Cybersecurity spending keeps climbing, and so do the number of incidents. A new book says leaders need to change how they think.
Announcement posted by Cyber Cognition 01 Nov 2026
MELBOURNE, 1 November 2026: Security spending keeps growing, yet so do the number of incidents. In Systems Thinking for Cybersecurity: Simple Rules to Navigate Complexity, and Lead with Clarity, cybersecurity leader Michael Collins argues that buying more is not working, because the problem lies in how organisations think about security rather than in what tools own. Published by Cyber Cognition, the book launches in paperback and ebook on Sunday 1 November 2026.
The book cites Gartner's projection that global end-user information security spending reached $213 billion in 2025, up from $193 billion in 2024, with a further 12.5 per cent rise forecast for 2026. Over the same period, Cybersecurity Ventures projected global cybercrime losses of $10.5 trillion for 2025.
The world is more interconnected than ever, yet the way most organisations approach cybersecurity has barely changed. Collins argues that much of the field still runs on thinking suited to the industrial era, when a problem could be broken into parts and solved through a predictable chain of cause and effect. Today's environment is interconnected, fast-moving and shaped by adversaries who adapt their thinking to the real world. Each new pressure brings another tool, dashboard or audit, and practitioners end up facing more data every day than anyone can reasonably absorb. In that environment, security needs adaptive resilience and a more effective way of organising information.
Traditional approaches to training cybersecurity professionals focus almost entirely on technical skills. That grounding matters, but it does not equip people with the thinking skills needed to operate effectively in a complex environment, where the hard part is deciding what a situation means and what to do about it. Collins argues that systems thinking can be taught as deliberately as any technical skill, which is why the book gives readers simple rules to practise.
Collins applies that argument to the problems security leaders are dealing with now. He examines why the same incidents keep returning when reviews stop at a single root cause or at the person closest to the failure. Blaming the human is a fallacy, he argues, because it ignores the conditions that made that person's decision seem reasonable at the time, such as deadline pressure, unworkable processes, limited capacity and the incentives around them. He shows how to question the system before the person, and how to look at the patterns, structures and beliefs underneath. He tests the fear-driven claims behind many buying decisions against evidence and an organisation's own circumstances. He also questions the expectation that a leader can answer "are we secure?" with a yes or no. In February 2026 the Federal Court of Australia fined FIIG Securities $2.5 million after a breach exposed client data on the dark web, yet the court stated that the legal standard does not require perfection, and that a successful attack is not proof of inadequate security. Collins uses the case to show that security is judged on whether it was reasonable in context, not whether it was flawless.
Collins also challenges the norm of leaving cybersecurity to one role. His premise is that security does not come down to the CISO or the security team. Cybersecurity outcomes emerge from the strength of the relationships across the entire organisation, and relying on one function to protect the business lets silos form between security and the rest of the organisation, and between the CISO and other executives. Breaking down those silos means building deliberate working relationships between security and every other function, because that is where outcomes are decided. Collins makes the case for putting cybersecurity on the company scorecard alongside the measures that set executive bonuses, so the board and management share accountability for the results. He points to Qantas, which reduced the scorecard outcomes of its CEO and executive team by 15 percentage points after a 2025 third-party platform incident exposed six million customer records, as an example of that accountability in practice.
Behind each of these challenges is the book's central argument: security outcomes will not improve until the thinking behind them does.
"The field of cybersecurity doesn't need more frameworks. It needs better thinking. And better thinking, it turns out, can be learned," argues Collins.
The book's simple rules give readers practical tools for making that shift. They draw on theory and practice developed through decades of research at Cornell University and applied across technology, education, government, healthcare, infrastructure and enterprise. Collins extends that work with his own research and has applied it in his senior security roles, bringing it into cybersecurity for the first time. He uses the rules to examine real-life breaches and familiar case studies drawn from his experience across several organisations.
Business leaders are actively looking for people who can think in systems, because the skill connects security work to the organisation's strategic goals. Readers learn to cut through complexity, recognise the patterns behind recurring problems, build a security culture and lead with clarity.
"A stable system is a fragile one, and the resilience we're really after in cybersecurity comes from adapting continuously, not from holding a fixed position," Collins said.
Systems Thinking for Cybersecurity is written for CISOs, CIOs and security practitioners, and for the risk and audit professionals who share responsibility for security outcomes. It suits experienced leaders looking for a better way to frame decisions, as well as practitioners preparing to step into leadership roles.
Availability
Systems Thinking for Cybersecurity is available from 1 November 2026 in paperback (RRP AU$25.99, ISBN 978-1-7645520-0-4) and ebook (RRP AU$11.99, ISBN 978-1-7645520-2-8) through online retailers. Links to online retailers at https://www.books2read.com/st4c, and more about the author at https://www.michaelcollins.au.
About Michael Collins
Michael Collins founded Cyber Cognition to promote systems thinking in cybersecurity. He has more than 20 years of technology and cybersecurity leadership experience in the United Kingdom, New Zealand, the United Arab Emirates and Australia. His senior roles include CISO at Judo Bank and General Manager Information Security at HESTA. Collins designed SC3, the Australian superannuation sector's framework for coordinating cyber defences. He was a finalist for the Australian CISO of the Year Awards in 2023, and for Outstanding Contribution to Cybersecurity at the 2026 AISA Cyber Awards. In 2025 he was named among the Top 40 Cybersecurity Influencers to Follow. His research appears in the Journal of Systems Thinking, and he serves on the Science Board of the Systems Thinking Standards Institute.
Media contact
Review copies, interviews and additional images are available on request.
Michael Collins, Founder, Cyber Cognition
Email: michael@cybercognition.com.au
Phone: 0487 888 131