What do you think?
Rate this book
Built Wrong: Why Cybersecurity Keeps Failing And How We Can Rebuild It
In February 2024, people stood at pharmacy counters across the country and were told the system was down. Cancer medication. HIV medication. Psychiatric prescriptions. No timeline. No explanation. No alternative.
A ransomware crew had taken down Change Healthcare, the clearinghouse that touches one in three American patient records. Roughly 192.7 million people, more than half the country, would have their information exposed by a company most had never heard of and none had chosen.
Nobody standing at that counter had a vote in any of it.
Built Wrong is about how failure got priced in.
Reported cybercrime losses in the United States were roughly $800 million in 2014. Ten years later the FBI put the figure at $16.6 billion. In 2025 it passed $20.9 billion. $100 growing at the rate of American cybercrime over that decade would have become $2,074. The same $100 in the S&P 500 became $343.
Every year of that run set another record for cybersecurity spending. Nobody was ever required to prove any of it worked.
There is no scoreboard. No accident record. No accepted instrument anywhere in the profession answers the question every board should be
Is this organization harder to compromise than it was twelve months ago?
The bad guys have an answer. Their revenue went up.
Richard Bird helped build this. Thirty years running security and technology organizations, more than a decade of it at JPMorgan Chase, buying and building the products, implementing the frameworks, inside the machinery he now argues was built to measure everything except whether it worked.
Everyone could do their job correctly, and the system could still fail. Boards got reassurance. Regulators got filings. Insurers got premiums. Vendors got renewals. Built Wrong calls this the Stable Failure every participant rewarded for doing exactly what they did while the losses kept climbing. Practitioners got blamed.
Cybersecurity did not fail in one place. Built Wrong works through three decades of the economics, incentives, governance, lines of authority, measurement systems, and institutional habits. Each arrives at the same destination on its own which is why fixing any one of them has never been enough.
The industry learned to measure activity without ever proving performance.
That is the diagnosis and it is the easy half. The rest of the book builds the instrument that does not exist, from the forensic record of real incidents, in enough detail to be argued with.
Built Wrong develops the Three Dynamics of Security Performance, a model of cybersecurity as a measurable discipline organized around Exposure, Interdiction, and Consequence. It proposes an institution that cybersecurity was built once, and then an equivalent of the accident record that transformed aviation safety, a common body of evidence showing whether security is improving and what actually changes outcomes. And it replaces "best practices" with Most Effective Practices, derived from demonstrated results rather than committee consensus.
Written for the CISO who has run out of ways to explain a program that is working and losing. For the executive trying to understand what the security budget actually buys. For the board member asked to govern a risk nobody has handed them an instrument to measure. For the regulator trying to improve outcomes with disclosure and prescribed activity.
And for anyone who has heard one more breach called sophisticated and known better.
Aviation does not tell passengers that crashes are inevitable. It tells them, with evidence, whether flying is getting safer.
Cybersecurity has never once been asked to do the same.
The formulas, metric definitions, instrumentation, and scorecard templates live in a companion volume, The Verified Security The Operating Manual for Built Wrong, publishing after this one.
A ransomware crew had taken down Change Healthcare, the clearinghouse that touches one in three American patient records. Roughly 192.7 million people, more than half the country, would have their information exposed by a company most had never heard of and none had chosen.
Nobody standing at that counter had a vote in any of it.
Built Wrong is about how failure got priced in.
Reported cybercrime losses in the United States were roughly $800 million in 2014. Ten years later the FBI put the figure at $16.6 billion. In 2025 it passed $20.9 billion. $100 growing at the rate of American cybercrime over that decade would have become $2,074. The same $100 in the S&P 500 became $343.
Every year of that run set another record for cybersecurity spending. Nobody was ever required to prove any of it worked.
There is no scoreboard. No accident record. No accepted instrument anywhere in the profession answers the question every board should be
Is this organization harder to compromise than it was twelve months ago?
The bad guys have an answer. Their revenue went up.
Richard Bird helped build this. Thirty years running security and technology organizations, more than a decade of it at JPMorgan Chase, buying and building the products, implementing the frameworks, inside the machinery he now argues was built to measure everything except whether it worked.
Everyone could do their job correctly, and the system could still fail. Boards got reassurance. Regulators got filings. Insurers got premiums. Vendors got renewals. Built Wrong calls this the Stable Failure every participant rewarded for doing exactly what they did while the losses kept climbing. Practitioners got blamed.
Cybersecurity did not fail in one place. Built Wrong works through three decades of the economics, incentives, governance, lines of authority, measurement systems, and institutional habits. Each arrives at the same destination on its own which is why fixing any one of them has never been enough.
The industry learned to measure activity without ever proving performance.
That is the diagnosis and it is the easy half. The rest of the book builds the instrument that does not exist, from the forensic record of real incidents, in enough detail to be argued with.
Built Wrong develops the Three Dynamics of Security Performance, a model of cybersecurity as a measurable discipline organized around Exposure, Interdiction, and Consequence. It proposes an institution that cybersecurity was built once, and then an equivalent of the accident record that transformed aviation safety, a common body of evidence showing whether security is improving and what actually changes outcomes. And it replaces "best practices" with Most Effective Practices, derived from demonstrated results rather than committee consensus.
Written for the CISO who has run out of ways to explain a program that is working and losing. For the executive trying to understand what the security budget actually buys. For the board member asked to govern a risk nobody has handed them an instrument to measure. For the regulator trying to improve outcomes with disclosure and prescribed activity.
And for anyone who has heard one more breach called sophisticated and known better.
Aviation does not tell passengers that crashes are inevitable. It tells them, with evidence, whether flying is getting safer.
Cybersecurity has never once been asked to do the same.
The formulas, metric definitions, instrumentation, and scorecard templates live in a companion volume, The Verified Security The Operating Manual for Built Wrong, publishing after this one.
473 pages, Kindle Edition
Published October 20, 2026
About the author
Richard Bird
241 books2 followersRichard Bird is a horticultural expert and gardening author.
There are other authors named Richard Bird:
* Richard Bird — a contemporary author
* Richard Bird — an early 20th-century author
* Richard S. Bird — a computer scientist
There are other authors named Richard Bird:
* Richard Bird — a contemporary author
* Richard Bird — an early 20th-century author
* Richard S. Bird — a computer scientist
Ratings & Reviews
Friends & Following
Create a free account to discover what your friends think of this book!
Community Reviews
No one has reviewed this book yet.