[DSRP Evidence](https://dsrpevidence.org/)

# Systems Thinking for Cybersecurity: A Reality Based Approach

Collins M, Journal of Systems Thinking 5(1):1-16, 2025

## Abstract

The effectiveness of our current cybersecurity strategies, characterised by escalating financial expenditures and excessive dependence on technological solutions, is being challenged. The lack of corresponding improvement in outcomes suggests a paradigm shift in how we approach cybersecurity is required. Furthermore, the cybersecurity curriculum has been centered on building technical skills, with very little emphasis on teaching cognitive skills, or "how" to think about cybersecurity. Despite being advocated as a remedy for the complex challenges of cybersecurity, systems thinking has largely fallen short of fulfilling all of its promises. This paper aims to bridge the gap by proposing a path forward that incorporates theory and practice, underpinned by extensive empirical evidence. When implemented by cybersecurity practitioners, this approach can reduce the competitive advantage of attackers by better organizing information to make sense of the complex world in which they operate. This effectiveness of this approach stems from its ability to offer practitioners a more accessible and effective approach to thinking in cybersecurity. This reality-centric paradigm advocates an adaptive approach to cybersecurity, moving away from static, belief-based approaches and towards methods based on empirical evidence and practical experience. It emphasizes the importance of continuous learning, adaptation, and the willingness to adjust our understanding in the face of evolving threats, reducing our reliance on increasing expenditures for tools and technologies, a cycle that is now spiraling out of control rather than producing better results.

## What they found (results)

A reality-centric, adaptive approach — continuous learning and better organization of information — can reduce attackers' advantage, in place of the spiralling spend on tools and technologies.

## Response

Argues cybersecurity education overweights technical skill and underweights how to think, and proposes DSRP as the route to joining theory, practice and evidence in the field.

[Read the paper](https://doi.org/10.54120/jost.2025-000052MC)