Continue your mission
# PDM Through History: How Rome Defended Its Information The Planetary Defense Model organizes cybersecurity into six concentric domains: Data Protection and Sovereignty, Vulnerability and Surface Defense, Security Posture and Hygiene, Identity Access and Trust, Threat Intelligence and Defense, and
# PDM Through History: How Rome Defended Its Information
The Planetary Defense Model organizes cybersecurity into six concentric domains: Data Protection and Sovereignty, Vulnerability and Surface Defense, Security Posture and Hygiene, Identity Access and Trust, Threat Intelligence and Defense, and Risk Governance and Assurance.
Most people encounter the PDM as a framework for modern digital security. Firewalls. Encryption. SIEM platforms. Zero trust architecture. The language is technical. The context is contemporary. The assumption is that information security began with the computer.
That assumption is wrong by roughly 2,000 years.
The Roman Republic and Empire built one of the most sophisticated information security programs in the ancient world. They encrypted military communications. They authenticated identity with physical tokens. They operated intelligence networks spanning three continents. They enforced operational hygiene through doctrine and discipline. They governed risk through institutional oversight that outlasted individual emperors.
They did all of this without a single line of code.
What Rome built maps to the PDM with structural precision, not because CDA designed the PDM to mimic Rome, but because the architecture of defending information has not changed. Technologies change. Threat actors change. The fundamental problem of protecting critical information from unauthorized access, modification, and destruction does not. The PDM describes that problem. Rome solved it with wax and iron. We solve it with encryption and access controls. The architecture is the same.
Rome's most critical data took physical form: military orders, troop positions, diplomatic correspondence, census records, treasury accounts, legal judgments. Protecting this data was not a bureaucratic concern. It was a survival imperative.
Encryption. Julius Caesar used a substitution cipher (now called the Caesar cipher) to protect military communications. Each letter shifted three positions in the Latin alphabet. The cipher was simple by modern standards, but it served its purpose: if a messenger was captured, the intercepted message was gibberish to anyone without the shift key. Augustus Caesar used a variant with a shift of one. Other commanders used different shift values, creating a form of key management across the Roman military.
The principle is identical to modern encryption: render data unreadable to anyone who does not hold the key. AES-256 is more complex than a three-position alphabetic shift. The operational logic is the same.
Data sovereignty. Rome understood that where information resided determined who controlled it. The Tabularium, built in 78 BC at the foot of the Capitoline Hill, served as Rome's central records archive. Census data, legal records, financial accounts, and legislative acts were stored in a single sovereign repository under state control. Provincial records were maintained locally but subject to Roman administrative authority, a model that mirrors modern data localization requirements under GDPR, CCPA, and national data sovereignty laws.
When Rome established a provincial capital, one of the first administrative acts was establishing a local tabularium. Controlling the records meant controlling the province. Every modern data sovereignty dispute, from EU-US data transfer agreements to China's data localization mandates, echoes this principle: whoever controls where data lives controls who can access it.
Sealed communications. Roman officials used wax seals (sigillum) and seal rings (anuli signatorii) to authenticate and protect documents. A broken seal meant the document had been tampered with or intercepted. This is the ancient equivalent of digital signatures and integrity verification. The seal did not encrypt the contents. It guaranteed that the contents had not been modified in transit, exactly as a cryptographic hash functions today.
Secure destruction. The Romans burned sensitive documents after reading. Military dispatches in hostile territory were destroyed after dissemination. This practice mirrors modern secure data disposal: shredding, degaussing, cryptographic erasure. The Romans understood what many modern organizations still fail to internalize: data you no longer need but still possess is a liability, not an asset.
The SDP (Sovereign Data Protocol) principle, "Your data lives where you decide. Period," would have been perfectly intelligible to a Roman provincial governor managing the tabularium.
Every Roman frontier was an attack surface. Every road, harbor, river crossing, mountain pass, and frontier post represented a point where adversaries could probe, test, and breach the perimeter. Rome's approach to managing this surface was systematic, continuous, and architecturally deliberate.
The limes. Rome's frontier defense system, the limes, was the largest attack surface reduction program in the ancient world. Hadrian's Wall in Britannia, the Limes Germanicus along the Rhine and Danube, the desert fortifications of North Africa: each represented a deliberate decision about where to draw the defensive boundary. The limes did not attempt to defend everything. It defined what was inside and what was outside, then concentrated defensive resources along that boundary.
This is Continuous Surface Reduction (CSR) in stone and timber. "Every surface you expose is a surface we eliminate." Hadrian did not build his wall because Rome could not project power beyond it. He built it because maintaining an undefined frontier consumed more resources than defending a defined one. The wall reduced the attack surface from "everywhere the barbarians might cross" to "these specific gates and fortifications where we control the engagement."
