Collins urges new thinking on cybersecurity decisions

Michael Collins has published Systems Thinking for Cybersecurity, which argues that organisations need to change how they make security decisions.

Collins, a Cybersecurity Executive and Founder of Cyber Cognition, argues that rising spending on security tools has not stemmed the growth in cyber incidents. He contends that many organisations still treat security problems as if they can be broken into separate parts and fixed through linear processes, even though threats now emerge in a more interconnected, fast-moving environment.

The book sets out what Collins describes as simple rules for handling complexity in cybersecurity. It is aimed at Chief Information Security Officers, Chief Information Officers, security practitioners, and risk and audit professionals involved in security oversight.

One of its central arguments is that technical training alone does not prepare security professionals for the practical judgement complex situations require. Collins argues that the harder task is often deciding what a situation means, which signals matter, and what response is appropriate when data, alerts, and competing pressures build up.

The argument comes as security budgets continue to rise. The book cites Gartner projections that global end-user information security spending reached USD $213 billion in 2025, up from USD $193 billion in 2024, with a further 12.5 per cent increase forecast for 2026. Over roughly the same period, Cybersecurity Ventures projected global cybercrime losses of USD $10.5 trillion for 2025.

Collins uses those figures to support his case that higher spending does not automatically produce better outcomes. He argues that organisations often respond to pressure by adding another tool, dashboard, or audit process, leaving practitioners with growing volumes of information but no better framework for interpreting it.

Beyond Root Cause

A significant section of the book focuses on incident reviews and organisational learning. Collins challenges investigations that stop at a single root cause or blame the individual closest to the failure.

He argues that focusing only on a person can obscure the broader conditions surrounding a decision, including deadline pressure, limited staffing, awkward processes, and the incentives that shape behaviour. In this view, a security mistake is not only a matter of individual judgement but also a product of the wider system in which that person operates.

The book urges leaders to examine patterns, structures, and assumptions before settling on conclusions about fault. Collins presents this as a way to understand why similar incidents recur even after reviews and remedial action.

He also challenges fear-based purchasing decisions in cybersecurity. The book argues that leaders should test such claims against evidence and against the specific circumstances of their own organisation, rather than assuming every threat or product warning justifies another investment.

Shared Accountability

Another theme is governance. Collins argues that cybersecurity should not be left solely to the Chief Information Security Officer or the security team, because outcomes depend on relationships and decisions across the organisation.

He says this narrow ownership model allows silos to form between security and other business functions, and between the CISO and the broader executive group. The alternative, he argues, is to make cybersecurity part of the company scorecard so boards and executives share responsibility for outcomes.

As an example, the book points to Qantas, which reduced the scorecard outcomes of its Chief Executive Officer and executive team by 15 percentage points after a 2025 third-party platform incident exposed six million customer records. Collins presents the case as an example of cybersecurity being treated as an executive accountability issue rather than a specialist technical matter.

The book also examines how legal and regulatory judgments shape views of security performance. Collins refers to the Federal Court of Australia's decision to fine FIIG Securities AUD $2.5 million after a breach exposed client data on the dark web.

He uses the case to underline the distinction between unreasonable security and imperfect security. As cited in the book, the court stated that the legal standard does not require perfection and that the fact of a successful attack does not in itself prove inadequate security.

That point feeds into Collins's broader criticism of binary questions about whether an organisation is secure or not. He argues that security should instead be assessed in context and judged on whether decisions and controls were reasonable in the circumstances.

Collins has held senior security roles including CISO at Judo Bank and General Manager Information Security at HESTA. He also designed SC3, the Australian superannuation sector framework for coordinating cyber defences. His work draws on systems thinking research developed over decades at Cornell University and applied across sectors including healthcare, government, education, and infrastructure.

In one of the book's central statements, Collins says the sector needs to rethink its habits rather than simply add more process. "The field of cybersecurity doesn't need more frameworks. It needs better thinking. And better thinking, it turns out, can be learned," said Collins, Founder of Cyber Cognition.

He presents the book as an attempt to bring that approach directly into cybersecurity leadership and practice. "A stable system is a fragile one, and the resilience we're really after in cybersecurity comes from adapting continuously, not from holding a fixed position," Collins said.