The war changed shape. The discipline has to catch up.

The early decades of cyber conflict were a perimeter war. Discrete actors, discrete targets, discrete intrusions. Walls, gates, guards, alarm systems. Cybersecurity was correctly shaped for that war, because that war is the one that existed.

The war has moved on. What we face now is sustained, ambient, multi-vector, supply-chain deep. The front line is everywhere and nowhere. The adversary is not approaching the gate. The adversary is in the supply chain, in the dependency tree, in the maintainer's compromised laptop, in the build pipeline, in the firmware of the device that shipped six years ago. There is no siege to break. There is a permanent operating condition.

Cybersecurity is not obsolete. It is being asked to do a different job in a different war, and the shape of the work has to change to match. The doctrine that was right for the perimeter war is not wrong, it is incomplete for the war we are now in. The honest position is that nobody yet has the finished answer for what cybersecurity should look like inside a resilience-first model. But there are shapes worth examining.

Emergency response. Less garrison, more fire service. The model where capability sits prepared, trains constantly, deploys fast when something is actively burning, and stands down between events. The work is not preventing fires. The work is responding to the ones that happen, containing them, and getting the system back to operating condition. This treats incidents as the normal operating environment of the discipline, not as exceptional failures.

Special forces deployment. Less standing army, more precision capability. Small, highly trained teams deployed against specific hostile situations, with deep authority to act, deep context about the system they are defending, and the autonomy to make decisions at the speed the situation demands. Resilience cannot wait for a committee to approve a counter-move while the system is hemorrhaging. The work is targeted, context-rich, short-cycle, and decentralised.

Intelligence gathering. The most important shift, and the one most underdeveloped in current practice. Every incident, every probe, every near-miss is signal. In a resilience-first model, the value of cybersecurity is not measured by what it stops, because most of what matters cannot be stopped. The value is measured by what it learns, and how fast that learning becomes a property of the system. Cybersecurity becomes the sensor network and the analyst layer feeding the resilience machine. The adversary is no longer just a threat. The adversary is also the curriculum.

These three are models, not a finished doctrine. The real shape is probably a hybrid. Most modern military thinking has converged on hybrid postures because the battlespace itself is hybrid. Cyber will likely follow the same path. The question worth sitting with is not which of these is right. The question is what combination matches the war we are actually in, and how we redeploy the discipline of cybersecurity from a perimeter posture it has outgrown into a posture that fits the conditions on the ground.

We do not have the finished answer. Nobody does. But the question is the right one to be asking out loud, and asking it openly is the first move toward an answer that is honest about the war we are in rather than nostalgic for the one we left behind.