Why Cybersecurity Leaders Need Systems Thinking with Michael Collins

Cybersecurity problems rarely exist in isolation. They sit inside complex organizations shaped by people, competing priorities, financial constraints, regulation, relationships, incentives, and decisions. In this episode of Vision 360, Matthew Webster speaks with cybersecurity leader and systems thinking practitioner Michael Collins about what changes when security leaders stop looking at cybersecurity as an isolated function and begin looking at the organization as a system. Michael draws on more than two decades of experience across the Royal Australian Navy, financial services, CISO leadership, and cybersecurity advisory work to explore how systems thinking can change the way leaders approach cybersecurity. The conversation covers business alignment, vulnerability management, compliance, cyber risk, risk quantification, decision-making, organizational relationships, human behavior, leadership, and the importance of understanding the perspectives of the people around you. Matthew and Michael also discuss why cybersecurity leaders can create unnecessary friction by imposing controls without understanding business context; how scenarios and financial impact can make risk meaningful to executives; why relationships can matter more than organizational hierarchy; and how distributed decision-making can create stronger, more capable teams. One idea runs throughout the conversation: build bridges, not ladders. Cybersecurity leadership is ultimately about more than threats, vulnerabilities, controls, and technology. It requires understanding the larger system in which those things exist—and the people who make that system work. Michael Collins is the author of Systems Thinking for Cybersecurity: Simple Rules to Navigate Complexity and Lead with Clarity. Topics include: • Systems thinking in cybersecurity • Cybersecurity and business alignment • Risk communication and quantification • Compliance and regulatory constraints • Vulnerability management and business context • Influence without authority • Human behavior and ecological rationality • Distributed decision-making • Building relationships across the organization • Cybersecurity leadership and organizational complexity