#ninjatheme 2026: Uncertainty at Speed
Scott Gardner ·
Here’s my prediction for 2026:
Security teams that can’t cope with uncertainty at speed will quietly fail; not in flames, but in process documents, dashboards, and post-incident PDFs written in passive voice.
Most security programs are still built to reduce uncertainty. That made sense when threats were slower, infrastructures were smaller, and change happened annually instead of hourly.
That world is gone.
By 2026, security won’t be judged on:
how complete your control set is
how elegant your architecture diagram looks
how confidently you say “we’re aligned to the framework”
It will be judged on one thing:
How fast you can learn while the ground is moving.
Attackers already operate this way. They don’t wait for certainty. They probe, adapt, discard hypotheses, and iterate... sometimes inside a single intrusion window.
Defenders, meanwhile, still behave as if uncertainty is a defect to be eliminated.
It isn’t.
Uncertainty is the native condition of modern cyber conflict.
This is why execution models matter more than tools. It’s why I keep pointing to systems like DARPA’s; not because cybersecurity should become a research lab, but because DARPA was designed for environments where:
the adversary adapts
the problem is poorly defined
and the cost of delay exceeds the cost of visible failure
In other words: reality
By 2026, the gap will widen between organizations that:
treat security as a portfolio to be managed
and those that treat it as an execution engine
The latter will:
run missions, not roadmaps
time-box bets instead of defending them indefinitely
kill initiatives early and learn publicly
accept failure as data, not disgrace
design architectures that can change direction without panic
The former will still be “mid-transformation.”
AI will accelerate this split. So will post-quantum migration. So will adversaries who are faster, cheaper, and less emotionally attached to their own assumptions.
The uncomfortable truth is this:
Security won’t win by becoming more certain in 2026. It will win by becoming more agile inside uncertainty. Without lying to itself about what it knows.
The future doesn’t belong to the most controlled organisations.
It belongs to the ones that can move, decide, and learn at speed, without certainty, and without pretending otherwise.
That’s the bar for 2026.
scottg/out
Threat intelligence every morning — new victims, new groups, what matters, in plain English. Free, with receipts.
Subscribe to the Daily →