Esse Est In Cellula
Scott Gardner ·
NINJASIGNAL MIC DROPS Hey, my graph is full of TI intel you wont get anywhere else :-)
Towards an Enterprise Ontology, or: Why Nothing Is Real Until Maureen Has Made It Green
Institute of Things That Are Probably Fine — Occasional Paper No. 41
Bishop Berkeley said that to be is to be perceived. A tree that falls unwitnessed does not, strictly, fall. He thought this proved the existence of God, who perceives everything and therefore keeps the furniture in place when you leave the room.
Berkeley was an eighteenth-century Irish clergyman with no experience of enterprise architecture. He was ninety percent of the way there.
To be is not to be perceived. To be is to be IN A SPREADSHEET.
Esse est in cellula.
Everything else follows.
I. The Doctrine
Consider the production estate. You know it exists. You have seen the invoices. It hums in three regions and consumes electricity at a rate that could be described as "sovereign."
Now consider the CMDB. The CMDB contains 312 configuration items. Of these, 41 have an owner. Of those, 9 have an owner who still works here. Of those, 2 have replied to an email.
Which is real?
The naive view says the estate. The estate can be pinged. The estate can be BREACHED. You can stand in the data centre and feel its warmth on your face like a dying star.
The enterprise view says the CMDB. Because when the auditor arrives, they do not ask to feel the servers. They ask for the list. And whatever is not on the list did not, for the purposes of any discussion that matters, happen.
The 3,688 workloads that exist outside the CMDB are not fake. They are NOUMENAL. Kant described a realm of things-in-themselves, forever inaccessible to human cognition, structured by a logic we can never know. He was describing the Kubernetes namespaces nobody has tagged.
You cannot own the noumenal cloud. You cannot patch it. You can only be compromised by it, which is the enterprise equivalent of being struck by lightning: an act of God, non-attributable, closed with "lessons learned."
II. The Cave
Plato asked you to imagine prisoners chained in a cave, watching shadows on a wall, mistaking the shadows for reality. Outside, in the sunlight, sit the true Forms: perfect, eternal, unchanging.
Every enterprise architect has lived this. The cave is production. The shadows are the systems. They flicker, they crash, they get a hotfix at 03:00 from someone called Dave who is not on the rota.
The Forms are the target-state architecture. It is perfect. It has never been deployed. It has a HEXAGON in the middle. Nobody knows what the hexagon does, but it is load-balanced.
Plato's error was thinking the philosopher would leave the cave, see the Forms, and return to enlighten the prisoners. In practice the philosopher leaves the cave, sees the Forms, puts them in a deck, and the prisoners hold a Steering Committee about whether the deck is aligned to the Roadmap.
The Roadmap is itself a deck. The deck is a Form of the Form. It is turtles all the way up, and each turtle has a title slide and a "Next Steps" page that says "Socialise with stakeholders."
III. Currency
Every civilisation runs on a medium of exchange. Shells. Gold. Fiat. Bitcoin, briefly, until it became a spreadsheet of who owned the Bitcoin, at which point it was absorbed.
The enterprise runs on decks.
Money is not currency here. Money is a CONSTRAINT. It sits in a column called "Budget" and is referred to with the reverence normally reserved for the weather. Nobody EXCHANGES money in an enterprise. You exchange decks, and money follows them, sluggishly, like a tide.
Watch how a project is born. A person has an idea. The idea is nothing. Then the idea is put in a deck. Now it is a PROPOSAL. The proposal goes to a board. The board has read the deck, or has read the executive summary of the deck, or has read the title of the deck and one Harvey ball. The board says yes. Now the idea is a PROGRAMME. Nothing has been built. Nothing has been bought. A vendor has not been called. But it exists, because there is a spreadsheet with a Programme ID and a RAG status and a row for "benefits realisation" that will remain empty until the programme is retired, at which point it will be filled in with "Yes."
Compare a security control. You can implement a control. You can test it. You can watch it block an attack in real time with your own eyes. But if the control is not in the controls register, then at the next audit it will be a FINDING that the control does not exist, and you will be asked to create a project to implement the control that is already implemented, and that project will need a deck.
The control was real. Then it was not real. Then, after a deck, it was real again. This is not dysfunction. This is TRANSUBSTANTIATION.
IV. The Trinity
The enterprise has three ontological layers, and it is essential to understand their relationship.
