The Risk You Cannot Model: Decision Making Under Uncertainty, Lessons From M&S and Jaguar Land Rover

In the spring of 2025, around Easter, Marks & Spencer, one of Britain's most trusted retailers, was hit by a cyberattack. Online orders were suspended for about six weeks. The company estimated the cost at roughly 300 million pounds, and its net profit for the six months to late September fell by about 98 percent.

A few months later Jaguar Land Rover, Britain's largest automaker, suffered its own attack. Production stopped for close to six weeks. The independent Cyber Monitoring Centre estimated the total cost to the British economy at about 1.9 billion pounds, affecting more than 5,000 organizations across the supply chain. It has been described as the most economically damaging cyber event in UK history.

These were not small companies with weak defenses. They were sophisticated, well-resourced organizations. And they were reminded, painfully, of something every leader eventually learns: the risk that hurts you most is often the one your spreadsheet could not see.

What CEOs Fear Most in 2026

The major CEO surveys this year tell a consistent story.

• In KPMG's 2026 Global CEO Outlook of 1,400 chief executives, 31 percent named cyber and data security as the greatest risk to growth over the next three years, ahead of global economic uncertainty (28 percent) and geopolitical instability (26 percent). In the UK, 89 percent of CEOs said they were concerned about their organization's vulnerability to cyberattacks.
• In PwC's 2026 Global CEO Survey of 4,454 CEOs, 31 percent cited cyber risk as a major threat, up from 24 percent a year earlier, and only 30 percent were confident about revenue growth over the next year.
• In The Conference Board's C-Suite Outlook 2026, U.S. CEOs ranked uncertainty itself as their top economic threat (43 percent), and 54 percent of U.S. CEOs ranked cyberattacks as their top geopolitical threat.

Notice the word that keeps appearing. Not risk. Uncertainty. And that distinction turns out to matter a great deal.

Risk Versus Uncertainty: A Hundred-Year-Old Insight

In 1921 the University of Chicago economist Frank Knight drew a line that still shapes how serious thinkers approach decisions. Risk, he said, applies when you can assign probabilities to outcomes, like the odds of a roll of dice or the default rate on a large pool of loans. Uncertainty applies when you cannot, when the situation is new enough or complex enough that no reliable probability exists.

Most corporate risk management is built for Knight's first category. It quantifies, models and hedges. But the events that reshape companies, a novel cyberattack, a pandemic, a sudden tariff war, a technology that rewrites an industry, usually belong to the second. Nassim Nicholas Taleb's The Black Swan (2007) popularized the point: the rare, high-impact events we fail to anticipate do the most damage, and we explain them neatly only after the fact.

The lesson is not that modeling is useless. It is that leaders must not confuse the precision of their models with the predictability of the world.

Why Smart Leaders Misjudge Uncertainty

Behavioral science has identified several patterns that make capable executives especially vulnerable.

• Overconfidence. Daniel Kahneman and Amos Tversky's research showed that experts routinely give confidence ranges that are far too narrow. Success can make this worse, because past wins feel like proof of judgment.
• Normalcy bias. Organizations assume tomorrow will resemble yesterday, especially after long stretches without a crisis.
• Siloed responsibility. Cyber risk is often treated as an IT problem rather than a strategic one, so the people who understand the threat are not the people who set priorities.
• Short horizons. PwC found that CEOs spend 47 percent of their time on issues with a horizon under one year and only 16 percent on decisions beyond five years. Uncertainty tends to hide in the long view.

Four Disciplines for Deciding Under Uncertainty

1. Run a Premortem

The psychologist Gary Klein proposed a simple technique in the Harvard Business Review in 2007. Before committing to a major decision, imagine it is a year later and the decision has failed badly. Then ask everyone to write down why. The exercise gives people permission to voice concerns they would otherwise keep quiet, and it surfaces failure modes that optimism hides. It is one of the cheapest tools in management and one of the most underused.

2. Practice What the Stoics Called Premeditation

Two thousand years before Klein, the Stoic philosopher Seneca recommended praemeditatio malorum, the deliberate rehearsal of misfortune. The point was not pessimism. It was preparation: a mind that has already imagined disruption responds to it with clarity instead of panic. Leaders who walk their teams through realistic crisis scenarios, including a full shutdown of core systems, are practicing the same ancient discipline.

3. Build a High Reliability Culture

Karl Weick and Kathleen Sutcliffe of the University of Michigan studied organizations that operate safely in dangerous conditions, such as aircraft carriers, nuclear plants and emergency rooms. In Managing the Unexpected they found that these "high reliability organizations" share habits: a preoccupation with small failures, a refusal to oversimplify, close attention to frontline operations, a commitment to resilience and deference to expertise rather than rank in a crisis. Those habits translate directly to cyber resilience. The person who notices the odd login at 2 a.m. must feel free to raise the alarm.

4. Decide for Resilience, Not Just Efficiency

Efficiency removes slack. Resilience requires some. Backup systems, manual workarounds, diversified suppliers and rehearsed recovery plans look like waste until the day they save the company. KPMG's UK survey found that 96 percent of CEOs have shifted resilience planning from short-term to long-term horizons, and 45 percent of global CEOs have increased cybersecurity investment. The best leaders treat that spending not as insurance but as strategy.

The Leadership Capability That Matters Most

When KPMG asked CEOs what leadership capabilities matter most now, 47 percent pointed to agility and faster decision making under pressure, and 44 percent to strategic foresight and scenario planning, double the share from a year earlier. That shift is telling. Executives are recognizing that the defining skill of this era is not predicting the future. It is deciding well when you cannot.

That is fundamentally a question of judgment. Models can tell you what is probable. They cannot tell you what to do when probability runs out. That requires leaders who know the limits of their knowledge, invite dissent, prepare for the unthinkable and act with clarity when it arrives.

Questions for Your Next Leadership Meeting

• If our core systems went down for six weeks, what would we do on day one, day ten and day forty?
• Which of our biggest assumptions have we never stress-tested?
• Does the person who understands our greatest risk have a seat where our priorities are set?
• When did we last run a premortem on a major decision?
• Are we confusing the confidence of our forecasts with the predictability of our world?

Sources and Further Reading

• KPMG, 2026 Global CEO Outlook, and CEO Outlook UK 2026.
• PwC, 2026 Global CEO Survey.
• The Conference Board, C-Suite Outlook 2026.
• Coverage of the M&S cyberattack costs, Associated Press via IOL (November 2025).
• Cyber Monitoring Centre estimate of the Jaguar Land Rover attack, Business Insurance (2025).
• Frank H. Knight, Risk, Uncertainty and Profit (1921).
• Nassim Nicholas Taleb, The Black Swan (2007).
• Gary Klein, "Performing a Project Premortem," Harvard Business Review (September 2007).
• Karl E. Weick and Kathleen M. Sutcliffe, Managing the Unexpected (3rd ed., Wiley, 2015).
• Daniel Kahneman, Thinking, Fast and Slow (2011).
• Seneca, Letters to Lucilius.

Want your executive team sharper under pressure? Dr. Sweis's keynote and workshops on judgment and decision making help leaders spot blind spots before they become costly. Book a keynote or explore executive coaching.