The Risks We Remember: How Availability Bias Creates Blind Spots in Critical Infrastructure Security Decisions

How much of what we judge to be a material security risk is driven by evidence — and how much by what we can most easily remember?

In this episode, Tim Slattery and Marina Shteinberg of Pentagram Advisory explore the availability heuristic and what behavioural science can teach us about security risk management and decision making under uncertainty.

In an era of heightened uncertainty, Boards, executives and security leaders are required to make consequential decisions with information that may be incomplete, uneven or constantly changing.

Recent incidents, personal experience and highly visible threats can quickly dominate attention — while less familiar but potentially material risks remain outside the spotlight.

Tim and Marina examine how availability bias can influence security risk assessment, risk prioritisation and investment decisions, and why a formal risk management framework does not remove human judgement — it structures where that judgement is exercised.

They also consider practical ways to strengthen decision-making through broader evidence, structured challenge and greater transparency around the reasoning behind risk ratings.

Because what is memorable is not necessarily what is material. And unfamiliarity is not evidence of safety.