Fragilience - The quantum state of survivable resilience in a world of fragile indifference

Chris Hoff opens by arguing that the security industry leans on words like resilience without defining them clearly. He draws on a regulator scenario where a bank was asked to assume all its controls had failed, and uses it to show how recovery targets and expectations can conflict. He also reviews anti-fragility, the idea that systems can get stronger from stress, and contrasts fragile, robust, resilient and anti-fragile responses.

The middle of the talk covers why he considers security more fragile than it should be. He points to a large number of sensors and tools without decision systems to act on their data, and surveys frameworks including the kill chain, ATT&CK, the NIST framework, threat modeling methods and quantitative risk models. He then introduces Cynefin's simple, complicated, complex and chaotic domains, safety science on human operators, and the reverse Conway's law, before walking through team topologies and how one company reorganized engineering teams around products. He also discusses the cybersecurity poverty line, the DevSecOps label applied without real change, and the punitive culture and militarized language that make security hard to work with.

He closes by urging practitioners to share lessons from incidents, organize teams around the services they deliver, and measure outcomes rather than only attacks stopped. The aim he sets is getting better from stressors, not just staying no worse than before. He presented the talk as a prompt for further discussion rather than a final answer.