During the COVID lockdowns, I decided to learn about cybersecurity as a way to fill in the time. I even signed up to sit the notorious 24-hour OSCP exam, although I never actually sat it, as I soon discovered cybersecurity wasn't for me.

One thing I did take from the experience, however, was the concept of offensive and defensive security.

Offensive (or red team) cybersecurity experts spend their days finding vulnerabilities in systems before hackers can exploit them. Defensive (or blue team) experts monitor for threats and respond when they arise.

I was reminded of this recently when a client asked me to review the statistical content of a slide deck he was preparing for a pitch to his own stakeholders. Working through it, I found myself completing both an offensive and a defensive pass.

In the offensive pass, I read the slides the way a hostile stakeholder would. Several things stood out immediately - places where my client had been vague about sample size requirements, for instance, that were practically begging for difficult questions.

Left unaddressed, those gaps would have undermined his credibility at exactly the wrong moment.

In the defensive pass, I looked for issues my client hadn't yet considered. The most significant was this: because the model was predicting rare events, false positives would inevitably outnumber true positives.

If that's not flagged upfront, stakeholders will eventually notice, and when they do, the credibility damage is far worse than if you'd simply named it from the start.

Both passes are worth doing every time you present analytical work to stakeholders.

The offensive pass forces you to find the weaknesses a hostile critic would exploit. The defensive pass forces you to think through the implications of your own work before your stakeholders do.

The goal isn't to make your work look perfect. It's to demonstrate that you've thought harder about it than anyone else in the room.

Talk again soon,

Dr Genevieve Hayes