Chakravyuh: What an Ancient Battle Formation Can Teach Us About Modern Cyber Defence

From the ancient battle fields to current state of cyber defence, the enduring lesson is that defending what matters most, requires more than building walls. It requires understanding the adversary, anticipating the next move and adapting continuously.

Imagine defending a kingdom where the enemy is constantly searching for weaknesses, testing your defences and looking for a path to its most valuable territory.

Now replace the kingdom with a modern enterprise, the enemy with a cyber adversary, and the battlefield with an interconnected digital environment spanning cloud infrastructure, identities, applications and data.

The challenge feels remarkably familiar.

The Chakravyuh, we all heard or read from the Mahabharata offers an intriguing parallel to Continuous Threat Exposure Management (CTEM), a modern approach to enterprise cybersecurity. They are not equivalent systems, but both illustrate a fundamental principle: effective defence is not a static wall. It is a coordinated, continuous, and an evolving principle built around understanding the adversary and protecting what matters most.

1. Beyond the perimeter: Defence in depth

The Chakravyuh is commonly depicted as a complex, circular military formation in which penetrating one layer does not guarantee success. The strategic point is knowing how to enter a system is not the same as understanding how to navigate it.

Modern enterprises also rely on multiple defensive layers - firewalls, endpoint protection, identity controls, cloud security and network monitoring. Yet today's attack surface extends far beyond the traditional network perimeter. Cloud workloads, SaaS applications, third-party integrations and machine identities create connections that attackers may exploit.

Finding an individual vulnerability is only the beginning. Security teams must understand how weaknesses connect and whether they could provide a route to critical systems or sensitive data.

CTEM helps bring these exposures into a unified, business-aligned programme rather than treating each security finding in isolation.

2. A changing battlefield demands continuous defence

Cyber environments change constantly. New vulnerabilities emerge, permissions shift, cloud configurations drift and attackers adapt their techniques. An assessment that accurately described an organisation's security posture last month may no longer reflect its exposure today.

This is why CTEM is not a tool but a continuous programme, to be built step by step, module by module.

CTEM framework comprises five repeating stages:

• Scoping: Define the assets and business risks that matter most.
• Discovery: Identify relevant assets, exposures, threats and attack paths.
• Prioritisation: Determine which exposures deserve attention based on exploitability, threat context and business impact.
• Validation: Test whether exposures are genuinely exploitable and whether security controls work as intended.
• Mobilisation: Turn findings into remediation actions, assign ownership and track outcomes.

The cycle repeats as the enterprise and threat landscape evolve.

The question changes from “What vulnerabilities did our last scan find?” to “What exposures matter now, how could they be exploited, and what must we do next?”

3. Understand the attack path, not just the weakness

Consider two scenarios.

One system has a critical rated vulnerability but is isolated from external access and protected by effective compensating controls. Another has a lower rated weakness on an internet facing asset that could provide a route to a privileged identity and a business-critical database.

A severity score alone may not reflect the relative risk.

This is where attack path analysis becomes important. It examines how an attacker might move from an entry point through connected systems towards valuable assets, potentially combining several weaknesses along the way.

CTEM encourages security teams to assess these relationships and validate whether suspected paths are genuinely exploitable. It also challenges the assumption that deployed controls are necessarily effective: a detection rule may be incomplete, or a configuration change may have created a blind spot.

The goal is to replace assumptions with evidence and focus attention on exposures that create credible routes to harm.

4. Protect the core, not every weakness equally

A military formation serves a strategic purpose: protecting what matters most. For an enterprise, that might mean customer data, financial systems, intellectual property, critical infrastructure or privileged identities.

Not every vulnerability presents the same business risk, and not every remediation task deserves equal urgency.

CTEM-informed prioritisation can consider asset criticality, exploitability, known threat activity, attack paths, existing controls and potential business impact.

Sometimes, addressing one weakness at a critical point in an attack path can disrupt several potential routes to an organisation's most valuable assets.

This approach also improves conversations with business leaders. Instead of reporting only the number of vulnerabilities closed, security teams can demonstrate which material exposures have been reduced, which attack paths have been disrupted and how risk is changing.

5. From assumed security to proven readiness

A defence should be judged by how it performs under pressure, not simply by how it looks on paper.

Security validation, breach and attack simulation, threat-informed defence, detection engineering, threat hunting, phishing and purple teaming help test whether controls can detect or prevent relevant adversary behaviours. The findings inform improvements to detections, remediation priorities and subsequent tests.

Automation and AI-enabled workflows can further help security teams correlate intelligence, prioritise exposures and accelerate remediation, with appropriate human oversight.

The result is a feedback loop: discover exposures, assess their significance, validate the defence, act on the findings and reassess.

No approach can anticipate every attack. But continuous validation can make defence more informed, measurable and responsive.

The modern Chakravyuh is a programme, not a wall

The Chakravyuh is not a historical blueprint for cybersecurity architecture, and CTEM is not its digital equivalent. Their connection lies in the strategic questions they raise.

Are we protecting the right assets? Do we understand how an adversary could move through our environment? Are our defences effective in practice? Can we adapt as conditions change?

For modern CISOs, answering these questions requires more than fragmented tools and periodic assessments. It requires continuous, evidence-based exposure management that connects visibility with context, validation with action, and security priorities with business risk.

Because in cybersecurity, the question is not simply whether the walls are standing.

It is whether the adversary has found a path through them and whether your organisation will recognise that path before it reaches the core.

The battlefield has changed. The strategic imperative has not: know your terrain, understand your adversary, protect what matters and keep adapting.

About the Author: Atanu Paul is the Business Director – India & SAARC at Gambit Cyber., driving business growth and strategic partnerships across the region. He focuses on advancing AI-native, risk-centric cybersecurity solutions that help organisations move towards proactive, threat-informed defence.

Disclaimer: The information provided on this blog is intended for general information purpose only and does not constitute legal, financial, medial, or other advice. By using the blog, you hold the author and Gambit Cyber B.V. harmless from all claims, damages, or expenses arising from the use.