Riskification and the production of threat: A comparison of risk assessments in cybersecurity and counter-terrorism

This article foregrounds the riskification of cybersecurity – the transition from pre-empting threat to governing risk – through a comparison of the U.S. government intrusion detection system EINSTEIN and parts of the UK counter-terrorism programme Prevent. Extensively theorised within both cybersecurity and counter-terrorism, calculating, profiling and governing risk has become the default mode of security governance, algorithmically producing subjects of insecurity. However, a closer, comparative read of the sociotechnical configurations that underpin specific modalities in risk assessment systems reveal important differences: Whereas Prevent more clearly presupposes normative subjects and standards of (in)security, EINSTEIN’s anomaly detection engenders threat not as a binary or normative distinction but as a separate category of risk. Highlighting these differences enables a deeper understanding of speculative security practices as such, and of how they may be theorised. In particular, the article shows how ‘meaning-making’ and ‘sense-making’ are processes that shape both security responses and timelines through which risk is conceptualised in different ways. Moreover, it reveals that rather than being fixed, risk and (in)security is perpetually co-produced with the tools used for assessment: The production of (in)security hence has little to do with real or imagined risk but rather emerges from a particular configuration of social, political and technological relations.