What Is a Wicked Problem? Making Decisions in a Cyber Crisis

What Is a Wicked Problem?

A wicked problem is a complex problem that has no clear or correct solution — only ‘less bad’ options whose trade-offs may create new problems down the line. The term was coined in 1973 by Horst Rittel and Melvin Webber. In cybersecurity, crises are wicked problems by nature: teams must make high-stakes decisions under time pressure, with incomplete and often contradictory information, and no playbook that fits perfectly.

We’ve all got problems. Whether at work or at home, human beings are bound to come across some stumbling blocks every now and then. There are well-defined procedures in place to fix the more common issues – call the plumber, darn the sock, visit the doctor. At work too, your office probably has an incident response plan or playbook to follow when something goes wrong. But for some problems, it’s not so simple. Enter the wicked problem.

What Is a Wicked Problem?

Coined in 1973 by Horst Rittel and Melvin Webber, wicked problems are those that have no clear answer. They’re often impossible or difficult to solve because of contradictory and changing requirements. Solutions to these complex issues are not right or wrong, but rather “less bad” options, and the interdependency of complexities means that one seemingly plausible solution may reveal or create further issues down the line. Due to these convolutions, wicked problems have no real definition, and there is no set way to approach them. Instead, they are framed around a set of characteristics, generalized by CogNexus Institute founder Jeff Conklin.

Crises, by their very nature, bring wicked problems. If wicked problems aren’t present, there’s probably a defined procedure in place to guide you through the problem. The more wicked a problem or set of problems, the more labyrinthine the crisis will be to navigate, and the more complex the decisions needed to resolve the issues.

But as past crises have shown, wicked problem decision-making is frequently more nuanced. A key component for each of Immersive’s off-the-shelf Crisis Simulations is that there is no “one size fits all” perfect way to respond or recover from a crisis – each scenario has multiple options to help you achieve your response objective, but each will add risk of collateral damage later in the exercise. Processes set in stone in an incident response plan or company playbook are insufficient for responding to the tumult of wicked problems that crises pose by their unpredictable nature. If it’s a crisis, there probably isn’t an all-encompassing plan to follow.

Wicked problems during a crisis require adaptivity, emotional and environmental intelligence, and lateral thinking, as well as a recognition that all options may be perceived as bad due to the differing requirements of key stakeholders. The onus is on the crisis management team (CMT) to make the best of the bad choices, accounting for diverse stakeholders and envisioning future events as accurately as possible based on the little information available. The most effective crisis leaders and teams employ various decision-making styles, and are conscious of when and why to transition between those styles as a crisis unfolds.

CogNexus Institute founder Jeff Conklin claims that the two most intense forces impacting organizations today are wicked problems and social complexity – two forces that are intrinsically linked. There’s no quick fix when it comes to solving wicked problems. Instead, the humans making the decisions need to be well-equipped and draw on certain skills, preparing them for better choices. So what skills help a CMT deal with wicked problems?

Intuitive Decision-Making

Intuition is the ability to understand something instinctively without the need for conscious reasoning. It’s the recognition of patterns in a given situation or crisis, and drawing on previous knowledge and experiences, past successes and failures, to make decisions about the immediate problem. With extensive relevant previous experience, the ability to draw conclusions becomes quicker, providing an internal sense of right and wrong for a given event, and what the correct course of action would be – ultimately saving time and making for a more effective crisis response plan.

Intuitive decision-making isn’t without its limitations, though. Wicked problems during crises are, by their nature, unique. The complexity, and often ambiguity, of such problems means it can be difficult to draw on previous experience, especially when the wicked problem at hand isn’t fully understood. The further we stretch the matching of previous experiences onto the problem, the larger the likelihood of false interpretations of an event. On the other side of the coin, intuitive decision making doesn’t lend itself well to avoiding cognitive bias. It’s all too easy to play up the similarities of a situation to a prior event and play down the differences.

But suppressing intuition isn’t the answer either. This instinctive style of decision-making is vital during time-restricted wicked problems. Instead, the best way to tackle this is deliberate analysis of intuitive thought processes and taking care to avoid simply looking for confirmation. Confront, test and explore any doubts in your intuition and your solutions will benefit.

