Dealing With Uncertainty: Scenario Planning for Cybersecurity Decision-Making

Dealing With Uncertainty: Scenario Planning for Cybersecurity Decision-Making

Speakers: Gert-Jan Bruggink (Venation)

Conference: FIRST CTI Conference

YouTube: https://www.youtube.com/watch?v=CRkMV5xXoKg

Overview

In the dynamic and often chaotic landscape of modern cybersecurity, decision-makers frequently find themselves ill-equipped to answer critical questions about future threats. Gert-Jan Bruggink, representing Venation, addresses this pervasive challenge in his talk, "Dealing With Uncertainty: Scenario Planning for Cybersecurity Decision-Making," delivered at the FIRST CTI Conference. Bruggink argues that traditional, reactive cybersecurity approaches—relying on dashboards, risk registers, or ad-hoc reports—fail to satisfy the strategic needs of executives who demand foresight and preparedness for an uncertain future. His presentation champions the adoption of scenario planning and strategic foresight as essential tools for cybersecurity teams, particularly Cyber Threat Intelligence (CTI) professionals, to bridge this gap.

Bruggink's core thesis revolves around the idea that cybersecurity, particularly at the organizational level, should be viewed as a complex system rather than a merely complicated one. This distinction necessitates a shift from purely technical, reactive problem-solving to a more holistic, proactive, and business-aligned approach. The talk provides a compelling framework for CTI teams to move beyond merely reporting on current threats to actively shaping future organizational resilience through structured decision-making processes, effective communication, and a deep understanding of business objectives. It matters because, in an era of escalating threats and constrained resources, the ability to anticipate and strategically prepare for future cyber events is paramount to an organization's survival and success.

Background

▶ Watch: The common CEO question: 'Are we prepared?' (0:00)

The problem Bruggink identifies is a common scenario in many organizations: a director or CEO, alerted by news (e.g., "MPM small thing," Axios reports), demands to know if the company is prepared for a new, emerging threat. Security teams often respond by scrambling, presenting existing dashboards, risk registers, or threat reports. However, as Bruggink points out, these responses often fail to satisfy executives, who "smell uncertainty" and are less interested in Excel files than in understanding "what happens if things change" and "how do we prepare for that future?" This disconnect frequently leads to frustration, anger, and, ultimately, a perception that security efforts are not yielding sufficient value, potentially resulting in budget cuts or stalled team expansion despite persistent threats.

Bruggink attributes this systemic failure to several fundamental issues. Firstly, cybersecurity is often mistakenly treated as a complicated problem, where solutions are sought by breaking down an attack chain (e.g., "attack technique X"). In reality, organizational cybersecurity operates within a complex system, where interconnected elements and emergent behaviors mean that simple, linear solutions are often inadequate. Secondly, there's a significant misalignment in time horizons: CTI practitioners typically focus on immediate threats (days, weeks), while business leaders operate on much longer strategic timescales. This temporal mismatch hinders effective communication and strategic planning.

Furthermore, the industry's ingrained reliance on inductive reasoning exacerbates the problem. Inductive reasoning, starting from observations to form hypotheses and theories (common in incident response and security operations), is ill-suited for anticipating future scenarios. Strategic foresight, by contrast, requires deductive reasoning, which begins with a focal question or potential future and then explores associated patterns and implications. The entire cybersecurity industry, Bruggink argues, is "primed towards inductive thinking," making it challenging for teams to naturally adopt a forward-looking stance. Finally, he notes that CTI's value is often "long-tail," meaning its preventative impact isn't immediately visible, leading to a lack of incentives for future-oriented work and a tendency to view cybersecurity as a game of "chess" (perfect, predictable moves) rather than "poker" (imperfect information, playing the odds). To overcome these challenges, Bruggink suggests drawing inspiration from established methodologies like Structured Analytical Techniques (SATs), long used by the intelligence community, and even military planning processes, which have refined approaches to dealing with uncertainty over decades.

