Decision-Making Under Uncertainty: How Security Leaders Decide Without the Full Picture

Fog Is Part of the Forecast 

Decision-making under uncertainty is not an unusual condition in cybersecurity; it is the environment in which most consequential security decisions are made. A CISO deciding whether to accelerate an investment cannot know exactly which threat will materialize next, a board reviewing ransomware exposure cannot know how well every control will perform under real pressure, and an executive evaluating a critical supplier rarely has complete visibility into everything that could go wrong.

The difficulty is not simply that information is missing. Some of the information that leaders want cannot be measured with the precision they would prefer, while other assumptions may become outdated before the decision has had time to prove itself. Recent research suggests that the more useful goal is therefore not to eliminate uncertainty, but to understand where it sits inside the decision and make sure it is not hidden behind dashboards, risk scores, or numbers that appear more certain than the evidence behind them.

Rule 1: Stop Waiting for the Full Picture 

A 2026 study examined cybersecurity decision-making across strategic, tactical, and operational roles, drawing on interviews with 36 professionals across six organizations, including senior executives, board members, governance specialists, and operational security teams. The researchers describe cybersecurity decisions as being shaped by uncertainty, time pressure, information asymmetry, technical constraints, organizational priorities, and human judgment, all at the same time.

What makes this especially important is that the study identified 23 different factors influencing effective decision-making, ranging from resources, regulation, and organizational structure to risk profile, experience, confidence, teamwork, bias, and cybersecurity posture. More than half of those factors operated across several organizational levels rather than belonging neatly to one team or one decision-maker.

This means a security decision is rarely just a technical response to a technical problem. The same threat can lead to very different choices depending on the organization’s appetite for risk, the maturity of its security program, the experience of the people involved, the resources available, and the consequences the business is prepared to accept. The real question is therefore not simply whether the organization has enough data, but whether leaders understand what is shaping the judgment they are about to make.

More Information Does Not Remove Judgment

It is tempting to imagine that better telemetry, more dashboards, or a more sophisticated risk model will eventually turn cybersecurity into a clean optimization problem, where the organization identifies the threat, calculates the likelihood, measures the impact, and selects the best control. In practice, every one of those steps still depends on interpretation, and interpretation is where uncertainty enters.

The same 2026 study found that professionals rely not only on formal information, but also on experience, awareness, confidence, team dynamics, and their understanding of the wider threat landscape. In other words, data matters enormously, but it does not arrive pre-labeled with the correct decision attached to it.

Rule 2: Do Not Mistake Precision for Certainty 

A 2025 study examined cyber risk management in five multi-billion-dollar organizations through 27 in-depth interviews with cybersecurity professionals, executives, board members, risk managers, and internal auditors. The researchers expected to find mature quantitative risk management in at least some of the organizations they studied, but instead found that many supposedly quantitative approaches still depended heavily on qualitative judgment. 

The authors describe this as a “quantitative veneer”, where numbers create the appearance of rigorous measurement even though the assumptions underneath them remain subjective. Organizations may present risk scores, probability scales, technical metrics, or financial estimates, but the route from raw information to the final number is often far less precise than the result suggests. 

That tension becomes especially visible when organizations attempt to estimate likelihood and consequence. Historical cybersecurity data is limited, attack techniques change quickly, and even when comparable incidents exist, their relevance may fade as architectures, controls, and business dependencies evolve. The study also shows that the consequences of a cyber incident can include downtime, customer loss, reputational damage, legal exposure, regulatory costs, contractual penalties, and other effects that interact rather than add up neatly. 

A Precise Number Can Still Be an Estimate

The danger is not the number itself. Quantification can help leadership compare risks, prioritize investments, and communicate more clearly, but it becomes misleading when precision in presentation is mistaken for certainty in knowledge.

A loss estimate of several million dollars may be useful, yet it still depends on assumptions about the duration of disruption, the effectiveness of current controls, the systems affected, customer behavior, recovery time, and regulatory consequences. A risk score can organize discussion, but it should not end it.

For security leaders, the better question is not simply, “What is the number?” but, “How was this number built, what assumptions support it, and how much would the conclusion change if one of those assumptions moved?”

Rule 3: Data Needs a Human in the Room  

The same study introduces a useful concept for understanding what organizations are actually doing: qualculation – a combination of quantitative analysis and qualitative judgment. Rather than treating numbers and professional judgment as competing approaches, the researchers argue that cyber risk management often requires both because perfect quantification is rarely available.

This is especially important at executive level, where the decision is rarely about a single technical metric. A CISO may have vulnerability counts, patching rates, control maturity scores, threat intelligence, historical incident data, and financial information, yet leadership still has to decide what those signals mean for the organization’s current priorities.

Professional judgment fills the space between evidence and action, but that judgment should not remain invisible. If a recommendation depends on experience, assumptions, or expert interpretation, leadership should be able to see that clearly rather than receive a conclusion that appears mechanically produced.

Make the Reasoning Behind the Number Visible

If a CISO presents a ransomware exposure estimate, the board should understand more than the headline figure. It should know what probability was assumed, which controls were considered effective, what recovery time was used, which business processes were treated as critical, and whether indirect effects such as reputational or regulatory damage were included.

