Cybersecurity is radically asymmetrically distributed.

The report argues that cybersecurity risk is radically asymmetrically distributed, drawing on examples from emissions testing and COVID-19 superspreaders and citing FBI and Cyentia data showing incidents concentrated in a subset of organizations and sectors. It recommends tailoring strategy to risk level: deploy prevention-focused approaches (e.g., zero trust, intrusion kill chain prevention, automation, workforce development) where outside-in risk is high, and emphasize resilience (backups, encryption, crisis planning, incident response, business continuity, chaos engineering) where risk is low.