Requisite Variety

When to use

"Use when a control system is failing to control a system. The control system must have at least as much variety (complexity, responsiveness) as the system it controls. If it does not, it will be overwhelmed."

Example

"A simple firewall (limited variety — allow/deny by port) cannot control a sophisticated threat actor (high variety — encrypted channels, social engineering, supply chain attacks). The control system's variety is insufficient. Adding more rules to the firewall does not help; the control system needs more variety (behavioral analysis, threat intelligence)."

Common misuse

"Adding more rules to a low-variety controller and expecting it to control a high-variety system. More rules of the same type do not increase variety; they increase rigidity. Variety requires new types of response."

Also known as

Related models