What If? Analysis
A SAT that assumes an unexpected event has already occurred and asks analysts to explain how it could have happened. Forces consideration of low-probability scenarios and identifies early warning indicators.
Purpose
Overcome the tendency to dismiss unlikely scenarios. By assuming the scenario has occurred, the technique bypasses the psychological resistance to examining unwelcome possibilities.
Method
- State: “Assume that [unlikely event] has occurred”
- Work backward: how could this have happened?
- Identify the chain of developments that would lead to this outcome
- Derive indicators/signposts (see Indicators or signposts of change) that would signal the scenario is emerging
Biases Primarily Controlled
| Bias | How this technique counters it |
|---|---|
| Hindsight Bias | The primary technique for this bias — by assuming an unexpected event has already occurred, it mimics hindsight prospectively, using it productively |
| Status Quo Bias | Forcibly displaces the status quo; the current state is no longer the reference point |
| Overconfidence Bias | Pre-mortem thinking consistently reduces overconfidence by requiring engagement with failure paths |
| Confirmation Bias | By starting from the assumed contrary outcome, it forces evidence to be marshaled in the disconfirming direction |
Applied in Cybersecurity
- Incident Responders: explores how incidents might unfold unexpectedly; prepares responders for worst-case scenarios (Riley: SATs in Cybersecurity (2024))
- Cybersecurity Auditors: explores how unforeseen events (sudden policy changes, new regulations) could impact security posture