Modern attack surface management operates on the same principle. An organization with 47 internet-facing services has a larger attack surface than one with 12. The goal is not to eliminate all exposure (Rome still had gates in the wall) but to reduce the surface to what you can defend, monitor, and control.
Fortification architecture. Roman castra (military camps) followed standardized layouts regardless of location. The same gate positions, the same road alignments, the same defensive ditch dimensions, from Britannia to Syria. This standardization meant that any Roman soldier arriving at any camp immediately understood the defensive architecture. Vulnerabilities in one camp's design were vulnerabilities in all camps, which created institutional incentive to identify and remediate weaknesses across the entire network.
This parallels modern configuration management and infrastructure-as-code. When your cloud environments follow standardized templates, a vulnerability discovered in one deployment can be remediated across all deployments simultaneously. When every deployment is unique, vulnerability management becomes an exercise in one-off remediation. Rome chose standardization for the same reason modern security teams do: it makes the surface manageable.
Port and harbor security. Rome controlled maritime attack surface through a network of naval bases and regulated ports. The classis (Roman navy) patrolled shipping lanes. Unauthorized vessels were intercepted. This is the ancient equivalent of API gateway security and network ingress control: define authorized traffic patterns, monitor for anomalies, intercept unauthorized access attempts.
Roman military effectiveness depended on operational discipline more than technology. The legions did not win because their weapons were superior (they often were not). They won because their daily operational hygiene was relentless.
The daily castra. Roman legions on the march built a fortified camp every single night. Every night. Not when they expected contact with the enemy. Every night. The camp followed the same layout, the same defensive dimensions, the same construction standards. Soldiers who had marched 20 miles still dug ditches and erected palisades before sleeping.
This is the cybersecurity hygiene equivalent of daily patching, configuration enforcement, and baseline validation. Not when there is a threat advisory. Not when the CISO asks. Every day. The organizations that maintain daily operational hygiene are the organizations that survive contact with an adversary. The ones that treat hygiene as an event rather than a state are the ones that discover their defenses have eroded at the worst possible moment.
Autonomous Posture Command (APC), "Your posture adapts. Your hygiene never sleeps," describes what the Roman legion practiced as doctrine 2,000 years before the first endpoint agent.
Equipment inspection. Roman centurions inspected soldier equipment daily. Weapons, armor, footwear, cooking equipment. A soldier with a rusted gladius or a cracked helmet was a vulnerability to the entire formation. Individual readiness was a collective security concern.
Modern endpoint health monitoring works on the same principle. A single unpatched endpoint, a single misconfigured laptop, a single expired certificate is a vulnerability to the entire network. Asset management and configuration compliance are the digital equivalent of the centurion's morning inspection.
Road maintenance. Roman roads were not built for commerce (though they enabled it). They were built for military logistics: rapid deployment, secure communication, reliable supply lines. Roads were maintained continuously. A deteriorated road slowed response times, degraded communication reliability, and created opportunities for ambush.
Network infrastructure maintenance, keeping routers patched, links redundant, bandwidth adequate, monitoring active, is the same operational discipline applied to digital terrain. Neglected infrastructure becomes the path of least resistance for attackers, exactly as an unmaintained Roman road became the path of opportunity for raiders.
Training and drills. Roman soldiers trained constantly, including in peacetime. Vegetius wrote in De Re Militari that Roman training was so rigorous that actual combat was "almost a relief." The distinction between training and operations was minimal. Soldiers practiced fortification, formation, and weapons drill until execution was reflexive.
In CDA's campaign model, C-DRILL (testing and validation) exists for this reason. Tabletop exercises, penetration tests, incident response drills, social engineering campaigns: these are not optional enhancements. They are the training regimen that makes operational performance reliable under pressure.
Rome's identity and access infrastructure was among the most sophisticated in the ancient world, because managing a multi-ethnic empire of 60 to 70 million people across three continents required knowing who belonged, what they could access, and how trust was established.
The tessera. Roman soldiers carried a tessera, a small tablet (wood, bone, or metal) that served as an authentication token. The tessera militaris identified the bearer as a member of a specific legion and entitled them to rations, access to camps, and passage through controlled areas. The tessera hospitalis was a two-piece token split between host and guest, which, when reunited, authenticated the relationship. Present the wrong tessera, or none at all, and access was denied.
This is multi-factor authentication in physical form. The tessera was something you possessed (a physical token) that verified your identity within a trusted system. Modern FIDO2/WebAuthn hardware keys operate on the same principle: a physical token that cryptographically proves identity without transmitting a shared secret.
The watchword (signum). Each night, the Roman camp commander issued a watchword that sentries used to authenticate anyone approaching the perimeter. The watchword changed nightly and was distributed through a controlled chain of command. A person who did not know the current watchword was denied entry regardless of rank or claimed identity.