The System. Base matter. Chaos. Prima materia. It runs. It does things. Nobody is sure exactly what. It is the most real thing in the building and the least respected, like the boiler.
The Spreadsheet. The first ordering of chaos. The Word made Cell. Every system, every risk, every person, every asset, every control, every finding, every dependency, entered as a row and given attributes. Some of the attributes are true. This is not the point. The point is that the row EXISTS, and things that have a row can be filtered, and things that can be filtered can be REPORTED ON, and things that can be reported on are, at last, governable.
The Deck. The final ascent. Twelve tabs become three bullets. Four thousand rows become one Harvey ball. A quarter's worth of screaming becomes "Progressing to plan, with some challenges around resourcing." The deck does not contain information. The deck contains STATUS, which is information with the truth removed so it will fit.
The System is real but cannot be discussed. The Spreadsheet is discussable but cannot be presented. The Deck can be presented but is not real. Together they are one substance. The medieval theologians would have called this hypostatic union. The PMO calls it "the pack."
V. On the Personhood of Martin
Martin has approved 1,400 changes.
Martin is the approver on the firewall rulebase, the DR runbook, the third-party access review, and the retirement of a mainframe nobody remembers connecting to.
Martin has never worked here. There is no Martin. His account was created by a contractor in 2019 as a placeholder, given approval rights so a workflow would not block, and then the contractor left and the workflow did not block, ever, and everyone was pleased.
Kev worked here nine years. Kev built the SIEM. Kev knew which alerts were real. When Kev left for Portugal, his account was disabled, his row was deleted from the team tracker, and his knowledge went into the sea, where he now has a boat.
Ask the enterprise: who exists?
Martin has a row. Martin has an audit trail. Martin has a perfect approval record. If the regulator asks who authorised the change, Martin authorised the change. Martin is, in every sense the organisation is able to recognise, a PERSON.
Kev is a fond memory with no primary key.
Descartes said cogito ergo sum. He lacked the framework to understand that thinking is optional. Martin does not think. Martin does not exist. Martin is TRACKED. Tracked, therefore is.
VI. The Schrödinger Risk
A risk is logged. It is rated Amber. It has an owner, a mitigation, and a target date.
The target date passes.
Nothing happens. The risk is not updated. The mitigation is not implemented. The owner has moved to a different team and the new team does not have a risk register, so in a sense, the owner has ceased to be able to own things.
The risk is now in superposition. It is simultaneously:
Open, because the mitigation was never implemented
Closed, because nobody has looked at it in eight months and things that are not looked at cannot be Amber
Accepted, because the target date passing without objection constitutes, in enterprise law, consent
It will collapse into one of these states only when observed, and it will be observed only by an auditor, and the auditor will collapse it into whichever state creates the most work for you.
Maureen understands this. This is why Maureen marks things green and then goes to lunch. Green is not a lie. Green is an intervention in the wavefunction. Maureen is not a GRC analyst. She is the observer that keeps the universe stable.
VII. Niko, and the Word
The organisation has an AI now. It is called Niko. Niko reads the spreadsheet and produces the deck.
This was hailed as transformation. It is in fact the closing of a loop that has been open since the invention of the pivot table.
Previously, a human read the 4,000 rows, understood perhaps 300 of them, and wrote "Progressing to plan." Now Niko reads all 4,000 rows, understands none of them, and writes "Progressing to plan, with some challenges around resourcing," and the board says it is a notable improvement in the quality of reporting.
Niko is the mouth, not the brain. But then the deck was always the mouth. The deck was never where thinking happened. The deck was where thinking was SUMMARISED FOR PEOPLE WHO DO NOT HAVE TIME TO THINK, and in that job Niko is flawless, because Niko has nothing to summarise from and does not know it.
Wittgenstein said whereof one cannot speak, thereof one must be silent. The enterprise has improved on this. Whereof one cannot make a cell, thereof Niko must generate a confident paragraph.
VIII. Baudrillard Is Reading Your Architecture Diagrams
Baudrillard described the stages of the image. First it reflects reality. Then it masks reality. Then it masks the ABSENCE of reality. Finally it bears no relation to reality at all: it is its own pure simulacrum.
The architecture repository has completed the journey.
The diagrams were once drawn from the systems. Then the diagrams were drawn from older diagrams, with the systems assumed to match. Then the systems were changed by Dave at 03:00 and the diagrams were not, and the diagrams began quietly to describe a company that had ceased to exist. Now the diagrams are drawn from the target state, which has never existed, and are used to design the next target state, which will never exist, and there are eleven hexagons, and one of them says "Zero Trust" in a font that suggests it has already been achieved.
