System Dynamics in Risk Management: A Primer

The talk introduces system dynamics, a sub-discipline of systems thinking, to information security and risk management audiences. It explains how a system can be described as stocks, flows and feedback loops, with balancing loops constraining behaviour and reinforcing loops driving compounding growth or decline. Leverage points, where a small change produces large effects, are presented as usually non-obvious.

The middle of the session builds a causal loop diagram step by step using a security example that links vulnerabilities, attacks, damage, security budget and defenses. Attendees are shown how to assign positive or negative relationships to each pair of factors, then trace a change around the loop to tell balancing loops from reinforcing ones, with an odd-number-of-negative-signs check as a cross-check. Delays and oscillations are illustrated with an ordering example, and the speaker argues that reacting too quickly to early signals can amplify swings. A stock-and-flow simulation of attacker and defender success is then shown, along with a public climate model whose slider interface is offered as an example of executive-facing output.

The closing advice covers setting model boundaries, interviewing the full range of stakeholders rather than only managers, versioning models as processes change, and documenting the reasoning behind each assumption. Practitioners are encouraged to weigh which leverage points are politically feasible in the short term and which need longer effort. Modeling tools and an introductory textbook were suggested for further study.