This is a rotating credential with a defined expiration and controlled distribution. Modern session tokens, rotating API keys, and time-based one-time passwords (TOTP) implement the same concept: a credential that is valid for a limited period and must be obtained through an authorized channel.
Citizenship as access control. Roman citizenship was a tiered access system. Citizens had rights (voting, legal protection, property ownership) that non-citizens did not. Within citizenship, further tiers existed: equestrian rank, senatorial rank, imperial office. Each tier unlocked additional access to resources, institutions, and authority.
CDA's own membership model mirrors this directly. Civilian, Cadet, Enlisted, Officer, Crew: each tier grants progressively greater access to content, missions, and operational authority. The Roman model and CDA's model share the same architectural principle: identity determines access, access is tiered, and higher tiers include lower-tier privileges.
Foreign nations as external networks. Rome's world was not a single network. It was an interconnected system of sovereign entities with different trust levels. Allied nations (socii) had trusted access to Roman military coordination, trade routes, and diplomatic channels. Neutral nations had limited, monitored interaction. Hostile nations (Carthage, Parthia, later the Germanic confederations) were adversarial actors probing Rome's perimeter, seeking vulnerabilities, and launching attacks.
The Internet operates identically. Trusted partners have VPN access, API integrations, and shared data agreements. Neutral entities interact through public-facing services under standard access controls. Hostile actors (state-sponsored threat groups, cybercriminal organizations) probe the perimeter, exploit vulnerabilities, and launch attacks. Some actors, like modern advanced persistent threat groups, maintain long-term presence inside the perimeter while appearing to be authorized traffic, exactly as Roman-era spies operated within allied nations while reporting to hostile powers.
Insider threats. Rome's history is a case study in identity compromise. Senators who conspired against the state (the assassination of Caesar). Praetorian Guard commanders who sold the emperorship to the highest bidder (Didius Julianus, 193 AD). Provincial governors who rebelled using legions they had been entrusted to command. Every major Roman political crisis involved a trusted insider who used authorized access for unauthorized purposes.
Modern insider threat programs address the same problem. An employee with legitimate credentials who exfiltrates data, a contractor with elevated privileges who installs a backdoor, a business partner who accesses systems beyond their authorized scope: these are the digital equivalent of the Praetorian prefect who turns his sword against the emperor he was sworn to protect.
Zero Possession Architecture (ZPA) addresses the structural version of this problem. "Trust nothing. Possess nothing. Verify everything." Rome could not implement ZPA (you cannot verify a Praetorian Guard commander's loyalty in real time), but the principle that trust must be continuously verified rather than permanently granted would have prevented several of Rome's most catastrophic security failures.
Rome operated one of the most effective intelligence networks in the ancient world. Knowing what threats existed, where they were gathering, and when they would strike was the difference between a defended frontier and a sacked province.
The speculatores. Originally scouts attached to each legion, the speculatores evolved into Rome's primary intelligence operatives. They conducted reconnaissance in enemy territory, gathered information on enemy troop movements and capabilities, and reported directly to commanding generals. During the imperial period, they also served as imperial couriers and, occasionally, assassins.
This is a threat intelligence team. The speculatores gathered tactical intelligence (immediate threat assessment) and strategic intelligence (long-term capability analysis of adversaries). Modern threat intelligence teams do the same work: monitoring threat actor activity, tracking capability development, providing early warning of impending operations.
The frumentarii. Originally military supply officers responsible for grain procurement, the frumentarii became Rome's covert intelligence service during the imperial period. They operated across the empire, gathering political intelligence, monitoring provincial loyalty, and reporting on potential sedition. Their cover as supply officers gave them legitimate reason to travel throughout the empire and interact with military and civilian populations, the ancient equivalent of operating under non-official cover.
Modern cybersecurity intelligence collection operates through analogous mechanisms: honeypots that present themselves as legitimate targets, threat intelligence analysts who monitor dark web forums under operational personas, and deception technologies that create false environments to study attacker behavior.
The cursor publicus. Rome's imperial postal system (cursus publicus) was not primarily a mail service. It was a communications intelligence infrastructure. Relay stations (mutationes and mansiones) were spaced at regular intervals along major roads, enabling rapid transmission of intelligence from frontier to capital. The system could move information across the empire in days, not weeks, giving Rome a decisive information advantage over adversaries who lacked comparable infrastructure.
Modern SIEM and SOAR platforms serve the same function: aggregating telemetry from distributed sensors across the environment, correlating events, and delivering actionable intelligence to decision-makers. The cursus publicus was Rome's SIEM, built with horses and relay stations instead of APIs and log collectors.
Early warning systems. Along the limes, watchtower networks provided early warning of hostile movement. Towers were spaced within visual signaling distance. Fire signals, flag signals, and mirror signals transmitted alerts faster than any mounted messenger could ride. The detection of a hostile force crossing the frontier triggered a cascade of signals that mobilized defensive forces before the threat reached populated areas.
