Systems thinking for cybersecurity: A reality based approach

The effectiveness of our current cybersecurity strategies, characterised by escalating financial expenditures and excessive dependence on technological solutions, is being challenged. The lack of corresponding improvement in outcomes suggests a paradigm shift in how we approach cybersecurity is required. Furthermore, the cybersecurity curriculum has been centered on building technical skills, with very little emphasis on teaching cognitive skills, or "how" to think about cybersecurity. Despite being advocated as a remedy for the complex challenges of cybersecurity, systems thinking has largely fallen short of fulfilling all of its promises. This paper aims to bridge the gap by proposing a path forward that incorporates theory and practice, underpinned by extensive empirical evidence. When implemented by cybersecurity practitioners, this approach can reduce the competitive advantage of attackers by better organizing information to make sense of the complex world in which they operate. This effectiveness of this approach stems from its ability to offer practitioners a more accessible and effective approach to thinking in cybersecurity. This reality-centric paradigm advocates an adaptive approach to cybersecurity, moving away from static, belief-based approaches and towards methods based on empirical evidence and practical experience. It emphasizes the importance of continuous learning, adaptation, and the willingness to adjust our understanding in the face of evolving threats, reducing our reliance on increasing expenditures for tools and technologies, a cycle that is now spiraling out of control rather than producing better results.