Is it safe to say that you are not a believer of “Business as usual”?
Rayna Stamboliyska: “No, I find it rather terrifying. But it is in the human nature to stick to what we know. However, in today’s world, this approach is no longer sustainable. The pace of change is too rapid, and the forces shaping our future are too unpredictable. To illustrate this point, let’s look at a historical example. In the 1960s, Shell, a leading fossil fuel company, embarked on the so-called Long Range Project. They began to consider potential geopolitical and economic disruptions that could significantly impact their business. At a time when oil supplies seemed endless, discussing the end of oil reserves or surging oil prices was considered ludicrous. Yet, Shell persevered and developed scenarios addressing probable futures. One of these scenarios explored the impact of an oil price surge. In the early 1970s, the well-known oil crisis erupted, and oil prices quadrupled. While the rest of the world scrambled to react, Shell was prepared.
As the architect of modern futures thinking, Alvin Toffler, put it in his book Future Shock back in 1960: “In dealing with the future, it’s more important to be imaginative than to be right”. We must embrace unfamiliar and even conflicting visions of what may happen, keep an open mind, and accept that business as usual is no longer a viable strategy.
Why do you believe it is important to care about the future?
Rayna Stamboliyska: “The need to care about the future extends beyond corporate strategy. It impacts our daily lives. Consider the generational differences in the workplace. For the first time in human history, we have five generations working side-by-side. This presents tremendous challenges in communication, collaboration, and understanding.
Just as we navigate generational differences, we must also navigate the broader societal and global changes after a window of great growth and peace, especially in Europe. We are witnessing an exponential increase in geopolitical mutations, technological innovation, and regulatory complexity. These factors interact, resulting in a world where nothing is certain, and much is beyond our control.
This situation of deep uncertainty challenges decision-makers at all levels. Traditional approaches, relying on past data and risk assessments, are no longer sufficient. We need new tools and techniques to navigate this complex landscape.”
In your presentation, you referred to the movie and book ‘Dune’ to illustrate the way we should look at the future.
Rayna Stamboliyska: “Indeed. In Frank Herbert’s renowned science fiction novel Dune, the story unfolds in a galaxy that has experienced a technological apocalypse. Interstellar travel, trade, and life itself depend on a precious substance called “the spice.” The spice, found only on the desert planet of Arrakis (Dune), enhances the human mind and enables prescience – the ability to see the future.
When the Atreides family is sent to govern Arrakis, they are betrayed, and the young son, Paul, is left to die in the desert. However, Paul survives by embracing chaos and using his developing so-called prescience: the spice opens his consciousness, allowing him to see different visions of the future. He uses these visions, contradictory and partial as they may be, to plot a path forward and ultimately take control of the planet. In other words, Paul turns his contradictory, incomplete visions into strategic assets and accepts that there are many plausible futures. The key takeaway here is that the future is not predetermined, and that agency does not lie with predictions. Instead, the future is a landscape of possibilities that we can influence and shape.”
So how do we navigate this landscape of possibilities?
Rayna Stamboliyska: “Good question. How do we learn to think like Dune’s Paul Atreides? How do we cultivate the ability to see the future and make decisions based on that? The answer lies in strategic foresight. Strategic foresight is a discipline that provides a structured approach to thinking about the future. It’s not about predicting the future with certainty, which is impossible, but about understanding the range of possibilities and preparing for them. So, instead of identifying a few desired future scenarios based on specific preset conditions and assets, we would look at a wide range of scenarios and chart a strategy that performs well enough across many of these. Thus, we stop trying to predict future conditions and focus on ways forward that resist changes in external circumstances.”
This requires a certain mindset, for sure?
Rayna Stamboliyska: “It does, and developing a foresight mindset requires several key attributes. First, we need to be curious. We need to be open to new ideas and new ways of thinking and doing. We also need to be willing to challenge our assumptions and to question the status quo, however uncomfortable that is. Next, we need to be willing to experiment and to learn from our mistakes. And finally, we need to be willing to collaborate with others, to share our ideas and our insights and listen to others.”
How can strategic foresight be used?
Rayna Stamboliyska: “It can support developing strategies. To identify the goals that we want to achieve and to develop plans to achieve those goals. Implicitly, you can use it to make robust decisions, to evaluate different options and to choose the most adequate course of action. And lastly, it can be used to innovate. To identify new opportunities and to develop new products and services.”
What are the tools and techniques used to support strategic foresight?
Rayna Stamboliyska: “Several tools and techniques can aid in strategic foresight. One of the most common is Scenario Planning. As exemplified by Shell, this involves developing different plausible scenarios of the future and analysing their potential impact. Another one is Trend Analysis or identifying patterns of change over time and analysing their potential impact. And finally, I would like to highlight a favourite, often called “How To, What If”. It is a combination of back-casting and fore-casting, that is, you define several realities you’d like to reach, then work backwards to identify chains of events that need to occur to make that reality happen. Then comes the fore-casting: what would be chains of consequences if that reality came to be? I use this one with clients and students alike.
Can you highlight some of the challenges and benefits of strategic foresight?
Rayna Stamboliyska: While strategic foresight offers significant benefits, it also presents challenges. We all have biases that can cloud our judgment, and strategic foresight requires time, effort, and resources. However, the benefits of strategic foresight far outweigh the challenges. It enables us to make more sustainable decisions, identify opportunities, foster innovation, and build resilience.
How can you use strategic foresight in cyber security?
Rayna Stamboliyska: “Let us take the example of the implementation of NIS2, which is a requirement for many companies throughout Europe. So, within this framework, how can businesses create a long-term strategy that is robust enough to anticipate heterogeneous transpositions across the EU, requirements for incident notifications in 24 languages and wildly diverging maturity levels? I have been working with a client to support building a robust implementation strategy for NIS2 and embed resilience into governance structures. In this particular case, we used the Dune analogy I talked about earlier to develop a game which we used to stress-test the client’s NIS2 approaches and converge towards a robust strategy.
Tell us more about this game…
Rayna Stamboliyska: “We modelled a game on strategic foresight. This company has specific challenges: heterogeneous NIS2 transpositions in the 10 countries they operate, challenging incident reporting, and a complex supply chain. The game starts with defining the uncertainties: for instance, heterogeneous transpositions. These are elements beyond your control. Next, you identify so-called levers, or all the things you can do to act within the given context to address uncertainties. For the challenge of the diverging transpositions, the levers could be either to harmonise compliance or tailor it by country. The next step is to develop the relationships between the uncertainty and the different levers. In this case, this was either a harmonised approach towards NIS2 by establishing a transborder governance group and monitoring the requirements, or else let each country handle it on their own and do no monitoring. The final part of the game is to define metrics for each of these pathways or storylines. By playing the game, you can come up with a strategy that offers the most resilient approach.”
Lots to think about. Any final thoughts to share with the cyber security audience?
Rayna Stamboliyska: “I tend to say that we are all migrants to the future. When you go to another country you see that things are different than in your own. It does not mean that one is better than the other. You cannot anticipate everything and that is fine. On the other hand, you cannot let aversity to change lead to paralysis and not do anything. By embracing a foresight mindset, utilising appropriate tools and techniques, and fostering a culture of continuous learning, we can navigate uncertainty, make informed decisions, and shape a more resilient future. And let us as technologists never forget that what we do in cyber, we do for people. So, whenever we design systems, we should always remember that those systems must serve the people, not the technology.”
