In February 2024, people stood at pharmacy counters across the country and were told the system was down. Cancer medication. HIV medication. Psychiatric prescriptions. No timeline. No explanation. No alternative. A ransomware crew had taken down Change Healthcare the clearinghouse that touches one in three American patient records. Roughly 192.7 million people, more than half the country, would have their information exposed by a company most had never heard of and none had chosen.
Nobody standing at that counter had a vote in any of it.
Built Wrong is about how failure got priced in.
Reported cybercrime losses in the United States were roughly $800 million in 2014. Ten years later, the FBI put the figure at $16.6 billion. In 2025, it passed $20.9 billion. Every year of that run set another record for cybersecurity spending. Nobody was ever required to prove any of it worked.
There is no scoreboard. No accident record. No accepted instrument anywhere in the profession that answers the question every board should be asking:
Is this organization harder to compromise than it was twelve months ago?
The bad guys have an answer. Their revenue went up.
Richard Bird helped build this. Thirty years running security and technology organizations, more than a decade of it at JPMorgan Chase, buying and building the products, implementing the frameworks, inside the machinery he now argues was built to measure everything except whether it worked.
Cybersecurity did not fail in one place. Built Wrong works through three decades of it: the economics, incentives, governance, lines of authority, measurement systems, and institutional habits. Each arrives at the same destination on its own, which is why fixing any one of them has never been enough.
The industry learned to measure activity without ever proving performance.
That is the diagnosis, and it is the easy half. The rest of the book builds the instrument that does not exist, from the forensic record of real incidents, in enough detail to be argued with.
Built Wrong develops the Three Dynamics of Security Performance, a model of cybersecurity as a measurable discipline organized around Exposure, Interdiction, and Consequence. It proposes an institution that cybersecurity was built once, and then dismantled: an equivalent of the accident record that transformed aviation safety, a common body of evidence showing whether security is improving and what actually changes outcomes.
Written for the CISO who has run out of ways to explain a program that is working and losing. For the executive trying to understand what the security budget actually buys. The board member asked to govern a risk that nobody has handed them an instrument to measure. For the regulator trying to improve outcomes with disclosure and prescribed activity.
And for anyone who has heard one more breach called sophisticated and known better.
Aviation does not tell passengers that crashes are inevitable. It tells them, with evidence, whether flying is getting safer. Cybersecurity has never once been asked to do the same.
Industry Reviews
"I was one of the lucky ones who got to read the early drafts of Richard's book "Built Wrong." I've had the privilege of getting to know Richard well over the years, and what I've always admired about him is his fearlessness and his unflinching commitment to truth. "Built Wrong" is a book filled with uncomfortable truths. I'm sure that it will anger quite a few people, but hopefully it will open the eyes of even more."
John Kindervag, Creator of Zero Trust
"For many decades, cybersecurity leadership has been trapped in a repeating cycle of recycled conversations and bad investments, leading to a net-negative security posture. The core of this failure is a strategic misalignment: CISOs continue to operate as cost centers, making technology investments without connecting them to business outcomes. The adversaries are operating with a business mindset, which is the lesson leadership needs to internalize. We are losing because we are playing the wrong game. The recommended path forward is to adopt a new operational model, as articulated by Richard Bird in the very book you are holding in your hands, which promises to link cyber investment to concrete security results and break this decades-long stagnation."
Jeffrey Wheatman - Cyber Risk Leader and Former Gartner Analyst
"Cybersecurity is the only industry of its size that renamed its defects and called it progress. Richard Bird spent three decades inside the machine watching organizations do everything the system asked of them and still lose. Built Wrong applies systems dynamics thinking that MIT has used for sixty years to explain why well-run organizations unintentionally produce disaster: a self-reinforcing loop where a broken narrative picks the wrong metric, the wrong metric rewards the wrong incentive, and the wrong incentive builds architecture that satisfies the metric instead of stopping the attack. Spending more money without touching the flawed logic within the loop just feeds it. Bird names the flaw and then shows us how to clearly solve it."
Dutch Schwartz, AI Security thought-leader and 2x LinkedIn Top Voice
"Richard has done the hard thing; he has put into succinct words what seasoned identity professionals know in their bones. He does so without assigning blame or victimization. And most importantly, he shows us a path forward."
Ian Glazer, Founder IDPro and Digital Identity Expert
"I have run global identity at the scale this book describes, and Richard is not exaggerating. He says out loud what most of the industry pays consultants to avoid: the model is built wrong, we mistook activity for impact, and we still fund identity like a discretionary line item. If you own, fund, or answer for enterprise identity, this is not optional reading. You cannot govern the exposure until you understand it. Read it before your 3:47 a.m. alert does the explaining for you."
Steve Tout, Founder / CEO, Identient and Author, CISO On The Razor's Edge
