Into the unknown: the need to reframe risk analysis
Andrew C. Simpson · Journal of Cybersecurity · 2024
Abstract In recent years there have been efforts to bring a degree of quantification to the task of security risk analysis. Various arguments in favour of such developments have been offered: ‘checklist’- or ‘tickbox’-based security is insufficiently dynamic; risk matrices are flawed; quantitative approaches must (somehow) be better than qualitative ones; it makes sense to leverage advances in data science, AI, and machine learning in concert with the increasing abundance of data; there is merit in leveraging lessons from economics. While some notes of caution have been offered in the literature (with data availability and quality being prominent concerns), we argue that greater consideration and recognition of the relationship between risk and uncertainty—and, indeed, unawareness—would be of value to the community. In doing so, we look to recent critiques of the prevailing economics orthodoxy before considering potential sources of possible help.