Another limitation of intuitive decision making is that it’s a personal process. Because actions are based on personal experiences – what you did previously, what you learned from it – it can be hard to persuade other stakeholders to understand your perspective or approve your choices. For these reasons, it’s crucial to use the intuition of outsiders or neutrals too, to test the results of your deliberative analysis or check any given assumptions made.

Norsk Hydro experienced a number of wicked problems when the company was under cyberattack in 2019. The cyber response and crisis leadership teams employed the intuitive quick decision to shut down all the computer networks and move to analogue systems before knowing the full extent of the attack. Despite a lack of information, a proactive decision was made to sacrifice service and business continuity for the protection of the network and customer data and to halt any further spread. Negative consequences existed on both sides of this argument, but the teams sensed they had to act fast and block any further attacks. This ultimately helped the situation from developing further and protected the network, meaning the damage was much less severe than it could have been.

Rational Decision-Making

To oppose the intuitive side of things, rational decision making is a multi-step process that favours logic, objectivity, and analysis over subjectivity and insight. When making rational decisions, the issue needs to be fully understood – not just the symptoms, but the causes too. An in-depth understanding of a problem allows decision makers to generate a range of potential solutions, not just one response option. The team can then analyze all the options and weigh up which will have the best chance of success. Depending on the problem’s nature, this analysis could be in-depth modelling or calculations, or more discussion-based, using the knowledge and experience (and intuition) of people in the room. After implementing the structures to support the option and evaluating the final outcome, the CMT is able to learn from its rational step-making process and identify whether the solutions solved the problem, or whether the problem needs to be redefined and the cycle reinitiated.

However, wicked problems don’t always allow time for a total understanding of the problem. It’s easy to tell a decision-making team to look at every angle, create some options, and pick the best one, but in reality wicked problems don’t behave that way. By definition, these problems have no “stopping rule”; the problem cannot be contained into one neat set of issues, and therefore the solutions cannot be as definitive either. The problem-solving process, then, ends when resources (time, money, energy) run out, not when an optimal solution emerges.

When employing rational mode in its decision-making, a CMT also needs to be careful that a decision is actually made. Deloitte talks about paralysis by analysis; too much rational thinking runs the risk of inertia, which could delay a decision being made or leave it for someone else. Inaction, unless strategically deliberate, is also likely to be an inappropriate response in the fast-moving cyber world. While intuition is essential, so too is rational decision-making. The more wicked the problem, typically the more rational and thoughtful a response is required.

Immersive’s Ben Hockman, crisis response expert, says that the space for rational decision-making in cyber responses is clear. Having coordinated the response to a number of ransomware attacks, Ben recalls one particular case a few years ago that included some fast, intuitive decisions early on. “While we still didn’t fully understand what was going on, we recognized that some mitigating action was required nonetheless.” As more information became available and the complexity of the attack became clear, rational planning and decision-making took precedence. CMT meetings became discussions around how long to disconnect certain servers for, how to perform specific containment and protection measures, how many customers would be affected, and to what extent, from each of the options. “Those were critical decisions with far reaching impacts,” Ben states. “They were decisions that needed to be made quickly, but not in seconds or minutes.” For this specific wicked problem, decisions were approached rationally, following detailed analysis, assessment, discussion and, more often than not, unilateral agreement among the senior members of the crisis management team.

So What?

One of the key moments in effective incident response is acknowledgement that a wicked problem exists, and recognizing it during the course of an event, ideally well before it unfolds.

Strategic leaders are likely to face a wicked problem at some point, and a good leader knows that there is no simple or right answer. These problems are uncomfortable regardless of your level of knowledge, skills or experience. Often when we encounter these problems, we need to think rationally and identify the ‘least bad option’, yet no matter how hard or difficult the decision is, one must be made. You can’t afford to suffer from decision inertia because it’s a tough call.

Wicked problems are best tackled by drawing on both rational and intuitive decision-making skills. Practicing these core skills in the right context is the only way to train your teams to be able to proactively influence the unfolding events during a crisis, rather than being pinballed through.

