Key Takeaways:
- Imagination alone isn’t enough for adequate polycrisis strategies. Threat modeling grounds foresight in basics—actors, vulnerabilities, attack paths, and mitigations—and backcasts that logic into today’s budgets, controls, and policies.
- Existing literature offers tested methods (threatcasting), academic frameworks (multidimensional cyber-foresight), empirical studies (threat drivers), and practitioner playbooks (future-back modeling) for such transdisciplinary synthesis. Deeper integration is possible and necessary.
- Polycritical foresight is the disciplined synthesis of futures thinking, threat modeling, and systems thinking—a practice that not only envisions multiple possible crises but actively stress-tests them against adversaries, vulnerabilities, and cascading risks—then backcasts those insights into today’s policies, budgets, and defensive strategies.The polycrisis describes an era in which multiple, overlapping, and interacting crises are unfolding simultaneously. Climate change, geopolitical instability, financial fragility, technological risks, pandemics, and social polarization are not only simultaneous but interdependent, impacting each other in ways predictable and not. Traditional foresight methods, such as scenario planning, horizon scanning, Delphi surveys, have long helped governments, corporations, and civil society navigate uncertainty, but the scale and interconnectedness of today’s challenges demand a deeper commitment to transdisciplinary approaches. What is needed for the scope and scale of polycrisis is what I call polycritical foresight.
So, how can we develop more robust preparedness in the face of polycrisis? First: by blending classic foresight with a discipline from cybersecurity: threat modeling. Done together, they move us beyond imagining plausible futures to stress-testing those futures against the actors, dynamics, and vulnerabilities that make crises contagious—and then backcasting to concrete actions we can take now. This is the essence of threatcasting, a relatively new methodology proposed by Natalie Vanatta and Brian David Johnson in 2018.
This proposal (among others) persuasively argues for synthesis between these two domains. But where a gap persists is in execution—these are typically framed in a reactive posture and/or set against dystopian backdrops. I believe there is further demand for futurists to incorporate threat modeling practices into foresight strategy across scales, and critically: take as given that the polycrisis is omnipresent in all scenarios, rather than generating scenarios that specifically depict or examine collapse (e.g., “decline and collapse” scenarios in Dator’s Four Futures). There has never been a greater need for linking the tactical affordances of threat modeling with foresight and systems thinking, weaving together imagination, historical analysis, and a grasp of the interrelatedness of contemporary crises. Polycritical foresight can strengthen the resilience of positive futures, ensuring that desirable pathways are not derailed by adversarial action or cascading fragility.
Comparing and Contrasting Foresight Strategy and Threat Modeling
Threat modeling and strategic foresight have traditionally been separate practices in risk management. Threat modeling is most often associated with cybersecurity and defense; it involves identifying potential adversaries, attack vectors, and system vulnerabilities in order to prioritize mitigations. Conventional threat modeling approaches (e.g., STRIDE or PASTA) analyze known threat actor tactics and historical attack patterns to map out “worst-case scenarios” for a given system. This adversary-focused (often technical) process helps organizations harden their systems against attacks we know how to expect.
Strategic foresight, meanwhile, comes from futures studies and strategic planning. It involves systematically exploring how emerging trends and uncertainties might play out in multiple future scenarios, often five, 10, or even 30 years out. Techniques are used to imagine different plausible futures (both desirable and undesirable) and to devise strategies that either encourage or prevent those outcomes. Rather than prediction, foresight is about preparedness; it helps anticipate emerging trends, rather than be surprised by change.
Put simply, where threat modeling asks “How could we be attacked next?” strategic foresight asks “What else could happen, and what would we do if it did?”
At their intersection lies a crucial question: How can we better anticipate and mitigate future threats that lack historical precedent? This is increasingly salient as technological and geopolitical change accelerates. Cybersecurity professionals find that focusing only on yesterday’s attacks leaves blind spots for novel exploits. Likewise, national security strategists see the need to prepare for “unknown unknown” threats (from AI-enabled cyber weapons to bioengineered agents) which demand imaginative foresight. Thus, in the past decade, futurists and threat modelers have proposed blended approaches that incorporate forward-looking scenario analysis into the threat modeling processes. This is epitomized in threatcasting, mentioned above, as well as other proposals that include “strategic threat modeling” and “multidimensional cyber-foresight” (among others outlined below).
