Rational Astrologies and Security

This post introduces a paper by John Kelsey and the author on 'rational astrologies' in security, arguing that organizations often deploy security theater or follow rules to satisfy social, institutional, or legal expectations rather than demonstrably reducing risk. It explains how principal–agent misalignment and pressures to show that 'all that could be done' was done lead to practices that reassure stakeholders but may not improve actual security.