Lessons from Black Swan Events and Building Anti-Fragile Cybersecurity Systems

Dave Lewis opens by framing security breaches as black swan events, drawing on Nassim Taleb's idea of rare, high-impact shocks that look obvious in hindsight. He points to recurring failures such as default device credentials behind large botnets, exposed cloud storage, and stale privileged accounts, arguing that many incidents could have been prevented with basic hygiene. He also notes that passwords are only one control, and that MFA, passkeys and extended access management reduce risk without eliminating it.

The middle of the talk covers organizational problems: shadow IT, unused incident response plans, forgotten services with no owner, and a copied policy that had been written for a swimming certification. Lewis describes ransomware trends from 2017 to 2023, including the shift toward smaller suppliers that connect to larger firms, and stresses non-blaming, open communication across finance, HR and other business units.

He closes by urging resilience and anti-fragility: systems that can absorb a hit and improve afterwards, practiced incident response, a dissenting voice on every review team, and realistic expectations about cyber insurance, which does not restore an organization on its own. He also flags caution around AI adoption. Practitioners should take away the need to plan for disruption rather than assume it will not happen.