# The Tenth Man's guide to modern security architecture **Vishal Santharam,** Product Manager, Manageengine ![date](https://www.manageengine.com/ems/images/icon/calender-icon-1.svg) Jul 27, 2026 ![A shrinking security window representing the collapse of time between patch release and exploitation.](https://cdn.manageengine.com/sites/meweb/images/desktop-central/images/fish-banner.jpg) Listen to the article (AI powered narration) Every other day security vendors introduce another existential threat, positioning their solution as the answer to the next big risk. While each requires attention, very few deserve an architectural response. The hardest part of a CISO's job is deciding which does, and dedicating budgets and efforts accordingly. To do this, you need a sound mental model that helps you filter out real threats from noise. The Tenth Man rule fits this purpose. Originally an Israeli intelligence strategy, and known for its dramatization in *World War Z*, the doctrine states that if nine council members agree on a decision, the tenth member is obligated to assume the other nine are wrong. The Tenth Man is required to argue the contrarian case and start working on the worst-case assumption. Applied to the current context, the Tenth Man asks what happens if a risk, however unlikely it sounds, actually materialized. Although this sounds like a slippery slope that leads to a never ending loop of pessimism and fear, you can use it as a realistic tool by institutionalizing it with a formal process. To qualify whether a risk needs to be taken seriously, three things should be answered "no" at once: 1. Can you confidently dismiss the threat as technically implausible? 2. Can your org survive if you're wrong? 3. Can you build the defense after it starts? Let's apply this model practically to the latest risk that everyone's been talking about to see if it needs an architectural upgrade: AI in cyberattacks. ## Does AI qualify as a Tenth Man problem? Large language models (LLMs) have become great at understanding code. So great, that when a vendor releases a patch, models can identify what exactly was fixed and build a whole attack chain. And frontier models like Mythos are even better at it. Although reverse-engineering exploits from patch diffs is a decades-old technique, it used to take time. Today, AI has greatly accelerated this process. In one recent case, a security team took a public FreeBSD advisory (CVE-2026-4747) and used a commercially available model to produce a working remote root-shell exploit in roughly eight hours. Time-to-exploit (TTE) has shrunk from days to hours. Unfortunately, the efficiency of today's systems is heavily time-dependent, making them inefficient against AI-based exploits. To qualify whether this is a real risk or if it is simply a marketing fluff, let's apply the Tenth Man's rule: **Can you confidently dismiss the threat as technically implausible?** No, the mechanism exists today in early stages, and we're seeing real-life case studies. **Can your org survive if you're wrong?** No, a breach that moves faster than your ability to respond is catastrophic and often irreversible. **Can you build the defense after it starts?** No, the architecture that defends against it needs months to be put together. So, the next question is how do you build a security stack against AI-enabled exploits, whose TTE has been continuously shrinking. ## The Tenth Man rule to building an efficient security stack When applying the Tenth Man rule to security architecture, assume every layer will eventually fail and design the next layer on that assumption rather than trusting any single control to hold by itself. Most modern security stacks are already built based on this rule. You assume breaches will occur and build the next layer to catch what the previous layer missed. This is a solid foundation worth investing in whether TTE is at hours or days: Faster patching, Zero Trust access, micro-segmentation, and sharper run-time threat detection and response. These are no-regret moves that pay off against ransomware groups, insider mistakes, and ordinary opportunists you already face today. The real shift required to address AI-enabled threats is to acknowledge the shrinking TTE. You need to fight machine-speed attacks with machine-speed defense. That means giving machines the authority to act autonomously. But it's also the one step that introduces an entirely new class of risk. So start with the no-regret moves, and treat the autonomous layer as the one strategic bet in your security architecture. The following is what the architecture looks like when you apply the Tenth Man rule to it. ## The no-regret moves To be effective against machine-speed exploits, vulnerability management should be a continuous state instead of waiting for the next scheduled scan. And continuous vulnerability discovery means an influx in vulnerabilities inflow, so prioritization needs to move beyond CVSS score. It should layer real-world signals (CISA KEV, EPSS) on top of your unique infrastructural context: what's connected to what, what's business-critical, what's a lateral-movement risk if breached. A one-size-fits-all prioritization model is not suitable anymore for today's landscape. And when it comes to speeding up the actual patch roll-out, autonomous patch management needs to level up. If every identity will eventually be compromised, Zero Trust becomes a logical addition to the stack. It protects any resource that needs to be exposed to the internet, not by trusting a user or app because of who they are, but by checking what device they're on, what they're trying to do, and whether their security posture is satisfactory every single time. The Tenth Man assumes containment will eventually be needed to prevent a breached host from reaching workloads it never had any business talking to. Micro-segmentation policies shrinks the blast radius of a compromise that sneaked through your defenses. ## Fighting fire with fire, and dealing with its risks responsibly As the next layer, you have run-time defense to catch threats that slip past all of the previous layers. And this is also where you need to hand over control to machines. If the attackers operate at machine speed, a response process that loops in a human analyst to validate every alert is a bottleneck you cannot afford today. ![ ](https://cdn.manageengine.com/sites/meweb/images/desktop-central/images/tenth-man-article-1.jpg) Handing over control to your endpoint detection and response (EDR) systems comes with two opposing risks: The first, major issue that most orgs are worried about is with autonomous response. The concern lies with falsely isolating a host, quarantining a process, or revoking a session, which in turn causes downtime. This is a business continuity problem that requires an operational layer of guardrails to validate, stage, or escalate actions before control is handed over to the machine. More on the operational aspects of this system in the next article. When the control is passed onto the machine, and things go wrong, productivity will be affected. This is a problem that you can recover from. The second risk is costlier: Falsely identifying an alert as benign and closing it. Not only will the system not act on it, it also won't raise the alert to a human analyst for validation. This can cause a breach that leads to reputational damage that some orgs can never recover from. So allow your system to have asymmetric autonomy for response: High autonomy for reversible actions and low autonomy for irreversible or high-impact actions. This works because it will not feel like doomsday when the system takes a wrong call. But do not allow your system to dismiss alerts as a false positive. If your primary model thinks an alert is not a threat, use a secondary model for review. If the secondary model also flags it as a false alarm, send a day's worth of false positives to human analysts for review. This maker-checker mechanism reduces the probability of a breach. ![ ](https://cdn.manageengine.com/sites/meweb/images/desktop-central/images/tenth-man-article-2.jpg) But what happens if the human analyst also misses a threat? In that case, you need to be prepared to deal with the consequences. Think of it like Israel's iron dome. The dome is only a part of a broader defense strategy. When interception fails, civil defense becomes the next line of defense. Air raid sirens are activated based on the predicted impact location, cell phones receive emergency alerts and people are instructed to move into bomb shelters within seconds to minutes, depending on location. These shelters are always kept operable, clean, and stocked with necessities. This is exactly what CISOs need to be prepared for too. In case of a breach, ensure you have a sound backup and recovery process to ensure quick business continuity recovery. ## The takeaway Every generation of security has its share of fashionable threats. While most disappear, a few permanently change how security must be viewed. The Tenth Man rule exists to distinguish the difference. If a threat cannot be dismissed, cannot be survived, and cannot be defended against overnight, stop debating whether it is real. Start redesigning your architecture around it. Endpoint security was never about building one wall high enough. It's about assuming every wall eventually falls—including the automated one you just built—and being ready behind the next.