Security in Uncharted Territory

Security in Uncharted Territory

Every framework for decision-making assumes some baseline of information. You gather the data, you analyze the options, you consider what you know and what you do not know, you apply your judgment, you decide. The assumption buried in that process is that you have enough information to know what you are deciding — that the situation is legible enough, the variables understood well enough, the risk profile clear enough that the framework can do useful work. In most business decisions, that assumption holds. Not perfectly — all decision-making involves uncertainty — but adequately. The information needed to make a reasonable call is in principle available if you are willing to do the work to get it. 

Security decisions almost never look like that. The threat actor who has been in your environment for six weeks has not been waiting for you to finish gathering data before making their next move. The breach you are responding to did not come with a briefing document explaining what happened and why. The regulatory guidance you are trying to comply with was written before the technology environment it is supposed to govern actually existed. The risk you are trying to assess is genuinely novel — not a variation on a known pattern but something that has not been seen before, in this combination, in this environment, against this specific target. 

Making good decisions under these conditions is a learnable skill. But it requires a different set of disciplines than the ones that work when information is adequate — and most leaders have spent their careers developing the latter without much systematic attention to the former. 

Why Security Is Structurally Different 

The information deficit in security is not accidental. It is designed in by the adversary. 

A threat actor who is trying to compromise an organization has every incentive to remain invisible for as long as possible. The most effective intrusions are the ones that look like normal network activity right up until the moment they do not. The signals that would allow a security team to identify and respond to an intrusion early are deliberately suppressed, obscured, or mimicked as benign behavior. When something finally becomes visible, it is usually because the attacker has already accomplished what they came to accomplish, or because the detection capability was sophisticated enough to surface something they could not fully hide. 

This is fundamentally different from most of the decision environments that business leaders are trained for. Financial decisions have complete transaction records. Operational decisions have performance data. Hiring decisions have interviews, references, and work samples. These are not perfect information environments — all business decisions involve uncertainty — but they are environments where the relevant information exists and is at least in principle retrievable. Security is an environment where some of the most critical information — what the adversary knows about your environment, what they have already done inside it, how long they have been there, and what they are planning to do next — is not just unavailable but actively concealed from you. The adversary has had time to study your environment. They know where the cameras are and which ones have blind spots. You are making decisions about a situation that the other party understands better than you do, and the gap between their knowledge and yours is not accidental. 

The implication of this is not that security decisions are arbitrary or that analysis is pointless. It is that the decision-making disciplines that work in security are somewhat different from those that work in other domains, and building them requires deliberate attention. 

The Discipline of Calibrated Confidence 

The first and most important discipline for security decision-making under uncertainty is what might be called calibrated confidence: the ability to form a working hypothesis, act on it with appropriate decisiveness, and revise it as new information arrives — without either freezing in the absence of certainty or locking into an early assessment when the evidence moves against it. 

The failure mode in one direction is paralysis: the security team that will not act on an incident because they do not yet have complete confirmation of what is happening. The threat actor who has already been in the environment for three weeks does not care that the security team has not completed their analysis. Every hour of analysis time is an hour of access time for whoever is on the other side. 

The failure mode in the other direction is premature closure: the security team that identifies an early indicator, forms a hypothesis about what it means, and then interprets every subsequent piece of evidence in light of that hypothesis rather than allowing the evidence to update the hypothesis. Premature closure is particularly dangerous in security because the adversary’s ability to mimic benign behavior means that the most dangerous threats are specifically the ones that look like the expected pattern right up until the moment they do not. 

Calibrated confidence sits between these. It means acting on the best current assessment while explicitly treating that assessment as provisional. It means building the decision process around the question not of “what do we know” but “what do we need to know to update our current position, and what are we doing in the meantime.” 

Building Decision Frameworks for Unknown Unknowns 

The particular challenge in security is not just the known unknowns — the things you know you do not know, like the exact scope of a breach you have detected. It is the unknown unknowns: the things you do not know you do not know, like the access the adversary established three months ago that has not yet produced any visible activity. 

Decision frameworks designed for known unknowns work reasonably well. You identify what you are missing, you prioritize getting it, you make provisional decisions while you are getting it. This is standard incident response logic and it can be trained and rehearsed. 

Decision frameworks for unknown unknowns are harder, because you cannot directly reason about something you do not know you are missing. The disciplines that help are indirect. They involve building habits of assumption auditing — periodically asking not “what do we know” but “what are we assuming we know that we have not actually verified.” They involve designing security programs that assume compromise rather than trying to prevent it entirely — operating from the baseline assumption that the environment has been accessed in ways that have not yet been detected, and asking what detection and response capability that assumption requires. They involve stress-testing the mental models that the security team uses to interpret anomalous signals, to ensure that the models are current with how actual threat actors are actually operating rather than how threat actors operated two years ago. 

The Organizational Dimension 

Security decision-making under uncertainty is not only a technical and analytical challenge. It is an organizational one, because the quality of decisions made in conditions of genuine uncertainty is heavily shaped by who is in the room, what authority they have, and what the organizational consequences of being wrong look like. 

