[DSRP Evidence](https://dsrpevidence.org/)

# Systems Thinking for Cybersecurity: A Reality Based Approach

## Details

**Authors** Collins M

**Year** 2025

**Publisher** Journal of Systems Thinking 5(1):1-16

**Kind of work** article

**Discipline** Cybersecurity

**Reading level** intermediate

**Kind of engagement** scholarly

[Read it at the publisher](https://doi.org/10.54120/jost.2025-000052MC) 
10.54120/jost.2025-000052MC

## In authors' words

### Abstract

The effectiveness of our current cybersecurity strategies, characterised by escalating financial expenditures and excessive dependence on technological solutions, is being challenged. The lack of corresponding improvement in outcomes suggests a paradigm shift in how we approach cybersecurity is required. Furthermore, the cybersecurity curriculum has been centered on building technical skills, with very little emphasis on teaching cognitive skills, or "how" to think about cybersecurity. Despite being advocated as a remedy for the complex challenges of cybersecurity, systems thinking has largely fallen short of fulfilling all of its promises. This paper aims to bridge the gap by proposing a path forward that incorporates theory and practice, underpinned by extensive empirical evidence. When implemented by cybersecurity practitioners, this approach can reduce the competitive advantage of attackers by better organizing information to make sense of the complex world in which they operate. This effectiveness of this approach stems from its ability to offer practitioners a more accessible and effective approach to thinking in cybersecurity. This reality-centric paradigm advocates an adaptive approach to cybersecurity, moving away from static, belief-based approaches and towards methods based on empirical evidence and practical experience. It emphasizes the importance of continuous learning, adaptation, and the willingness to adjust our understanding in the face of evolving threats, reducing our reliance on increasing expenditures for tools and technologies, a cycle that is now spiraling out of control rather than producing better results.

### What they set out to do (purpose)

A paper arguing that cybersecurity education overweights technical skill and underweights how to think, and proposing a systems thinking (DSRP) path that joins theory, practice, and empirical evidence.

### What they found (results)

A reality-centric, adaptive approach — continuous learning and better organization of information — can reduce attackers' advantage, in place of the spiralling spend on tools and technologies.

## Commentary

### In short

Argues that cybersecurity needs a systems thinking approach that teaches how to think, not only technical skills.

### Response

Argues cybersecurity education overweights technical skill and underweights how to think, and proposes DSRP as the route to joining theory, practice and evidence in the field.

## Questions it bears on

- Q28. [Does improving mental fitness improve outcomes?](https://dsrpevidence.org/question/fitness-improves-outcomes)

**How to cite this** Collins M (2025). Systems Thinking for Cybersecurity: A Reality Based Approach. Journal of Systems Thinking 5(1):1-16.