Foresight and its Limits in Polycrisis
Foresight is an essential tool for expanding strategic thinking. It encourages us to consider multiple futures rather than relying on a single prediction. Common foresight methods include: horizon scanning (monitoring signals of change), scenario planning (building legible narratives about alternative futures), Delphi methods (eliciting expert consensus about emerging risks), and trend analysis (projecting forward from historical data).
These methods can be used to surface possibilities and challenge assumptions, but they often struggle with 3 challenges in the context of polycrisis:
Adversarial dynamics. Many crises aren't passive events that simply “happen”; they involve deliberate actions taken by states, corporations, or other groups that exploit vulnerabilities.
Systemic vulnerability. The polycrisis is epitmozed by interdependence. A single shock can cascade through multiple systems, altering and reinforcing other factors.
Actionability/Operability. Many foresight practices and outputs spark reflection but often don’t necessarily provide concrete steps for establishing resilience and preparedness.
Enter: threat modeling.
What Is Threat Modeling?
Threat modeling originated in information security as a way for organizations to proactively anticipate and mitigate cyber risks. It helps us structure our thinking like adversaries and identify weak points, based on the following series of questions:
What are you protecting? (referenced below as assets)
Who might attack you? (i.e., adversaries)
Where are your weak points? (i.e., vulnerabilities)
How could a threat manifest? (i.e., attack vectors)
What can you do to reduce the risk? (i.e., mitigations)
TLDR: Threat modeling is about stress-testing systems to reveal blind spots and indicate the capabilities needed to proactively mitigate risk.
How Threat Modeling Enhances Foresight: Polycritical Foresight in Action
By weaving the logic of threat modeling into foresight, we can make the resulting strategy proposals more robust and actionable.
Incorporating Adversarial Intelligence
Foresight exercises risk treating crises like unavoidable external forces (a la natural disasters), but they are often the result of deliberate choices. Threat modeling forces us to identify who the key actors are and imagine their motivations.
Mapping Real-World Vulnerabilities in Systems
While foresight often allows us to sketch broad drivers of change (e.g., AI adoption), threat modeling drills down into the specific vulnerabilities of a system, asking: “Where are the single points of failure?” This focus helps us grasp how the polycrisis could actually reverberate across systems, and the nth order effects that might follow.
Enabling Prioritization
A common critique of foresight is that it overwhelms decisionmakers with too many possibilities and signals; threat modeling provides a way to address these concerns by scoring threats based on likelihood and potential impact. Clients can thus focus their resources where they matter most, even in amid ongoing uncertainty.
Connecting Awareness to Mitigation
It’s easy to create a vivid scenario and then leave the audience wondering, “So…what now?" Threat modeling shrinks this gap, moving from vulnerabilities to specific mitigation strategies. The goal is to identify defensive investments (literal and proverbial) that are effective across a range of possible futures.
How Foresight Enhances Threat Modeling
Where foresight methodologies can benefit from threat modeling, the same is true in reverse. Many threat modeling frameworks still rely heavily on past attack patterns and overlook “unknown unknowns.” There is often an “insufficient integration of foresight into security strategies,” as one study noted, leading to an “unawareness gap” in preparing for emerging risks.
Bridging this gap will require greater collaboration among security experts and futurists, organizational culture shifts to embrace long-term thinking, and development of tools to systematically incorporate foresight insights into day-to-day risk management. Though it’s not in the scope of this article to elaborate on these points in depth, I will note that areas for improvement include developing metrics for success of foresight-informed security measures, training analysts in futurist techniques, and ensuring executive buy-in for proactive (rather than purely reactive) security investments.
What Scholarship Already Exists at This Intersection?
As I mentioned above, I’m not starting from zero here; there’s a growing body of work fusing foresight with threat analysis:
Threatcasting (Vanatta & Johnson, 2018). A 10-year threat methodology that integrates futures studies with military planning; outputs include narrative scenarios, early indicators (“flags”), and backcasted action plans.
Multidimensional Cybersecurity Framework for Foresight (Onwubiko & Ouazzane, 2021–22). Proposes a 6-domain framework (Physical, Cultural, Economic, Social, Political, Cyber) underpinned by situational awareness to ensure socio-technical drivers inform cyber risk planning.
