Finding the weak spot: Rethinking how we assess control effectiveness

The cyber security industry has always borrowed concepts from other fields. From the military, we use terms like "defence in depth", "kill chains" and "threat actors". From medicine, we borrow terms like "virus" and "triage". When cyber security needed a way to measure itself, it borrowed maturity models like CMMI, which was originally built for software development process improvement. They created a common language, enabled benchmarking, and gave organisations a structured starting point. But they were designed to measure whether processes are repeatable and well-documented, not whether and how controls hold up under pressure. 

This disconnect shows up every time a red team walks into a "mature" environment and finds fundamentals that never held up in practice. The instinct might be to do more red teams. However, red teams were designed to identify existing gaps at a point in time, but they don't give us a systematic way to get ahead of the gaps. So, the question becomes: who has? 

Formula 1 didn't start out with the safety record it has today. Early improvements came only after catastrophic failures, but the sport made a deliberate institutional shift from asking "what happened?" to asking "what conditions made this inevitable?" That shift from reactive investigation to proactive failure condition analysis resulted in fundamental changes to the rules, the car, and the circuit design, which are all changes that continue to prevent accidents to this day. 

Cyber security is overdue for the same shift. Unlike threat modelling or red teaming, "Control Failure Analysis" doesn’t start with the threat actor, but starts with the organisation itself. It asks two questions: what organisational conditions does each control depend on to work, and are those conditions reliably in place? Working through those questions systematically exposes gaps that maturity assessments overlook and red teams find after the fact, which often reveals a whole-of-organisation accountability issue and not just another security team problem. 

This session will provide InfoSec leaders and GRC practitioners with a "failure analysis" approach to strengthen their cyber security programs and expose the broader organisational responsibilities that determine whether security controls work in practice.