Risk Immune System
Lower vulnerability by improving how you detect, assess, respond, and learn
- Difficulty
- Advanced
- Time to result
- ~ongoing to results
- Steps
- 5
- Confidence
- 98%
McChrystal reframes risk as threat multiplied by vulnerability, then concentrates attention on the side people can influence. Threats will emerge unpredictably, but an individual or organization can reduce exposure by strengthening its equivalent of an immune system. A healthy risk immune system detects a threat, assesses its danger, responds, and learns. Its performance depends on risk-control factors such as communication, narrative, timing, action bias, and diversity. The factors must be strengthened both individually and as a connected system. The output is not a promise of avoiding every shock; it is a higher probability of absorbing bad luck, deciding under uncertainty, and improving after each encounter.
Origin
McChrystal and his collaborators used the human immune system, which continually detects, assesses, responds to, and learns from pathogens, as the model for organizational risk health.
Core principles
- 01External threats cannot be predicted or controlled with precision
- 02Vulnerability is more controllable than threat
- 03Healthy systems detect, assess, respond, and learn
- 04Risk-control factors work together as a system
How to run it
- 1
Define the threat
State the external event or force that could cause harm. Accept that its timing and exact form may remain uncertain.
Pro tip Separate the existence of the threat from your ability to predict it.
Watch out Do not spend the whole exercise trying to control an external force you do not control.
- 2
Map vulnerability
Identify the conditions that allow the threat to hurt you. Focus on weaknesses in preparation, structure, behavior, or resources.
Pro tip Use the threat-times-vulnerability equation to keep attention on controllable exposure.
Watch out A low-probability threat can still create serious risk when vulnerability is high.
- 3
Test detection and assessment
Check whether the system can notice an emerging threat and correctly assess its potential danger. Trace how information moves from the point of detection to the people who must interpret it.
Pro tip Look for gaps in communication before a real crisis exposes them.
Watch out Sensing a threat is useless if the system cannot communicate what it sensed.
- 4
Strengthen the response system
Improve weak risk-control factors, including communication, narrative, timing, action bias, and diversity. Treat them as an interacting system rather than independent improvements.
Pro tip Start with the factor that most limits the full response cycle.
Watch out Strong individual factors do not compensate for a system that cannot coordinate them.
- 5
Respond and learn
Act when the threat appears, then study the response and its outcome. Feed the lessons back into the system before the next threat arrives.
Pro tip Judge the decision process separately from luck in the outcome.
Watch out Do not wait for perfect information when delay itself carries risk.
In the wild
McChrystal contrasts a person exposed on the street with the same person protected inside a tank. The handgun threat remains, but the tank sharply reduces vulnerability, so the resulting risk falls.
→ The example shows why reducing vulnerability can lower risk even when the threat cannot be removed.
McChrystal describes Jeff Bezos building a stronger team while some decisions fail. The organization learns from those decisions, raising its probability of success over time and improving its ability to absorb a bad piece of luck.
→ Organizational health improves the odds across repeated uncertain decisions.
Common mistakes
Trying to eliminate every threat
External risks inevitably emerge and cannot be predicted with perfect clarity. Trying to remove them all diverts attention from vulnerabilities you can reduce.
Treating factors in isolation
Communication, narrative, timing, action bias, diversity, and the other controls must work as a system. Improving one while the system remains disconnected leaves the response weak.
Is it for you?
Best for
It is best for teams operating under uncertainty where resilience matters more than precise prediction.
Not ideal for
It is not ideal for isolated choices where the relevant threat and outcome are already fully known.
From the transcript
“literally it's threat times vulnerability equals your risk.”
“We do control our vulnerabilities. We control what can hurt us and what we can do about it in the moment.”
“it just detects, assesses, responds, and learns from that process, and we go on our merry way.”
From the episode
#535: General Stanley McChrystal — Mastering Risk: A User's Guide