Why Your Security Strategy Is Failing: The Myth of the "Dumb Criminal"

Tony Ridley, MSc, CSyP, FSyI, SRMCP. Originally published 19 August 2026.

Most security strategies are built to defeat an imagination rather than a threat. The image many Boards, executives and even seasoned professionals still carry is the bumbling, comical criminal seen in film and the evening news, opportunistic, unsophisticated, easy to outwit with a camera and a fence. That image is dangerously out of date.

Global disruption over the past six years, including the COVID-19 pandemic and the conflicts in Ukraine and Gaza, has reshaped the adversary landscape. The threat actors operating today are professionals, not amateurs. Many treat criminality, deception and destruction as a dedicated vocation, pursued with the same discipline, training and career long commitment that any specialist brings to their field. Some now operate with resources and freedom of action that outstrip the constraints under which lawful security and risk professionals must work.

This piece examines why treating adversaries as unintelligent is not a harmless simplification but a professional failure, one that reduces security spending to a blunt instrument applied indiscriminately rather than a precise, evidence based discipline. It asks what genuinely adaptive threat analysis requires, and what happens to organisations whose risk assessments have not caught up with how capable, resourced and motivated their adversaries have become since 2020.

This is a member article. The full piece is available to members. Become a member to read it in full.