Should Cybersecurity Views and Decisions Be Subjective or Objective?

In today’s digitally connected world, cybersecurity has become a critical concern for organizations of all sizes. From critical enterprises safeguarding sensitive data to startups navigating innovative tech landscapes, decision-making in cybersecurity is both complex and consequential. A key question arises: should these decisions be driven by objective data, established standards, and measurable outcomes, or should they be shaped by subjective judgment, informed by experience, intuition, and specific business contexts? This debate is more than theoretical—it directly impacts how effectively risks are managed and how resilient an organization can be against cyber threats. In this article, we’ll explore the merits of both objective and subjective approaches to cybersecurity decision-making, using specific case studies and examining the ethical and bias-related implications of subjective views. I’ll argue that the most effective strategies often lie in finding the right balance between the two.

Objective Views and Decisions in Cybersecurity

Cybersecurity traditionally emphasizes objective decision-making, which relies on hard data, measurable outcomes, and standardized frameworks. Objective views are important for maintaining a consistent and predictable approach to security.

Benefits of Objective Decision-Making:

1. Consistency and Transparency: Objective views promote consistency (and repeatability) across organizations by ensuring that the same standards and policies are applied uniformly. This approach allows for transparency, as decisions can be traced back to verifiable metrics, such as incident response times, system vulnerabilities, or compliance scores.
2. Data-Driven Insights: Security monitoring tools, vulnerability scanners, cyber threat intelligence, and risk assessments provide actionable data that inform objective decisions. For example, metrics such as patching cycle times, the number of open security incidents, or phishing email response rates offer clear insights into a company’s security hygiene and health.
3. Compliance and Standards: Regulatory frameworks like GDPR, HIPAA, SAMA CSF, NCA ECC, and ISO/IEC 27001 promote objective cybersecurity measures by mandating specific protocols and benchmarks. These frameworks ensure that risk management decisions align with legal obligations, which makes it easier to demonstrate compliance during audits or legal investigations.
4. Predictive Modeling and Threat Intelligence: Predictive analytics and threat intelligence platforms rely on historical attack data and pattern recognition to estimate potential threats. Objective decisions, informed by these insights, help organizations proactively defend against emerging attacks.

However, a strictly objective approach may be insufficient when addressing the full complexity of cybersecurity.

The Role of Subjective Views in Cybersecurity

While objective data and frameworks are invaluable, subjective decision-making often plays a pivotal role in handling unknown or unquantifiable risks. Cybersecurity professionals must frequently make judgment calls based on incomplete information, and experience becomes a critical asset in these scenarios.

Benefits of Subjective Decision-Making:

1.????? Context-Specific Adaptability: No two organizations face identical cybersecurity challenges. A subjective approach allows security leaders to adapt strategies to the unique needs, environments, and priorities of their organization.

2.?????Experience and Expertise: Cybersecurity professionals bring years of experience and intuition to their roles. These subjective insights enable them to make quick, informed decisions in ambiguous or fast-moving situations. This can be illustrated by a personal experience of mine: I was once tasked with making a critical decision where the available data wasn’t sufficient to clearly point in any direction. After an extensive discussion about the possible consequences of each path, my manager asked me, "How do you feel about those directions? What do your guts tell you?" At that moment, I realized that beyond the objective assessments, trusting my instincts was vital. I made a decision based on those feelings, and it turned out to be the most fitting choice with the desired positive outcomes.

The Ethical Implications of Subjective Decision-Making

While subjective decision-making can offer valuable insights and flexibility, it also raises significant ethical concerns. One key concern is the potential for bias. When decisions are based on intuition or personal experience, there is a risk that unconscious biases can influence the outcome. For example, a security team might prioritize certain types of threats over others based on recent high-profile attacks, even if objective data suggests that other vulnerabilities pose a greater risk.

Another ethical concern is the potential for disparate impact. Subjective decision-making can lead to inconsistent or unfair treatment of different groups. For example, if a financial institution uses a subjective approach to evaluate which customer accounts to flag for fraud prevention, unconscious biases could lead to unfair targeting of certain demographics.

In high-stakes environments, like critical infrastructure or healthcare, decisions based on gut feelings without supporting data could endanger lives or lead to catastrophic financial losses. The ethical responsibility for cybersecurity professionals, therefore, is to balance subjective judgment with objective facts to ensure decisions are made in the best interest of all stakeholders.

Addressing the Potential for Bias in Subjective Decision-Making

One of the significant risks of subjective decision-making is the introduction of bias. While objective data is not immune to bias, subjective judgments are particularly vulnerable to cognitive biases such as confirmation bias, where decision-makers may seek out information that confirms their pre-existing beliefs, or availability bias, where recent experiences disproportionately influence decisions. (Read this article about How do Cognitive Biases Affect Cybersecurity? ).

In cybersecurity, bias can manifest in several ways. For example, a security team might prioritize certain types of threats over others based on recent high-profile attacks, even if the objective data suggests that other vulnerabilities pose a greater risk. Similarly, decision-makers may overlook critical risks because they align too closely with familiar situations where they’ve seen success, leading to overconfidence in their instincts.

Mitigating Bias in Cybersecurity Decisions

To minimize bias, cybersecurity professionals can use structured frameworks and decision-making models that incorporate both objective data and subjective insights. Encouraging diverse viewpoints, building teams with a variety of backgrounds and experiences, and fostering a culture where dissenting opinions are valued can also reduce the risk of bias. Regular audits of decision-making processes—comparing subjective decisions with objective outcomes—can help organizations identify patterns of bias and correct them before they become systemic issues.

Emerging Trends and Their Impact on Cybersecurity Decision-Making

Several emerging trends are significantly impacting the way cybersecurity decisions are made:

• Artificial Intelligence (AI): AI is being used (certainly has a greater potential) to automate many aspects of cybersecurity, including threat detection, incident response, cyber threat intelligence and vulnerability assessment. While AI can provide valuable insights, it is important to ensure that it is used ethically and responsibly.
• Internet of Things (IoT): The proliferation of IoT devices is creating new attack surfaces and increasing the complexity of cybersecurity. Organizations must develop effective strategies for securing their IoT devices and networks.
• Cloud Computing: The shift to cloud computing has introduced new risks and challenges for cybersecurity. Organizations must ensure that their cloud providers have adequate security measures in place and that they are taking steps to protect their data in the cloud.

These emerging trends are making cybersecurity decision-making more complex and challenging. Organizations must stay informed about these trends and adapt their strategies accordingly.

Conclusion

In cybersecurity and risk management, both subjective and objective views have their roles. Objective decision-making provides consistency, transparency, and alignment with standards, while subjective judgment offers flexibility, adaptability, and the benefit of experience. However, it is crucial to recognize the ethical implications and potential biases inherent in subjective decision-making. An optimal cybersecurity strategy draws from both approaches, ensuring that decisions are grounded in data yet informed by human intuition and expertise. By balancing the two, organizations can create more resilient security postures that not only mitigate risks but also enable growth and innovation in an increasingly digital world.