[DSRP Evidence](https://dsrpevidence.org/)

# Systems Thinking in Cybersecurity: A Conversation with Michael Collins

## Details

**Authors** Cornford, Cole and Collins, Michael

**Year** 2023

**Publisher** Secured (Galah Cyber), episode 20

**Kind of work** media

**Discipline** Cybersecurity

**Secondary disciplines** Business & Management

**Kind of engagement** public

**Applied** false

[Read it](https://www.galahcyber.com.au/podcasts/michael-collins/)

## In authors' words

### What they set out to do (purpose)

An interview with Michael Collins, then Chief Information Security Officer at Judo Bank, covering how he moved from a technical role into a CISO position and how systems thinking shapes the way he leads a security function and speaks to the rest of the business.

### How they did it (methods)

A roughly 45-minute recorded conversation hosted by Cole Cornford, published with a full transcript and a timestamped topic list. The DSRP segment runs from 17:40, following an earlier section at 16:30 on how a newcomer should get started in systems thinking. The host's topic list names the framework as "DSRP thinking (Distinctions, Systems, Relationships and Perspectives)" and names the source as "Systems Thinking Made Simple – by Derek Cabrera."

### What they found (results)

Collins presents DSRP as his primary framework and describes the four patterns as rules people already apply constantly without noticing, which is what produces biases such as seeing a problem only from one's own position. He says he arrived at DSRP after working through research on decision-making and cognition, starting from Senge's The Fifth Discipline, and recommends Cabrera's book as the one he would give a newcomer because "it's very simple and easy for understand" where "Often systems thinking is made overly complex and it puts people off." He reports applying the framework to security leadership — "you are consciously and simultaneously applying those four rules to everything you do every minute of every day" — and argues that doing so lets security staff "start conversing in language that they understand" when speaking to executives. He attributes a specific prevalence claim to no source: "almost 98% of people only look at something from their own perspective."

## Commentary

### In short

A bank CISO names DSRP as the framework he works from and explains all four patterns on the record, then describes how he uses them to run a security team and to translate security concerns into business terms. The episode carries a full transcript, with the DSRP segment beginning at 17:40.

### In more detail

This is DSRP arriving in an operational security role rather than in a classroom or a journal. Collins, then CISO at Judo Bank, traces his own route into systems thinking — Senge first, then work on decision-making and cognition, then the Cabreras — and settles on DSRP as what he actually uses, recommending Systems Thinking Made Simple as the book he would hand to a newcomer specifically because the four rules are stated simply enough to survive contact with practitioners. His account of the patterns is accurate and unembellished. Distinctions he describes as understanding "what the boundaries are, what you include and what you exclude." Systems he puts as "understanding the parts of the whole, and also that the whole could be part of another larger whole" — the nesting claim, stated correctly rather than reduced to decomposition. Relationships he gives as "for every relationship there's an action and a reaction," the action-reaction elements rather than a vague notion of connectedness. Perspectives he frames as the point-and-view structure and its consequence: "we see things from our own position, we have biases, we think we're right." The applications he describes draw mostly on relationships and perspectives. He asks his team to nominate an area of the business to invite in and present "Here's what we do, this is why we do it, here's how we do it," which is perspective-taking built into a team routine rather than a one-off exercise. He describes "building relationships before you need them, and being curious about what the business does" as the relationship pattern applied to a CISO's standing in an organization. His risk conversations use a waterline framing — "is this going to be below the waterline or above the waterline?" — and he argues the four rules are what let a security function speak in terms the business can act on. In a leadership talk he recounts, he uses ant colonies to argue that culture emerges from simple rules followed by many agents rather than from a single leader. The episode documents a senior practitioner treating the four patterns as a working habit and saying so in detail, with the host's topic list pointing listeners to the source.

### Response

Collins gets the content of all four patterns right, including the two that are most often garbled in secondhand accounts: he states the nesting claim for Systems rather than flattening it into decomposition, and he gives Relationships its action and reaction elements rather than treating a relationship as a line between two things. His framing of DSRP as rules already in constant use, with bias as the consequence of applying them unreflectively, matches what the theory claims about them. One figure should be read with care. The claim that almost 98% of people look at something only from their own perspective is offered without a source and does not come from the DSRP literature. The Cabreras' measurement work does report that Perspectives is the least-used pattern by a wide margin in observed thinking activity.

**Patterns it shows** D, S, R, P

**Added** 2026-10-20

**How to cite this** Cornford, Cole and Collins, Michael (2023). Systems Thinking in Cybersecurity: A Conversation with Michael Collins. Secured (Galah Cyber), episode 20.