For most of the age of sail, a captain could find his latitude in minutes and could not find his longitude at all.
Latitude you could read off the sun. Longitude, your position east to west, offered no such trick. Three weeks into the Atlantic, a navigator knew how far north he was and could only estimate how far along he had come. The estimate was often wrong, and wrong on open water means rocks. After a British fleet was lost on home rocks in 1707, Parliament offered up to 20,000 pounds for anyone who could solve it.
The problem was never the ocean
Longitude is not really a sea problem. It is a time problem.
The Earth turns 15 degrees an hour. Know the exact time at a fixed reference, Greenwich, check it against your local noon, and the gap tells you where you are. The whole problem collapses to one question. Can you carry a single fact, the reference time, across an ocean without losing it?
The prestigious answer was the lunar distance method. Measure the angle between the moon and the stars, then calculate against printed tables to derive the time. It was elegant and rigorous. And it was inference. You looked at the sky and computed a hope.
The carpenter who refused the premise
John Harrison did something different.
A self-taught carpenter from a Yorkshire village, Harrison’s move was not to guess the time more cleverly. It was to carry it. He set out to build a clock so indifferent to a pitching deck, heat, cold, salt and damp that it could hold Greenwich time across months at sea. Do that, and longitude becomes arithmetic. Not a calculation of where you probably are. A statement of where you are.
In 1761, his fourth timekeeper sailed to Jamaica, and after 81 days at sea it had lost five seconds. That meant a longitude error of about one nautical mile.
The distinction matters. A guess, however educated, is a probability. When you carry the fact, the answer stops being a matter of odds.
There was still a problem. Harrison had made one magnificent object by hand. The navy needed something every ship could carry cheaply and at scale. Chronometers remained expensive, so lunar tables stayed in use long after Harrison proved the idea. The fact only truly won when reliable timekeepers could travel onto every deck.
The AI era is a longitude problem
Attackers and defenders are now reaching for the same engines. The reasoning models that can write a flawless lure are the same class of models that can read one. When both sides have comparable instruments, the contest increasingly comes down to what you feed them.
For most of security’s history, we did what the astronomers did. We got better at inference. Better anomaly scoring, better reputation systems, better models of what bad behavior looked like before. More sophisticated ways of reading the sky.
Attackers operate largely the same way. They scrape your org chart, guess who signs the wire, assume which domains belong to you and harvest what normal looked like months ago. Their picture is external, often stale and rarely confirmed. They are reading your stars.
Defenders can carry facts the attacker has to guess at: who actually approves a payment and whether it takes two signatures, the 99 domains you own that an outsider might flag as strangers, the vendor that is real and the one that never existed.
That advantage is not absolute. Attackers get inside through stolen passwords, compromised mailboxes and breached suppliers. But getting inside costs them, and even then, they are moving against facts they cannot fully see or reliably keep current. For 30 years, the asymmetry ran their way because they only had to be right once. Ground truth is how the price starts to run the other way.
Consider a wire request from the CFO. The grammar is perfect, the tone is right, the thread looks real and it clears every reputation and anomaly check because nothing about it appears unusual.
What kills it is a fact. The person named as approver is not the approver of record for that account, and the reply-to domain is not one of the 99 you own. A system carrying your ground truth does not need to decide whether the email looks strange. It can ask whether the message contradicts something you already know to be true.
Then comes the hard part. Ground truth decays.
Approvers change; domains sprawl and business units add vendors nobody logs. A fact you stop maintaining becomes a confident guess in better clothes. Keeping those records true is the modern equivalent of getting the chronometer onto every ship and keeping every one wound.
None of this produces a system that cannot be fooled. It produces one that is fooled far less and, for anyone who has to answer for a decision later, one whose reasoning can be read back. Owning the truth is the idea. Keeping it true is the work.
For 300 years the best navigators alive guessed their way across the ocean, and good ones still ran aground. The attackers at your gate are doing much the same thing, inferring your world from the outside and computing a plausible version of it.
Guesses have been good enough to wreck fleets. The question is whether your defenses are still reading the stars beside them or carrying the fact.
If you want to know where to start, start with the fact your attacker most has to guess: who in your company can actually move money.
No Responses