Four perspectives on organisational security

Perrow's point was that in systems that are both complex and tightly coupled, accidents will sooner or later happen, however good the barriers are, because failures propagate faster than anyone can understand them. What he described for nuclear plants and petrochemical facilities in the 1980s applies today to organisations that have never thought of themselves as high-risk. The Norwegian National Security Authority calls concentration risk a national challenge: cloud services dominated by a few foreign providers, supply chains running through a single country, satellite services Norway does not control, and control systems that cannot withstand being kept busy. The couplings no longer run through pipes and valves, but through suppliers, and they are at least as tight.

What is new is that the holes no longer simply appear. Someone is looking for them. The Police Security Service writes that Russian intelligence may see it as worthwhile to carry out sabotage against targets in Norway in 2026, often through proxies, and that China poses a significant intelligence threat, strongest in the cyber domain. Recruited insiders are asked to obtain information about internal conflicts, discontent and weaknesses in routines, and the security authority points out that weak leadership and poor internal communication in themselves increase insider risk. Perrow's accidents were normal because nobody wanted them. Today's incidents may become normal because someone does, and because a tightly coupled system gives the attacker the same paths of propagation that chance once had.

For the three perspectives this means that none of them is outdated, but that all of them have taken on a new meaning. Perrow's system is still there, only larger. Reason's Swiss cheese is still the right image, but an adversary sits on the other side holding the slices up to the light. And the answer from research on high-reliability organisations – attention, training and exercises throughout the system – has become the security authorities' own advice in the total-defence year 2026. At the same time, the authority finds significant gaps in preventive security work across sectors: organisations that have not carried out tests, controls or exercises, and employees holding security roles they lack the competence for. We exercise too little, and we exercise separately.

This is where proactive crisis management enters as the fourth perspective, and where ORGSEC has its place. No assessment removes the risk Perrow described; nor is that the purpose. What an assessment can do is show where the organisation stands before someone else finds out: which functions must continue to work, which dependencies are tightest, whether the plans are known and exercised, and whether management has the competence to see the development early. Then the measures can be prioritised, the competence built, and the result measured again. It is no more dramatic than that, and no less necessary.