Key Findings

▶ Watch: Cybersecurity as a complex system, not complicated (10:00)

Bruggink's talk delivers several key findings that challenge conventional CTI practices and propose a more effective path forward:

• Three Drivers for Future Thinking: He identifies three primary reasons why organizations engage in future-oriented thinking:

1. Demand: Executives or colleagues explicitly request predictive insights, often coming from backgrounds where foresight is incentivized.
2. Regulatory Compliance: Emerging regulations, particularly in the EU (e.g., DORA and NISTU), increasingly mandate robust threat and risk management, creating a compelling opportunity for CTI professionals to lean into foresight.
3. Ambition: Some teams are intrinsically motivated to look further into the future, recognizing it as the right thing to do and investing resources accordingly.

• Cybersecurity as a Complex System: A critical insight is distinguishing between complicated and complex systems. Bruggink asserts that while a machine is complicated, an organization's behavior is complex, with interconnected elements where everything affects everything else. Treating cybersecurity as merely complicated (e.g., fixing an attack chain) while ignoring its complex organizational context (e.g., staffing, alignment) leads to ineffective outcomes.
• A Distilled Decision-Making Framework: Drawing from military planning, Bruggink and his team have distilled complex methodologies into a seven-step process for scenario planning. While the specific steps are not detailed in the talk, this framework provides a structured approach for guiding teams through the journey of answering strategic business questions about future threats. He emphasizes that organizations should adapt or create their own workflow, using this as a proven starting point.
• The Primacy of Business Objectives in Communication: CTI teams often start with the "threat" (e.g., "MPM problem," "ransomware cluster"), but executives "don't care" unless it's articulated in their language. The key finding is that effective communication begins not with the threat, but with the business objective and its relevance to them, outlining what actions can be taken to prevent future impacts.
• Layered Communication for Diverse Audiences: Communicating complex issues like supply chain risk requires different "layers of content" and technical detail. Bruggink advocates for creating trust at each organizational level by providing varying levels of visualization and technical depth, from high-level strategic overviews to detailed technical procedures.
• Incentivizing Foresight: Future-oriented work often lacks immediate incentives, as its value is "long-tail." Bruggink advises starting small, demonstrating tangible outcomes, and creating "small incentives" to encourage business stakeholders to invest in broader scenario planning exercises.
• Shift from Inductive to Deductive Reasoning: A profound finding is the inherent bias towards inductive reasoning (observation → pattern → hypothesis → theory) in the cybersecurity industry. For effective future thinking, CTI must cultivate deductive reasoning (focal question → potential outcomes → associated patterns). This shift is crucial for proactive threat intelligence.
• CTI as Poker, Not Chess: Recognizing that cybersecurity operates in an "imperfect world" with numerous potential threats and limited resources, Bruggink argues that CTI should be approached like poker, where one plays the "hand that is given us" with imperfect information, rather than chess, which assumes perfect information and predictable outcomes. The goal is to explore options and decide "where are we going to put our chips in."

Technical Deep Dive

▶ Watch: AI's impact: humans trust vetted processes (16:00)

Bruggink's talk, while focused on strategic decision-making, delves into several technical and methodological underpinnings that enable effective scenario planning. A core tenet is the application of systems thinking, specifically differentiating between complicated and complex systems. A complicated system, like a machine, can be understood by breaking it down into its parts; the whole is the sum of its parts. A complex system, such as an organization or a global supply chain, exhibits emergent properties, where the interactions between parts create unpredictable outcomes, meaning the whole is greater than the sum of its parts. Bruggink argues that treating cybersecurity as complex, rather than merely complicated, is fundamental to effective decision-making.

