We (in this usage, the planetary we) are now beset with various richly controversial examples of risk. They range from the merely large to the truly gargantuan: from the ongoing dissection of the space shuttle Columbia disaster and the Rhode Island nightclub fire (both of which may, in varying degrees, come down to a matter of risk assessment gone wrong) to the colossal geopolitical menaces that now hunker in the daily consciousness like a tribe of pre-rampage Godzillas. Since this magazine’s topic, writ large, is risk, it seems fitting to consider a sometimes unacknowledged reality: Godzilla-class risks resist easy assessment.Reasonable people around the globe can be heard today disagreeing wildly about which constitutes the greatest risk: attacking Iraq or not attacking Iraq. As it happens, the debate may turn out to have little bearing on what actually happens. But on both sides are marshaled compelling arguments about the causal chains of disastrous or beneficial outcomes likely to ensue in each instance. On the one hand, aggressive unilateralist American intervention may trigger waves of terrorism that menace domestic security for years to come. On the other hand, equivocation, inaction and appeasement may allow tyranny to grow unchecked, sowing the seeds of escalating evil down the road. The situation of growing tensions with North Korea presents the same sort of brew of perplexing variables, all swirling around the choice between “rewarding bad behavior” and “failing to engage in a constructive dialogue.”Risk assessment is in part an outgrowth of policy. If your policy is that you never reward bad behavior, then failing to engage in constructive dialogue will fall to a lower rung on the risk ladder. But, as I wrote in an earlier column, good risk assessment requires, in addition to policy and data, an active imagination. You have to be able to walk down the if-then path with open eyes and an open mind. If policy or other considerations cause eyes and minds to close, decision making is impaired. Consider the e-mail threads made public in the shuttle disaster investigation. A team of engineers was able to game out scenarios that appear to have been eerily prescient in describing the shuttle’s breakup before it happened. But did a rigid belief in only the most optimistic cooling-tile damage assessments preclude those scenarios getting their due?An article in the April Atlantic Monthly explores President Bush’s decision-making process and finds it to be lamentably low on imagination. If imagination is the row of open windows interposed between a complex decision and its possible outcomes, no decision should ever be made without taking a look out each of those windows. As you will read in our own cover story profiling Dennis Treece, the director of corporate security for the Massachusetts Port Authority, one of his quests is to find ways of bringing more and better data to bear on evaluations of risk (see “Safe Harbor”). But Treece relies on more than data. He also turns his vivid imagination on every source of potential vulnerability that falls within his domain (Logan Airport’s unprotected beach especially irks him). Only by imagining the worst that could happen can Treece comfortably hope for the best. At this moment of elevated global risk, we hope that Mr. Bush has likewise exercised his imagination, picturing a world pitched headlong into concatenating, uncontrollable catastrophes.PS: The medallion on our cover represents bragging rights conferred on CSO by American Business Media, which honored us with the 2003 Jesse H. Neal Award as “Best Start-Up Publication.” We are pleased to have the validation of our peers in the business press, who recognized the importance of our mission and our audience. Related content feature Top cybersecurity M&A deals for 2023 Fears of recession, rising interest rates, mass tech layoffs, and conservative spending trends are likely to make dealmakers cautious, but an ever-increasing need to defend against bigger and faster attacks will likely keep M&A activity steady in By CSO Staff Sep 22, 2023 24 mins Mergers and Acquisitions Mergers and Acquisitions Mergers and Acquisitions brandpost Unmasking ransomware threat clusters: Why it matters to defenders Similar patterns of behavior among ransomware treat groups can help security teams better understand and prepare for attacks By Joan Goodchild Sep 21, 2023 3 mins Cybercrime news analysis China’s offensive cyber operations support “soft power” agenda in Africa Researchers track Chinese cyber espionage intrusions targeting African industrial sectors. By Michael Hill Sep 21, 2023 5 mins Advanced Persistent Threats Cyberattacks Critical Infrastructure brandpost Proactive OT security requires visibility + prevention You cannot protect your operation by simply watching and waiting. It is essential to have a defense-in-depth approach. By Austen Byers Sep 21, 2023 4 mins Security Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe