Dealing With Uncertainty: Scenario Planning for Cybersecurity Decision-Making
summary
Distills decades of theory into a usable 7-step practical framework with templates and facilitator guidance tested in real Venation engagements and workshops, including a rushed 4-hour workshop that proves short sessions underdeliver. Adapts NATO special-operations planning into a simpler process, uses the open-source attack flow visualization to force decisions, and emphasizes impact metrics over activity counts. Shows how to map business objectives to scenarios, align time horizons, and produce choices (e.g., do nothing vs. a ~€500k hard-investment) that executives can act on.
AI-written summary · about
chapters (20)
- 0:00Welcome
- 1:10Panic of uncertainty
- 3:39Improving cybersecurity decisions
- 7:13Scenario planning background
- 8:17Future thinking reasons
- 10:03Complex systems challenges
- 11:27Foresight techniques
- 13:32Seven-step planning process
- 14:35Cybersecurity and business goals
- 16:02Security vs business timeframes
- 17:24Mindset shift in decisions
- 18:49Communicating risks
- 20:35Incentives for future thinking
- 21:59Long-term security value
- 23:23Inductive vs deductive reasoning
- 24:25Cybersecurity as poker
- 26:12Outcomes over budgets
- 27:15Impact metrics focus
- 28:19Clear choices for decisions
- 30:24Closing thoughts
related talks
20mExtreme Cyber Scenario Planning & Fault Tree Analysis
40mTool Time: Building Your Cybersecurity Architecture Planning Toolbox
28mHow to Tell the Right Cyber-Story to Executives and Board Members
32mConfidence in Chaos: Strategies for World-Class Security Operations
44mImproving Cyber Risk Management with Threat Modeling
39mChaos Stack: Designing Layered Tabletop Exercises for Complex Crisis Simulation
45mBuilding Your Roadmap to Cyber Resilience – Five Things You Can Do Today
03mIt starts and ends with you