Think Like a Poker Player – Don’t Gamble With Your Cybersecurity

Such a mentality can be valuable across all areas of business, but is particularly pertinent when considering cybersecurity. It is all too easy for businesses to underestimate the cyber threat, taking an ‘it won’t happen to me’ approach.

But a report published by secure messaging and collaboration platform Wire, titled ‘Odds of a Bad Bet’, lays bare how the odds are stacked against businesses that take a lax approach to cybersecurity.

According to Wire, the odds of a business avoiding a malware attack in the next year are as “unlikely as pulling the ace of spades from a shuffled deck on one try” – or 2%.

Boeree, who collaborated with Wire on the report, found this statistic striking and attributes it to the low cost for a cybercriminal to fire out malware into the wild, be it via malicious emails or dangerous websites.

“I think that was the one that really made me sit up and listen and be like oh, wow, this is a problem,” she says.

In 2019, a spate of ransomware attacks crippled numerous US cities, including Baltimore, Maryland; Greenville, North Carolina and Texas.

The estimated cost of these attacks spiralled into the tens of millions and has likely exceeded $100m.

According to Wire, the odds of your business suffering a “costly ransomware attack are the same as a hurricane hitting Florida next year”.

Similarly, a business is “over ten times more likely to suffer a week-long downtime from a ransomware attack than you are to suffer a house fire”.

By failing to make the necessary cybersecurity investments, in addition to upholding a robust cybersecurity culture, businesses are gambling with their very survival.

Those that fall victim to a cyberattack can find themselves crippled not just by operational losses, but also reputational damage and regulatory fines.

These factors have lead Wire to conclude that “the average ROI [return on investment] of cybersecurity intelligence investment is twice as high as that of the S&P 500”.

Businesses would do well to take on board these statistics and approach cybersecurity in a quantified way, says Boeree.

Her advice to decision makers is to “know when to rely on your intuition and when not to”.

She says that “people often use intuition as an excuse to be intellectually lazy” and avoid properly weighing up the outcomes and carrying out a cost-benefit analysis.

“But really your gut is just best suited for things that are like life or death situations. A car swerves into your lane – if you try and think about it, you will die. If you just let your instincts take over they'll probably do a better job.”

She continues: “The general rule of thumb these days seems to be – at least if the internet is anything to go by – is that your intuition is this magical thing, that if in doubt, you should just always trust it. And poker has shown me very clearly that that's not necessarily the case.”

At the poker table, Boeree has made “mathematically erroneous calls” because her gut told her the other player was bluffing.

“My gut was completely wrong. And yes, there's been many times when it was right, but it's not perfect,” she says. “And I think this applies to business because it's very, very rare – particularly in the day and age of data science [where] we have so much information and data at our fingertips and analytical tools – it's very unlikely that your intuitions are going to be able to outperform those.”

“The point is that you can't expect your instincts to be better calibrated than what the data actually says.”