The methodology proposed draws heavily from established intelligence practices. Bruggink highlights Structured Analytical Techniques (SATs), used for decades in the intelligence community, as a foundational approach. While he doesn't enumerate specific SATs, he mentions his personal preference for techniques like corner plausibility, which helps explore extreme but plausible future scenarios. He also references the rigorous NATO Special Operations Force planning process as an inspiration for structuring foresight exercises. Recognizing its inherent complexity for typical business environments, his team has distilled this into a more manageable seven-step process designed to guide organizations through scenario planning and advanced threat modeling. This process, taught through workshops, aims to provide a practical framework for addressing strategic questions from business owners and security teams.

In terms of practical application and communication, Bruggink stresses the importance of layered communication. This involves presenting information at varying levels of technical detail to different organizational stakeholders. For executives, high-level visualizations and impact-focused narratives are crucial, while technical teams require granular data and procedural specifics. To facilitate this, he gives a "pro tip" to use Attack Flow, a free and open-source solution for visualizing scenario flows. He notes that Attack Flow is "the least bad one" for this purpose, not just because it makes users "look really really smart," but because its visual nature forces decisions. Non-cybersecurity stakeholders, he explains, can quickly grasp visualized information, enabling them to identify choices and understand the cost implications of different strategic paths.

Finally, Bruggink elaborates on the critical distinction between inductive and deductive reasoning. Inductive reasoning starts with specific observations (e.g., an incident, a threat report) and moves towards broader generalizations or theories. This is the dominant mode in operational cybersecurity (e.g., SOC analysis, incident response). Deductive reasoning, conversely, begins with a general theory or a focal question about the future and then tests specific hypotheses or explores potential patterns. Bruggink asserts that any friction experienced in forward-looking cybersecurity work stems from this clash, as the industry is "primed towards inductive thinking." Shifting to a deductive mindset is key for CTI professionals to effectively explore "what could potentially happen" and proactively plan for it. This also extends to metrics, where he advocates for impact metrics (e.g., "hamster gets out of the cage" – risk avoided) over mere performance metrics (e.g., "how fast the hamster wheel is spinning").

Demo / Proof of Concept

▶ Watch: Inductive vs. deductive reasoning in CTI (22:00)

While the talk did not feature a live technical demonstration or a traditional proof of concept involving code or exploit execution, Gert-Jan Bruggink extensively referenced the practical application of his methodologies. He highlighted that Venation conducts expert-led scenario planning and advanced threat modeling through workshops, such as one held the day before the conference. These workshops serve as the practical "demo" of how their distilled seven-step process, adapted from military planning, helps teams structure their thinking and apply foresight in real-world cybersecurity decision-making. The mention of Attack Flow as a tool for visualizing scenario flows further underscores the practical, hands-on nature of their approach, enabling teams to model and communicate complex cyber scenarios effectively.

Defensive Implications

▶ Watch: Connecting CTI with Business Continuity Management (Q&A) (30:00)

The insights shared by Gert-Jan Bruggink offer profound implications for cybersecurity defenders seeking to enhance their strategic posture and operational effectiveness.