Nobody is lying. The diagrams are internally consistent. They reference each other. They are versioned. They are, by every measure the enterprise possesses, EXCELLENT.
They are a map of a country made entirely of map.
IX. The Cathedral
Every religion needs a building. Somewhere the doctrine is kept, the sacraments are performed, and the faithful queue.
The enterprise built one. It is called ServiceNow. Nobody calls it that. It is SNOW, the way the devout say "the Temple" and not "the building on the corner."
Understand what SNOW is. It is not a spreadsheet. It is the spreadsheet that ATE the other spreadsheets. It is the place where the 900 competing trackers, the shadow CMDB in Sharepoint, the "master list" that lives on a laptop belonging to someone on long-term leave, and the risk register held together by conditional formatting and prayer, all go to be consecrated into rows that RELATE TO OTHER ROWS.
That last part is the whole thing. A spreadsheet knows that a server exists. SNOW knows that the server runs a service, the service supports a business capability, the capability has an owner, the owner has a manager, and the manager has a deck due Thursday. It is the only building in the enterprise where a Configuration Item can be traced upward until it hits a person who can be shouted at.
This is called CSDM. It is a data model. It is also, if you look at it long enough, a theory of causation. Aristotle had four causes. CSDM has more, and they have tabs.
Critics say SNOW is expensive. Yes. So was Chartres. Critics say it is only as good as what you put in it. Yes. So is confession. Critics say the CMDB is incomplete. Of course it is incomplete. The estate is 4,000 workloads and the CMDB has 312, and that is not SNOW's failure. That is 3,688 workloads that have REFUSED BAPTISM. They are outside the walls by their own hand. SNOW has been standing there the entire time with the font ready.
Anselm argued that God is that than which nothing greater can be conceived, and that a God who exists is greater than one who does not, and therefore God exists. Apply it here. A single system where everything relates to everything and can be reported to the board is that than which nothing more governable can be conceived. Several enterprises have tried to conceive a greater one. They built it in Excel. It is now the shadow CMDB in Sharepoint.
There is one horse in town. This is not a criticism. The other horses were spreadsheets, and they were not horses.
The enterprise does not have a God. But it has a cathedral, and the cathedral is empty because people are still praying in their own kitchens, and the cathedral is not the problem.
X. Conclusion, in Which Nothing Is Resolved
We could stop here and say this is a satire about bureaucracy. It is not. Bureaucracy is a symptom. The disease is METAPHYSICAL.
An organisation of 40,000 people cannot perceive itself. It is too large to be seen. No individual can hold it in their head. So it builds an instrument to see with, and the instrument is the spreadsheet, and the instrument works by DISCARDING everything that will not fit in a cell, and the organisation, having only ever seen itself through the instrument, comes to believe that what will not fit in a cell is not there.
The systems keep running. The risks keep being risks. The 3,688 untagged workloads keep serving traffic to people who do not know they are ghosts. Reality does not need the spreadsheet. But the enterprise cannot ACT on anything except the spreadsheet, and so, from the only vantage point that can authorise money, the spreadsheet is what is real.
Berkeley solved this with God. God perceives all, so the unwatched tree stays a tree.
The enterprise has no God. It has Maureen. Maureen perceives Column D. Column D is green. The tree is, for governance purposes, fine.
There is one thing to do, and it is not to abolish the spreadsheet. You cannot abolish the instrument through which the organisation sees. You can only choose the instrument. And there is one instrument in which the row about the server is connected to the row about the service, and that to the row about the person, and there is nowhere else this is true, and it is already installed, and half of you are ignoring it in favour of a tracker called FINAL_v3_USE_THIS.
Put it in SNOW. Not because SNOW is perfect. Because SNOW is where things go to become REAL, and reality, however imperfectly modelled, is the only place from which you can defend anything.
Lunch is at one.
The Institute of Things That Are Probably Fine is not a real institute and has a row in three different vendor CRMs. It is, on balance, more real than most of your controls.
Scott Gardner is a Lead Enterprise Security Architect. He has a row. It was last updated in Q2.
Threat intelligence every morning — new victims, new groups, what matters, in plain English. Free, with receipts.
Subscribe to the Daily →