This paper reflects upon the experience of a 3-year-long pilot process of drafting inductive use case scenarios about emerging security threats and roadmapping future capability requirements for preparedness and response. Major focus thereby has been the exploration of conditions for coping with (desired and undesirable) disruption, including hybrid threats, cascading cross-sectoral spill-over effects, as well as complex entangled emergencies. The scenario process was performed in an EU-wide process with first responders from Law Enforcement and Border Control agencies, international bodies, such as satellite and critical infrastructure agencies, as well as with security policymakers at state level and at EU institutions level. The iterative table-top scenario games have had as ultimate objective to identify “criticality zones”, and, consequently, produce security capability requirements for the EU, disaggregated along technological, human-related, organizational, and regulatory dimensions.
The author, coming from policy analysis and advice to governmental and international bodies, has been co-responsible for the design, conduct, evaluation, and transfer of the results of the scenario exercise to the target stakeholder groups. This paper will accordingly single out and draw lessons along the following three aspects: First, the limited capacity of practitioners to commit to and use the results of a forward-looking exercise; Second, the challenge of indulging into not-probable/non-plausible high-impact scenarios, which generate catastrophic surprise to organizations with security mandate; Third, the crucial role of self-inflicted blinders giving rise to uncomfortable knowledge, which then systematically gets within organizations distracted from or suppressed into the cognitive category of “Unknown Knowns”.