1. Embrace Proactive Scenario Planning: Defenders must shift from a purely reactive stance to one of proactive scenario planning. Instead of just responding to current threats, CTI teams should actively explore "what else could happen," "what does it mean for us," and "what are we doing about it." This involves asking focal questions about potential future events and modeling their impact, moving beyond the "holy moly scramble" when a new threat emerges.
2. Align CTI with Business Objectives: It is crucial for defenders to articulate cybersecurity risks and investments in the language of the business. This means framing threats not just technically, but in terms of their impact on business objectives, patient data, or revenue streams. Starting conversations with "why is this relevant for them" rather than "what is the threat" will secure better engagement and support from executives.
3. Master Layered Communication: Defenders need to develop sophisticated communication strategies, presenting information on different "layers of content" and technical detail. Utilizing tools like Attack Flow can create compelling visualizations that quickly convey complex scenarios and force explicit decision-making, making the impact and cost of different choices clear to non-technical stakeholders. This builds trust across all organizational levels.
4. Leverage Regulatory Compliance as an Opportunity: Regulations like DORA and NISTU should be viewed not as burdens but as strategic opportunities. These mandates for robust threat and risk management provide a strong impetus to implement structured foresight and scenario planning, allowing CTI teams to demonstrate tangible value and secure resources.
5. Cultivate Deductive Reasoning: Security teams, particularly CTI, must actively train themselves to adopt deductive reasoning. This involves starting with potential future states or strategic questions and then working backward to identify patterns and necessary preparations, rather than solely relying on inductive reasoning from past observations. This shift is essential for effective future-proofing.
6. Integrate with Business Continuity Management (BCM): Defenders should actively link CTI insights with Business Continuity Management (BCM) and Business Impact Analysis (BIA). This connection moves organizations beyond "compliance theater" to "practicing resilience." By modeling scenarios and understanding potential impacts, CTI can inform recovery strategies and ensure that investments are made in areas that genuinely enhance an organization's ability to recover from disruptive cyber events, even when suppliers fail.
7. Focus on Impact Metrics: Instead of reporting on operational performance metrics (e.g., number of alerts closed), defenders should prioritize impact metrics. These metrics demonstrate the tangible outcomes of cybersecurity efforts, such as risks avoided, successful recovery capabilities, or improved strategic decision-making, providing a clearer picture of value to business leaders.
8. Start Small and Build Incentives: Recognizing that foresight often lacks immediate incentives, defenders should initiate small, manageable scenario planning exercises. These "spaghetti at the wall" approaches can demonstrate quick wins, build momentum, and create internal incentives for broader adoption of future-oriented cybersecurity practices.
9. Embrace Imperfection and Strategic Resource Allocation: Acknowledge that perfection is unattainable in cybersecurity ("poker, not chess"). Defenders must accept imperfect information and resource constraints, focusing on strategically allocating "chips" to the most critical risks and opportunities based on scenario analysis, rather than striving for exhaustive, but unrealistic, coverage.

Key Takeaways

• Shift from Reactive to Proactive: Cybersecurity decision-making must evolve from a reactive, incident-driven approach to one rooted in proactive scenario planning and strategic foresight to effectively manage uncertainty and executive expectations.
• Embrace Cybersecurity as a Complex System: Recognize that organizational cybersecurity is a complex system, not merely complicated. This necessitates a holistic approach that considers interconnectedness, organizational behavior, and emergent properties, moving beyond simple technical fixes.
• Bridge Communication Gaps: CTI professionals must align their communication with business objectives and time horizons of executives. This involves presenting information in layered formats and using visualization tools like Attack Flow to make complex cyber risks and strategic choices clear and actionable for diverse audiences.
• Adopt Structured Foresight Methodologies: Leverage Structured Analytical Techniques (SATs) and adapt military planning processes into practical, multi-step frameworks for scenario planning. Even small, incentivized initiatives can build momentum for future-oriented work.
• Cultivate Deductive Reasoning: Actively train teams to shift from inductive reasoning (reactive, observation-driven) to deductive reasoning (proactive, focal question-driven) to anticipate and prepare for potential future threats.
• Measure Impact and Build Resilience: Focus on impact metrics that demonstrate risk reduction and strategic value, rather than just performance metrics. Integrate CTI insights with Business Continuity Management (BCM) and Business Impact Analysis (BIA) to move from compliance to demonstrable organizational resilience.

About the Speaker(s)

Gert-Jan Bruggink is the founder and director of Venation, a company dedicated to helping teams with expert-led scenario planning and advanced threat modeling. With over 16 years of experience exploring effective ways to support decision-making processes, Bruggink and his global team at Venation structure and share their research with the community, including through workshops. His work focuses on translating complex foresight methodologies into realistic and applicable strategies for cybersecurity professionals, aiming to combat mediocrity in the field and encourage continuous improvement in strategic thinking.