Those who drill wicked problems – under time pressures, with teammates whose decisions may make a problem more wicked, without all the necessary information – are more likely to succeed when it comes to the real thing.

How to Train Teams for Wicked Problems

You can’t make wicked problems disappear, but you can prepare people to make better ‘least bad’ calls. The only way is realistic practice that recreates the fog of war — not a comfortable tabletop. If a simulation is comfortable, it isn’t doing its job. Good crisis exercises deliberately push teams into wicked territory:

• Induce the fog of war. Give teams incomplete and contradictory information, and make them discover facts in real time rather than handing over a clean timeline.
• Create dilemmas, not puzzles. Design no-win scenarios where every option carries a cost — isolate systems and lose operations, or investigate and risk the spread — so teams practise weighing trade-offs with no right answer.
• Compress time. Run the scenario faster than real life so teams feel the tunnel vision and pressure they’ll experience in a real crisis.
• Make consequences visible. Show the business impact of each decision — revenue lost per hour, regulatory exposure, customer trust — so the trade-offs are real.
• Build a forcing function to decide. As Kev Marriott puts it, you need a collaborative environment to think it through, but a clear point where the team commits — because the quicker you reach a sound decision, the better the outcome.

Repeated under pressure, this builds the muscle memory to make least-worst calls — and the discipline to spot a wrong call quickly and change course. Immersive’s Crisis Simulations, Cyber Range Exercises, and the Dynamic Threat Range are built to push teams into exactly this wicked territory, with objective metrics so you can prove readiness and track improvement over time.

“In a high crisis incident, a lot of the time there’s no best decision to make — there’s a least worst. You’ve got to have a collaborative environment to think it through, but at some point you have to decide; the quicker you get to a sound decision, the better the outcome tends to be. Identifying that least-worst call comes through practice — the more you make these decisions under real stress, the better you get.”

— Kev Marriott, Senior Manager of Cyber, Immersive

Immersive’s Crisis Simulator puts intuitive and rational decision-making and core values of teamwork and agility to the test in reality-based exercises where, ultimately, your decisions have consequences. Being able to stress-test teams on their wicked problem-solving in a sandbox environment is the only way to be fully prepared when the real thing strikes.

Is your team ready to deal with a wicked problem? Head below to book a demo of Immersive’s cyber readiness platform and the Crisis Simulator today.

Frequently Asked Questions

What is a wicked problem?

A wicked problem is a complex problem with no clear or correct solution — only ‘less bad’ options whose trade-offs can create new problems later. The term was coined in 1973 by Horst Rittel and Melvin Webber. In cybersecurity, crises are wicked problems by nature, because teams must decide under time pressure, with incomplete and often contradictory information, and no playbook that fits perfectly.

What makes a cyber crisis a wicked problem rather than a normal incident?

A normal incident is like a puzzle with a defined solution and a playbook to follow. A wicked problem has no single right answer — only trade-offs with consequences. In a cyber crisis, requirements conflict and change, information is incomplete or contradictory, time is short, and every option carries some risk of collateral damage, so set-in-stone procedures are rarely enough.

What is the difference between intuitive and rational decision making in a crisis?

Intuitive decision making is fast, instinctive pattern recognition based on past experience — valuable under time pressure but prone to cognitive bias. Rational decision making is a slower, multi-step process that weighs options logically — thorough but at risk of paralysis by analysis. The most effective crisis teams draw on both and consciously switch between them as the situation changes.

How do you make a ‘least bad’ decision under pressure?

Acknowledge that the problem is wicked and has no perfect answer, gather the most important facts rather than waiting for all of them, weigh the trade-offs of each option, and avoid decision inertia. Combine intuition with rational analysis, make the call, and stay ready to spot a wrong decision quickly and correct it.

How do you train teams for wicked problems?

Drill teams in realistic crisis simulations that recreate the fog of war: incomplete and contradictory information, no-win dilemmas where every option has a cost, compressed timelines, and visible business consequences. Repeating these exercises builds the muscle memory to make sound least-worst decisions under pressure.