Dear renegades, mavericks, and deviants,

You’ve probably heard people say this before (and you probably sighed). I heard a version of it twice last month (and yes, I don’t mind sharing that I might have sighed, albeit inwardly)... 

“The problem with using behavioral data is that people are irrational and unpredictable. Which means you can’t use historical data to say anything meaningful about what someone will do next.”

Here’s what I said in response (OK, not quite word-for-word, but words to this effect): 

“You’re right. And you’re asking the wrong question.”

I then expanded on this by explaining that nobody in the business of behavioral security is trying to predict what one person will do next Tuesday (or at any given time, for that matter). Instead, we’re trying to understand what thousands of people tend to do under similar pressures and contexts. And that is an entirely different problem, but one that data (fortuitously) can solve remarkably well. (Data for the win. Not for the first time, and it definitely won’t be the last).

Here’s what it boils down to: The individual is hard to predict, the population is not.

Three analogies you can use to explain this

The abstract argument isn’t always the easiest way to help people understand. Here are three analogies I use in a bid to make the concept clearer (feel free to repurpose them as and when you need):

The actuary: No actuary knows which specific customer will die this year. Yet, the entire insurance industry prices that uncertainty profitably, at scale, every single day. They don’t predict individuals, they understand populations. The individual is a coin flip, the portfolio is not.

The epidemiologist: No public health official predicted exactly who would catch the flu last winter. But they used historical data to model outbreak probability, allocate vaccines, and save lives. The individual is noise, the population is signal.

The weather forecaster: They can’t tell you whether you’ll need an umbrella at 3:47pm on a specific Tuesday three months from now. But they can say with confidence that London in November is wetter than London in July. That’s not a failure of the model, it’s the model working exactly as it should.

Same logic, same principle, different domain.

The line that tends to help people ‘get it’

If you need one sentence to get your message across and stick in the mind, use this one:

“The goal was never to predict individuals. The goal is to reduce the aggregate risk of a population making the wrong choices, by understanding the conditions that make those choices likely.”

And that’s it, that’s the whole argument.

No one is suggesting data turns you into some form of crystal-ball-gazing psychic (if only). But it does help you make better decisions, narrow confidence intervals, and build a more defensible case for where your budget and attention should go.

The alternative (running your program on gut instinct, anecdote, and completion or engagement rates) isn’t humility. It’s actually just a different kind of folly, and one with much worse odds, at that. If you're the only one inside your organization carrying this argument, it doesn’t mean you’re wrong, you're just ahead of the room. And — good news — CybSafe is built for people like you.

Secure the buy-in

If you want help making this case to your colleagues, book some time with me directly here. I'm happy to work through it with you.

— Oz A

P.S. If this argument resonates, share it. The more people in security who understand the difference between individual unpredictability and population-level insight, the better the field gets, and the safer we make the world.

Oz Alashe

CEO and Founder, CybSafe

What did you think of today's email?

Your feedback helps me create better emails for you!

Was this email forwarded to you? Sign up here.