Not the monster under the bed
Halloween is built on monsters we already know. The ghost in the attic, the thing under the bed, the shadow behind the door. We check those places because we have already pictured what might be there.
The monsters that truly upend a company are different. They may sit outside the assumptions leaders have thought to test. Nassim Nicholas Taleb called these unexpected, high-impact events black swans, and for leaders in technology and cybersecurity, they are among the scariest creatures of all.
What makes a swan black
For centuries, Europeans assumed every swan was white. In January 1697, Willem de Vlamingh’s expedition recorded black swans at the Swan River in western Australia. Those observations challenged a long-held European belief.
In The Black Swan (2007), Taleb uses that story to describe events with three traits:
- Rarity. They sit outside an observer’s established expectations.
- Extreme impact. When they land, they reshape everything around them.
- Hindsight logic. Afterwards, we explain them as if they were obvious all along.
The third trait is the cruelest. After the event, people may explain it as if it had been predictable all along. Before it, the possibility was easy to dismiss. That illusion of predictability can keep the next black swan hidden.
Three black swans, and the people who had to decide
When an extraordinary crisis lands, standard playbooks may not cover the exact event. What remains is a person, a few minutes, and a decision that cannot wait for certainty.
The fall of the Berlin Wall, November 9, 1989. A confused press conference announced that new travel rules applied immediately, and thousands of East Berliners walked to the border. At the Bornholmer Strasse checkpoint, Harald Jäger and his colleagues faced mounting pressure and unclear instructions. The checkpoint opened that night. History turned on people deciding how to respond before their chain of command had resolved the confusion.
September 11, 2001. The use of hijacked passenger jets as weapons exposed profound gaps in aviation preparedness. At the FAA Command Center, Ben Sliney was on his first day as national operations manager. The FAA first stopped departures nationwide, then directed aircraft already in the air to land at the nearest suitable airport. Thousands of flights were brought safely to the ground amid extraordinary uncertainty.
Fukushima Daiichi, March 2011. The tsunami overwhelmed the plant’s defenses. According to TEPCO’s account, headquarters decided to suspend seawater injection amid uncertainty over approval, but plant manager Masao Yoshida directed the plant to continue. His decision illustrates the responsibility of acting amid an escalating disaster.
Three crises that overwhelmed established expectations, three leaders who acted before certainty existed. Whether each meets Taleb’s strict definition of a black swan depends on whose knowledge and assumptions we examine. Each leader had the authority, or took it, to decide.
Geopolitics: where cyber black swans are born
Most security risk registers look inward: our systems, our vendors, our people. The events that truly blindside a tech company increasingly start somewhere else, in a capital city, a war zone or a stretch of seabed.
About an hour before Russia invaded Ukraine on February 24, 2022, a cyberattack disrupted Viasat’s KA-SAT network. The UK’s National Cyber Security Centre assessed Russia was almost certainly responsible and said the primary target was believed to be Ukraine’s military. Other customers, including wind farms in central Europe, were affected. A dependency had carried the disruption beyond its intended target.
The dependency problem extends to undersea cables, which carry most international data exchanges. Cable damage can have accidental, natural or deliberate causes; damage alone does not establish sabotage or attribution. Sanctions and export controls can restrict access to a supplier, a cloud region or software. A conflict can turn an offshore development team or a data center into an unreachable asset.
For tech leaders, the lesson is uncomfortable: your exposure to geopolitics is set by where your data, vendors, people and infrastructure sit, not by whether you consider your company political. The black swan may not be aimed at you. It only needs to pass through something you depend on.
Planning for what you cannot predict
If a black swan cannot be forecast, planning for one sounds like a contradiction. It is not. The shift is to stop planning for causes and start planning for consequences.
- Plan for impact, not for the event. Nobody can list every possible shock. Every leader can ask what happens if a critical vendor, a cloud region, a country or the network itself disappears tomorrow. The cause will surprise you. The consequence usually will not.
- Settle decision rights in advance. Jäger, Sliney and Yoshida all faced the same question first: am I allowed to decide this? Know who can make the drastic call, at which level, and without waiting for consensus.
- Rehearse what feels impossible. Teams practice the scenarios already on the register. Spend time on the ones that make the room uneasy, especially those triggered from outside the company.
- Keep slack in the system. Backups that sit apart from the main network, a second supplier, people who know how to work without the usual tools. Efficiency removes exactly the margin a black swan consumes.
- Listen to the quiet signals. Black swans often send weak warnings that sound too unlikely to repeat in a meeting. Create space where people can say them without looking alarmist.
The goal is not to see the black swan coming. It is to make sure that when it lands, your people are ready to decide.
Accountability when the unthinkable happens
A black swan tests accountability twice: during the crisis and after it.
During the crisis, someone has to own a decision made with incomplete information. Waiting for certainty is also a decision, and often the most expensive one.
After the crisis, the temptation is to judge every call by its outcome. Former poker champion Annie Duke discusses this as "resulting" in Thinking in Bets. A sound decision can meet a bad outcome, and a reckless one can get lucky. Accountable leaders ask better questions: what did we know, what could we reasonably have known, and how did we decide?
Two habits make those questions answerable. A decision log captures what was known, which options were weighed, and why one was chosen, at the moment it happened. A blameless post incident review then looks at the system rather than hunting for a scapegoat. Boards increasingly want to understand not only what happened, but how leadership decided. Yoshida's story shows the hardest side of accountability: sometimes it means owning a decision your own headquarters did not authorize, and answering for it afterwards.
Check under a different bed
This Halloween, look somewhere new. Not at the threat already sitting on your risk register, but at the assumption nobody in the room questions anymore.
You cannot predict a black swan. You can prepare the people who will face one.
Ceiba Wellness designs immersive experiences for tech leadership teams on incident response, crisis management and decision making under pressure. No slides, no theory for its own sake: real scenarios, real trade offs, and the kind of practice that holds when the plan runs out. Get in touch to bring one to your team.
This is one session within The Ceiba Protocol.