Mental Models to Anticipate the Next Stages of the AI and Cybersecurity Revolution

Sounil Yu frames the talk as a search for ground truth in security, arguing that mental models give practitioners a shared vocabulary for hard questions about AI. He combines several of them: a risk-focused version of the serenity prayer, the Cynefin framework for deciding when to run experiments versus automate, and the DIKW pyramid, which he uses to map familiar data problems onto knowledge problems raised by large language models.

He then applies the models to automation. He recasts the OODA loop as sensing, sense making, decision making and acting, and shows that each stage handed to a machine needs its own controls, with agentic AI requiring controls over decisions. He argues that agent experiments are most valuable for discovering better business processes, and that job losses often follow process redesign rather than AI alone. He compares language models to fast, intuitive thinking and suggests that structured frameworks can supply the slower checking layer, drawing on organizational typologies and a balance of generative, bureaucratic and pathological functions.

He closes by warning that every model is incomplete, so a useful test is whether a claim fits the model at hand. When it does not, either the claim or the model may be wrong. In audience questions he discussed whether a model must want honesty rather than just know it, and where a reasoning layer sits relative to the model. The practical takeaway is to combine a few models to evaluate vendor and AI claims.