This week’s newsletter captures my reflections and key insights from Part 2 of my podcast with Glenn Wilson, founder/CTO of Dynaminet.
In this episode, Glenn discusses how cybersecurity programs are often fractured because teams like SOC and AppSec don’t communicate, leading to “random chaos” instead of a recursive, cohesive structure. Using the Viable System Model (VSM), he emphasize managing risk through organizational viability and resilience rather than treating vulnerabilities as isolated problems or compliance checkboxes.
We discuss how some breaches don’t destroy companies (e.g., Marks & Spencer, Equifax) while others do, and suggest studying what enables survival, recovery, and adaptation.
We also critique reductionist “A vs B” tradeoffs like features versus security, referencing John Boyd’s decision effectiveness over speed, and propose learning from Toyota’s Andon Cord to break builds early, fix issues immediately, and prevent vulnerabilities.
A MUST WATCH for Cybersecurity executives and practitioners!
“In a system, the best way to treat a problem is seldom where the problem appears.”
Podcast Video
Members of the Cyb3rSyn Community can watch/discuss the podcast episode on the www.cyb3rsynlabs.com portal or the mobile app (iOS and Android). The video is also on YouTube here 👇🏾
Key Insights and My Reflections
In this episode we dive deep into Glenn’s pre-print paper centered on VSM - please reach out to him directly if you are interested in getting a sneak preview.
In the high-stakes world of enterprise security, we’ve been sold a lie: that if we just buy enough "symptom detectors" - SAST, DAST, scanners, etc., we’ll eventually be safe.
My conversation with Glenn deconstructs why this approach is failing. We aren't just facing a volume problem; we’re facing a structural one. Most security organizations today are what Glenn calls a "fractured system." The SOC is over here, AppSec is over there, and they exist in entirely different universes.
To move from this "random chaos" toward a truly resilient posture, we need to start thinking like cyberneticians.
Here are the key takeaways and my reflections from the conversation.
Table of Contents
Move from "Random Chaos" to Recursive Security
Viability is the Ultimate Bar
Stop "Popping Zits"
The Zero-Sum Fallacy: Speed vs. Security
Build "System 4" Capabilities
Toward the Viable Organization