Locked Shields and the OSI Model: Stop blaming the firewall

A first-hand account of deploying Tanium at Locked Shields 2026, the world’s largest cyber defense exercise involving over 4,000 participants from 41 nations. The post argues that blue teams struggling at Locked Shields fail not because of weak SOC playbooks, but because incidents break at Layer 2 and BGP while defenders are focused on Layer 7, making fundamental OSI model knowledge critical to winning.