, services and economic development can build on that shared foundation. The project principles place worldwide benefit and vendor independence alongside that participation. Artifact-specific licenses and future governance instruments must make the intended rights concrete.

• See the argument made concrete in a case
• Inspect questions and evidence
• Read how stewardship is intended to mature

Project thesis: 6 October 2026; openness wording reviewed 19 October. This argument states the motivation and proposed direction of MC; it does not report an empirical finding that other security approaches are ineffective.