Built Wrong

In February 2024, people stood at pharmacy counters across the country and were told the system was down. Cancer medication. HIV medication. Psychiatric prescriptions. No timeline. No explanation. No alternative. A ransomware crew had taken down Change Healthcare the clearinghouse that touches one in three American patient records. Roughly 192.7 million people, more than half the country, would have their information exposed by a company most had never heard of and none had chosen.

Nobody standing at that counter had a vote in any of it.

Built Wrong is about how failure got priced in.

Reported cybercrime losses in the United States were roughly $800 million in 2014. Ten years later, the FBI put the figure at $16.6 billion. In 2025, it passed $20.9 billion. Every year of that run set another record for cybersecurity spending. Nobody was ever required to prove any of it worked.

There is no scoreboard. No accident record. No accepted instrument anywhere in the profession that answers the question every board should be asking:

Is this organization harder to compromise than it was twelve months ago?

The bad guys have an answer. Their revenue went up.

Richard Bird helped build this. Thirty years running security and technology organizations, more than a decade of it at JPMorgan Chase, buying and building the products, implementing the frameworks, inside the machinery he now argues was built to measure everything except whether it worked.

Cybersecurity did not fail in one place. Built Wrong works through three decades of it: the economics, incentives, governance, lines of authority, measurement systems, and institutional habits. Each arrives at the same destination on its own, which is why fixing any one of them has never been enough.

The industry learned to measure activity without ever proving performance.

That is the diagnosis, and it is the easy half. The rest of the book builds the instrument that does not exist, from the forensic record of real incidents, in enough detail to be argued with.

Built Wrong develops the Three Dynamics of Security Performance, a model of cybersecurity as a measurable discipline organized around Exposure, Interdiction, and Consequence. It proposes an institution that cybersecurity was built once, and then dismantled: an equivalent of the accident record that transformed aviation safety, a common body of evidence showing whether security is improving and what actually changes outcomes.

Written for the CISO who has run out of ways to explain a program that is working and losing. For the executive trying to understand what the security budget actually buys. The board member asked to govern a risk that nobody has handed them an instrument to measure. For the regulator trying to improve outcomes with disclosure and prescribed activity.

And for anyone who has heard one more breach called sophisticated and known better.

Aviation does not tell passengers that crashes are inevitable. It tells them, with evidence, whether flying is getting safer. Cybersecurity has never once been asked to do the same.