Stopping the tank: Centre of gravity analysis for cyber threat prioritisation

Every security practitioner has sat in a resource prioritisation meeting where the decision went to whoever argued loudest. Every CTI lead has watched investment go to the most visible risk rather than the most consequential one. The gap between where an organisation spends and where its real exposure sits is one of the most persistent problems in security, and most frameworks do not give practitioners the analytical tools to surface it in a way that holds up in a room full of competing stakeholders.

Centre of gravity analysis does. Developed in military doctrine and applied directly in developing a cyber threat intelligence framework for operational technology within the Australian defence sector, it is a structured methodology for identifying the critical dependency that, if disrupted, causes a system to collapse without having to attack its hardest point directly. The concept is straightforward in principle: to stop a tank, you do not need to destroy the tank. You need to cut its fuel supply. The tank becomes combat ineffective at a fraction of the cost. The centre of gravity is not the hardest point to attack or defend. It is the critical dependency everything else relies on, and it is rarely the thing people assume it is.

Applied to cyber security resource prioritisation, the question becomes: what is the one dependency in our environment that, if disrupted, causes everything else to fail? Not what is most visible, not what the loudest stakeholder claims is essential, but what the entire operation actually rests on. Once you can answer that, the prioritisation decision becomes defensible. Spending on anything else first is not just inefficient, it is the wrong call.

The methodology does not work in isolation for one side. You apply it simultaneously to your own organisation and to the adversary. Your centre of gravity tells you where to invest. The adversary's centre of gravity tells you what they are actually trying to break. Running both together surfaces the gap between where you are currently spending and where your real exposure sits, in a way that competing stakeholder claims and internal politics rarely surface on their own.

This session walks through the methodology and works through real prioritisation scenarios drawn from government, critical infrastructure, and enterprise environments, giving security leaders who need to make the call, and practitioners who need to give them the argument to do it, something they can take into the next resource prioritisation conversation and actually use.