Kept here because a sovereign estate has to defend itself. A perimeter model — network, application, data, and little else — leaves real surfaces undefended: the build pipeline itself is rarely treated as a security surface even though a compromised CI job is one of the more effective ways into production anywhere, and automated traffic detection needs its own specialised discipline rather than living inside generic application security. The ten-plane model gives each concern its own owner, its own interfaces to its neighbours, and its own written doctrine, so a gap in one plane does not hide behind a catch-all in another. The guiding rule across all ten is attack first, train from that: every defensive capability is built by first writing the attack it needs to stop, so the test harness is adversarial by default rather than an afterthought bolted onto a finished system. That discipline is why this card sits under research rather than only in an internal runbook — the doctrine is public even where the live findings behind it are not.