That does not make the decision less rigorous. In many cases, it makes the rigor more visible, because it reveals where the analysis ends and judgment begins.

The strongest decisions are not those in which judgment disappears. They are those in which judgment is explicit enough to be challenged.

Rule 4: Kick the Assumptions and See What Breaks  

Another research from 2025 focuses directly on uncertainty in cybersecurity decision-support models. Their starting point is that cybersecurity metrics, particularly estimates of security-control effectiveness, are inherently imprecise. 

Even a seemingly simple question such as whether a control is effective can be difficult to answer with confidence. A firewall that has never been breached may be highly effective, but it may also have avoided a sophisticated enough attack, while the absence of incidents does not automatically prove that the control will perform equally well against a different threat in the future. 

Instead of assuming one precise value for control effectiveness, the researchers model several possible scenarios and ask how different security decisions perform across them. One of the approaches they examine is minmax regret, which looks for a choice that minimizes how badly the organization could regret that decision if reality turns out differently from what was expected. They also develop a min-product approach designed to reduce risk more consistently across a range of scenarios.

The mathematics is not the most important lesson for executives. The more useful principle is that a security decision should not only be tested under the assumptions that make it look correct.

Ask What Happens When the Assumption Moves

A security investment may appear attractive when the expected control effectiveness is high, the estimated recovery time is short, and the supplier dependency is believed to be manageable. The decision becomes much more revealing when leaders ask what happens if one of those assumptions changes.

Would the investment still make sense if the control delivered only half the expected protection? Would the organization make the same prioritization if recovery took twice as long? Would a supplier still be considered acceptable if the business later discovered that several critical processes depended on it?

The point is not to invent endless worst-case scenarios until no decision feels safe. It is to understand whether the decision remains defensible across several plausible versions of reality rather than only under the one forecast that was used to justify it.

Rule 5: Give Executives Context, Not More Noise

The 2025 cyber risk management study also found a recurring gap between technical teams and senior leadership. Security and IT professionals often hold much deeper technical knowledge, while executives and boards depend on those teams to translate the meaning of that information into something that can support business decisions.

The problem is that more reporting does not automatically close that gap. The organizations in the study often provided leaders with information from different functions, using different metrics, methodologies, and levels of detail, which could make cyber risk reporting more complicated rather than more useful. Executives and boards were often more interested in forward-looking questions: what is changing in the threat landscape, what is happening to peers, and how prepared the organization would be if a similar event occurred.

The board does not need every vulnerability, every control metric, or every technical exception; it needs enough context to understand what those signals mean for the business, where the uncertainty lies, and what decision is actually being requested.

How CISOteria Makes the Mess Make Sense 

CISOteria does not try to eliminate uncertainty from cybersecurity decisions, because that would create exactly the kind of false confidence this post warns against. Instead, it helps make the information behind those decisions more connected, current, and easier to interpret. 

Instead of forcing CISOs to piece together risk, vulnerabilities, compliance, third-party exposure, remediation progress, incidents, and workplans from separate systems and spreadsheets, CISOteria brings them into one operational view. That makes it easier to see how technical findings connect to business impact, who owns the next action, what has changed, and where residual exposure remains. 

The platform also helps bridge the gap between technical evidence and executive decision-making. Current risk, compliance, third-party, and incident data can be translated into board-ready reporting, while risks and vulnerabilities can be connected to business context, priorities, treatment plans, ownership, and remediation progress. 

That does not make the underlying uncertainty disappear. It gives leaders a stronger basis for working with it: a more current picture of the cyber program, clearer connections between evidence and business impact, and less dependence on fragmented reporting that may already be outdated by the time a decision reaches the boardroom. 

Conclusion: The Goal Is Not Certainty 

Decision-making under uncertainty is not a sign that the organization lacks maturity; in cybersecurity, it is often the reality of making consequential choices before the evidence is complete. What matters is whether leaders can separate what is known from what is estimated, recognize where judgment is filling the gaps, and understand how much the decision depends on assumptions that may later prove wrong.

The three studies point in the same direction from different angles. Cybersecurity decisions are shaped by organizational context and human judgment, quantitative risk analysis can create an illusion of certainty when assumptions remain subjective, and stronger decisions are those that remain reasonable across several plausible scenarios rather than only one expected future.

The goal is not to predict the future perfectly, because cybersecurity rarely offers that luxury. It is to make a decision that can be explained, challenged, and revisited when the evidence changes, while remaining clear about why that decision was defensible with the information available at the time.

For Further Reading

This blog post is based on insights and analysis from:

• Dawson, Niamh, et al. “Informed cybersecurity decisions: A synthesis of expert perspectives.” Computers & Security (2026): 104927. 

https://doi.org/10.1016/j.cose.2026.104927 

• Zhang, Yunxiao, and Pasquale Malacaria. “Dealing with uncertainty in cybersecurity decision support.” Computers & Security 148 (2025): 104153. 

https://doi.org/10.1016/j.cose.2024.104153 

• Slapničar, Sergeja, Micheal Axelsen, and Marc Eulerich. “Cyber risk management: an illusion of a risk-based approach.” Journal of Management Control (2025): 1-36. 

https://doi.org/10.1007/s00187-025-00401-z