One of the things I’ve been thinking about for years, but more acutely now because of the conversations around controlling open source models, is the question of why more bad things don’t happen.
So I’m asking:
Why don’t more bad things happen?
What I’m specifically asking about is the Theory of Constraints analysis of the problem. Meaning, what specific set of controls or friction points stop bad things from being more common, or higher impact.
I think this is foundational to doing security, yet there is virtually no conversation about it in the standard discourse.
As an example, why aren’t there more cyber threat actors?
What stops someone from becoming one? Is it skill? The inability to do the operational side? Moral or ethical restraint?
Ok cool. So let’s say we have a list.
Now here’s the question:
What changes in the world might increase or decrease pressure on one or more of these flow points in a way that materially affects the numbers?
Examples:
What if some significant percentage of mostly ethical developers lose their jobs in countries that don’t have great law enforcement?
What if all the difficulty of running a complex cybercrime operation is reduced by 50%? Or 80%. Or 95%
What if part of that change was making it much harder to trace crimes back to the perpetrator?
In other words, what if AI (and specifically unrestricted open models and shared pre-made crime harnesses) were able to make it 20x easier to do cyber crime without getting caught? Or really any type of remote and tech-enabled organized crime.
And what would happen if that became possible right at the moment that companies are laying off junior developers. And not hiring new ones. And where people coming out of college don’t have great prospects in companies like they used to.
I think this is a powerful way to think about change right now.
Theory of Constraints.
What are the reasons things aren’t worse? Or better?
And how will change X or Y change that calculus?
