ISSA-LA Security Summit 2025

Most security programs today use threat profiling and risk prediction exercises in an attempt to assess the probability and likelihood of a threat impacting the company. However, many programs fail to consider the threat actors’ willingness to take enormous risks for huge gains, and fall victim repeatedly due to a lack of strategic foresight. In this presentation, I argue that we must approach risk and threat defense with the most severe degree of pessimism, imagining the worst-case scenario as plausible. This presentation dives into real-world examples of devastating cyber and physical attacks that few thought could happen. Then we explore the tradecraft behind predicting these “high-impact, low probability” scenarios and how to best prepare and defend against them