Why Aren’t Things Worse?

One of the things I’ve been thinking about for years, but more acutely now because of the conversations around controlling open source models, is the question of why more bad things don’t happen.So I’m asking:Why don’t more bad things happen?What I’m specifically asking about is the Theory of Constraints analysis of the problem. Meaning, what specific set of controls or friction points stop bad things from being more common, or higher impact.I think this is foundational to doing security, yet there is virtually no conversation about it in the standard discourse.As an example, why aren’t there more cyber threat actors?What stops someone from becoming one? Is it skill? The inability to do the operational side? Moral or ethical restraint?Ok cool. So let’s say we have a list.Now here’s the question:What changes in the world might increase or decrease pressure on one or more of these flow points in a way that materially affects the numbers?Examples:What if some significant percentage of…