Organizations that have done this well tend to share a few structural features. The people with the security expertise to assess a developing situation have clear authority to act on that assessment without having to navigate layers of organizational approval that consume the time window during which action is most valuable. The people at the leadership and board level who are responsible for the organization’s overall risk posture have a direct, current relationship with the security function — they are not learning about developing situations through filtered summaries delivered by people without the security expertise to accurately represent them. And the organizational culture around security decisions treats being wrong in good faith as an acceptable and expected outcome, rather than creating incentives for people to wait for certainty that will never fully arrive. 

The last of these is the hardest to build and the most important. An organization in which the person who made the security call that turned out to be wrong faces professional consequences is an organization that has trained its security team to delay action until certainty arrives — which is to say, until it is too late. Good security decision-making requires the same kind of organizational environment that good general leadership requires: one in which judgment exercised honestly and in good faith is valued over judgment that is withheld to avoid being wrong. 

The Practiced Response Advantage 

One of the most reliable interventions for improving security decision-making under uncertainty is one that does not require better information: practicing the decision process itself before the high-stakes version of it arrives. 

Organizations that have conducted genuine incident response exercises — not tabletop reviews where everyone discusses what they would theoretically do, but simulations that put people through the actual decision sequence under realistic time pressure with realistic information constraints — consistently outperform those that have not when a real incident occurs. Not because the exercise gave them information they would not otherwise have had, but because it gave them practiced familiarity with the discomfort of making consequential calls when the picture is incomplete. 

The decision-making skill that matters in an active incident is not primarily analytical. Analysis is important, but most organizations with a mature security team have adequate analytical capability. What degrades under the pressure of a real incident, and what practice specifically develops, is the ability to maintain clear decision authority, resist the pull of premature closure, communicate current assessments honestly as assessments rather than certainties, and revise position when new evidence warrants revision without losing the thread of what has already been decided and acted on. 

These are skills that can be trained, but they have to be trained before the incident. The organization that first discovers what its decision process looks like under pressure during an actual breach is making that discovery at the worst possible time. The organization that has run through the discomfort of incomplete information and contested judgment in a low-stakes environment has built a capability that is ready when the high-stakes version arrives. 

What the Co-Managed Model Provides 

For organizations that do not have a dedicated internal security function with the depth to build and sustain these decision capabilities, the co-managed model provides something that is often framed as coverage but is more accurately described as expertise under pressure. 

When an anomaly surfaces at 2am on a Friday, the value of having a 24/7 SOC partner is not primarily that someone is watching the screen. It is that the person watching the screen has seen enough volume of genuine incidents and false positives to have developed calibrated confidence — the ability to form a working hypothesis quickly, act on it appropriately, and update it as evidence develops, without either freezing or locking in prematurely. 

That calibration is the product of years of exposure to real incidents across many organizations and environments. It cannot be built by an internal IT team that handles one significant security event every eighteen months, if that. The decision-making quality that a seasoned security partner brings to an ambiguous developing situation is not a function of how good they are at following a process. It is a function of how many times they have had to make these calls before — and what that exposure has taught them about when the anomaly is nothing and when it is the thing you respond to immediately. 

The organizational leaders who understand this tend to describe their security partnership not primarily in terms of the technology it provides but in terms of the judgment they are accessing. Not monitoring, but expertise. Not tools, but calibrated human decision-making available at the moment when calibrated human decision-making is most needed and least available internally. 

The Preparation That Is Always Possible 

Even in the absence of perfect information — which in security means always — there is preparation that is always possible and almost always underinvested in. 

The documentation of what is normal. Before you can detect deviation from baseline, you have to know what baseline looks like. Most organizations do not have a current, detailed picture of what normal network behavior looks like in their specific environment. Building that picture is not glamorous work, but it is foundational to the detection capability that allows security decisions to be based on something other than gut instinct under pressure. 

The pre-commitment to decision authority. The question of who is authorized to do what during an active incident should not be resolved for the first time during an active incident. The organizations that respond well have answered this question in advance: who can take a system offline, who can notify external parties, who can invoke the incident response plan, who is the decision authority when the normal chain of command is unavailable. These decisions should be documented, practiced, and understood by everyone who might be in the chain. 

The honest current-state assessment. Knowing what you do not know is a form of preparation. The organization that has conducted a recent, honest assessment of its detection and response capability — what it can see, what it cannot see, how long it would take to identify various categories of compromise — is better positioned to make good decisions under uncertainty than the organization that assumes it is covered because it has the tools but has not tested whether the tools are working, calibrated, and integrated as assumed. 

Security in uncharted territory does not require perfect information. It never has and it never will. What it requires is the preparation, the practiced discipline, and the organizational structure to make consistently good decisions with the information that is actually available — and the honest acknowledgment that in this domain, that information will always be less complete than you would prefer it to be. 

Tom Glover is Chief Revenue Officer at Responsive Technology Partners, specializing in cybersecurity and risk management. With over 35 years of experience helping organizations navigate the complex intersection of technology and risk, Tom provides practical insights for business leaders facing today’s security challenges.