The Hierarchy of Hurt builds on David Bianco's Pyramid of Pain (2013) by adding a second axis to the same underlying question — what makes a detection valuable? Where PoP answers from the adversary's moment of adaptation (how hard is it to change?), HoH answers from operational consequence: what does being caught actually cost them? Most of the time these point in the same direction, which is why PoP has held up for over a decade. HoH extends the logic into cases where they diverge, and into AI-plane territory where the change-difficulty framing has no clean answer.

Hurt is concrete and operational, not emotional. Detecting an IP address may delay an adversary for minutes — new VPS, new IP, back in operation. Detecting a tool forces them to rebuild or replace it — days to weeks of disruption. Detecting a TTP requires retraining operators and rebuilding muscle memory across the team. Detecting a TA operational signature forces them to retool their entire approach to how they run operations. At the AI plane, the adversary faces constraints they cannot simply spend their way out of: a model fingerprint is baked in by training and cannot be removed by prompting.

Lower-level detections — IPs, hashes, domains — remain essential for rapid response and volume triage. They are not dismissed here. But they impose limited long-term operational cost on a capable adversary. The framework is designed to help defenders understand that distinction and invest accordingly.

The framework is organized into three sections. The Foundation layers draw on Bianco's original structure, enriched with concrete event examples, data sources, and ATT&CK mappings. The HoH Extended layers add the TA operational signature as a bridge between traditional tradecraft and AI-assisted operations. The AI plane layers extend the same disruption-cost principle into territory that simply didn't exist in 2013 — model fingerprinting, linguistic laundering, synthetic identity operations, and the prompt/interaction plane.

Each layer documents observable artifacts, detection approaches with concrete examples, data sources, cloud and email attack surfaces, and adversary recovery cost. The goal is a framework that is both conceptually rigorous and operationally actionable.

Most detection frameworks stop at TTPs. The cost-of-disruption framing has not been applied to AI-assisted adversary operations — influence campaigns, BEC, synthetic persona networks, AI-augmented impersonation — which are already operational threats. Defenders need a structured way to think about where to invest, what to detect, and what operational cost each detection layer imposes on the adversary.

Modern adversaries can rotate infrastructure in minutes, regenerate malware automatically, and rebuild artifacts on demand. Change itself is cheap. But operational recovery — rebuilding tradecraft, retraining operators, redesigning workflows, absorbing the exposure cost of being detected — is not always cheap. That asymmetry is what the Hierarchy of Hurt is built to exploit. The question defenders should be asking is not just "can we detect this?" but "does detecting this actually cost the adversary something meaningful?"

The linguistic laundering concept — treating multi-model AI content generation as a money-laundering analog with placement, layering, and integration phases — provides a novel detection primitive grounded in disruption cost. The adversary's evasion effort creates the signal. Every additional laundering pass costs compute time and operational overhead while generating new artifacts. The harder they work to reduce their fingerprint, the more laundering signature they produce. Evasion and detection become mutually reinforcing.

The framework is also a maturity roadmap. Foundation and HoH Extended layers are operational today. TA operational signature and model fingerprint are emerging. The AI plane upper layers are research-stage — the theory is sound, proof-of-concept work exists, but production-grade tooling does not yet exist for most orgs. Knowing where you are on that curve, and what it would cost an adversary if you could detect at higher layers, is what drives investment decisions.