Network intrusion detection systems, anomaly detection platforms, and distributed sensor networks serve the same operational function. The Roman watchtower did not stop the invaders. It detected them and transmitted the alert. Just as an IDS does not block an attack but detects and reports it for response.
The PDI (Predictive Defense Intelligence) methodology, "See the threat before it sees you," describes what Rome's speculator-frumentarius-watchtower network accomplished: layered intelligence collection that provided warning before the threat materialized at the frontier.
Rome survived for over a thousand years (from Republic to the fall of the Western Empire, longer if you count Byzantium) because its governance structures could sustain defense across changes in leadership, economic conditions, and strategic priorities. Individual emperors came and went. The institutional apparatus persisted.
The Senate as governance body. The Roman Senate, particularly during the Republic, provided strategic oversight of military operations, foreign policy, and resource allocation. Senators debated threat priorities, authorized military deployments, allocated funding, and held commanders accountable for outcomes. This is board-level cybersecurity governance: strategic oversight, budget authority, risk tolerance decisions, and accountability for program effectiveness.
Modern organizations struggle with exactly the governance challenge Rome solved: how does a non-technical oversight body (the board, the Senate) exercise meaningful governance over a technical defense function (the security program, the legions) without micromanaging operations? Rome's answer was the same as the modern best practice: the Senate set strategic direction and allocated resources. Commanders executed within that mandate and reported outcomes. The Senate did not tell Scipio how to fight Hannibal. It authorized the campaign, funded the legions, and held Scipio accountable for the result.
Provincial governance as distributed risk management. Each Roman province had a governor responsible for local defense, law enforcement, tax collection, and infrastructure maintenance. Governors operated within Roman law and policy but had significant operational autonomy. The governor of Syria did not wait for Senate approval before responding to a Parthian border incursion. He responded within his mandate and reported afterward.
This maps directly to distributed cybersecurity governance in large organizations. Business unit security leads operate within corporate policy but have operational autonomy to respond to local threats. The CISO sets strategy and standards. Business unit leads execute within those boundaries and report metrics upward.
Roman law as the compliance framework. Roman law (ius civile, ius gentium, ius naturale) provided the framework within which all other operations functioned. Military operations, trade, property, citizenship, criminal justice: everything operated within a legal structure that defined rights, obligations, and consequences. Compliance with Roman law was not optional. Consequences for non-compliance ranged from fines to exile to execution.
Perpetual Compliance Assurance (PCA) operates on the same principle: compliance is not an event you prepare for annually. It is a continuous state that governance structures maintain. The Roman Empire did not have an annual "Roman law audit." Roman law was enforced continuously, violations were detected and remediated in real time, and governance structures ensured that compliance persisted across changes in personnel, geography, and circumstance.
Census and actuarial intelligence. Rome conducted regular censuses that served as the foundation for resource allocation, military planning, taxation, and risk assessment. Knowing the population, wealth distribution, and military-age male count of each province enabled strategic planning at imperial scale. The census was Rome's risk register: a quantitative assessment of available resources and potential vulnerabilities across the enterprise.
Modern GRC platforms serve the same function. A risk register that quantifies threats, vulnerabilities, and asset values enables strategic resource allocation. An organization that does not maintain a current risk register is operating with the same blindness as a Roman governor who failed to conduct a provincial census: they do not know what they have, what they might lose, or where to invest.
Every PDM domain has a Roman precedent because the PDM describes the architecture of defense, not the technology of any particular era. Data must be protected whether it is inscribed on a wax tablet or stored in a cloud database. Surfaces must be reduced whether they are frontier provinces or internet-facing APIs. Hygiene must be maintained whether it is inspecting a gladius or patching an endpoint. Identity must be verified whether the mechanism is a tessera or a FIDO2 key. Threats must be detected whether the sensor is a watchtower or an IDS. Governance must persist whether the governing body is the Roman Senate or a corporate board.
The organizations that fail at cybersecurity today fail for the same reasons Roman provinces fell: they neglect hygiene when no immediate threat is visible (SPH), they allow surfaces to expand unchecked (VSD), they grant trust without verification (IAT), they ignore intelligence about gathering threats (TID), they fail to classify and protect their most critical assets (DPS), and they lack the governance structures to sustain defense across leadership changes (RGA).
The Romans who got it right survived. The ones who did not fell to adversaries who understood their weaknesses better than they did.
The PDM is not a modern invention mapped backward onto history. It is a description of how defense works, observed across millennia and formalized into an operational framework. Rome proved the architecture. CDA operationalizes it.
Word count: 3,487
CDA Theater missions that address topics covered in this article.
Written by Evan Morgan
Found an issue? Help improve this article.