Strategic foresight for security (Vescent & Blakley, NSPW 2018). Foresight run with security pros (interviews, scenarios, backcasting), derives “new security paradigms” (e.g., from reactive to proactive security; human-centered design). Concludes that futurist-security collaboration yields more robust strategies.
Threat drivers research (Raban & Hauptman, 2018). Long-term foresight study drawing out major threat drivers and assessing how emerging technologies amplify defense and attack capabilities.
Industry practice notes. Futures Platform summarizes how to embed scanning, scenario workshops, and iteration into cyber strategy; Team Cymru frames adaptive threat models that blend strategic foresight with preparedness.
Future-back threat modeling (Vu Van Than, ISC2, 2025). A method developed to counter “past-pattern bias”; models hypothetical future attacks, challenges hidden assumptions, and uses honeypots + anomaly-hunting to surface tactics, techniques, and procedures (TTPs).
Defense/intel foresight. National-security voices arguing for using layered time horizons (5/15/30-year) and threat-scenario programs for emerging science/tech risks; analyses of “Havana Syndrome” as foresight failure case study.
Incorporating Threat Modeling into Foresight
Scenario stress-testing + backcasting (adapted from threatcasting)
1) Build three-four divergent scenarios; 2) For each one, list assets, adversaries, vulnerabilities, and attack vectors; 3) Note possible “flags” (risks to track) and “gates” (interventions); 4) Backcast from these to the present to develop strategies.
Polycrisis “attack trees”
Convert interdependencies into attack trees that grapple with cascades (e.g., drought begets crop failure begets export bans begets food-price spikes begets unrest); note interventions/mitigations (aligned with threat-model practice and complements cyber-foresight).
Actor-centered scanning (adapted from Multidimensional Cyber-Foresight)
Expand scanning to monitor behaviors of those who could exploit vulnerabilities; combine with drivers. Multidomain lenses reveal risks from beyond narrow boundaries of just “tech.”
Resilience portfolios
Use threat models to build cross-scenario mitigation portfolios, per industry guidance to frame threat modeling as continuously updated program vs. isolated artifact.
Hypothetical Case Studies
What follows are broad examples to depict how threat modeling can enhance scenarios produced using foresight methodologies. These are meant as invitations to possibility rather than exhaustive breakdowns.
Climate x Finance
The accelerating shift toward decarbonization has linked climate policy directly to global economic stability. As “green” tech investments, carbon-credit markets, and critical-mineral supply chains scale, they open up new pathways for opportunity and exploitation. Imagine futures where the success or failure of climate policy is inseparable from financial resilience, making it a front line for for adversarial action, cascading impacts, and crises of public trust.
Assets: financial stability, energy supply, public trust.
Adversaries: hedge funds, authoritarian regimes, cybercriminals.
Vulnerabilities: overconcentration of investment in a few technologies, dependence on fragile supply chains for critical minerals, politicized central banks.
Attack vectors: speculative carbon-credit bubbles, coordinated attacks on energy infrastructure, disinformation undermining climate policy.
Mitigations: diversified investments, stronger cybersecurity, international agreements on mineral supply governance.
Regulators, policymakers, and institutions can use polycritical foresight to anticipate where climate action intersects with financial fragility and adversarial behavior. Monitoring flags like sudden volatility in carbon-credit markets, anomalous cyber activity targeting energy infrastructure, or sharp fluctuations in critical mineral supply chains can provide early warnings of systemic risk. Decisionmakers could use these to activate gates like emergency trading circuit breakers and cybersecurity protocols.
AI in Healthcare
AI-driven healthcare systems (ranging from diagnostic algorithms to robotic surgery platforms) hold the potential for increased efficiency and expanded access, but are also vulnerable to misuse. Consider future scenarios where a given nation’s healthcare infrastructure relies heavily on AI.
Assets: Patient data, trust in healthcare, availability of accurate diagnosis and treatment.
Adversaries: Cybercriminals ransoming hospitals; actors destabilizing public trust; insider threats manipulating algorithms for financial and/or political gain.
Vulnerabilities: Dependence on opaque AI models; fragile supply chains for smart devices; insufficient regulation of algorithmic outcomes/accountability.
Attack Vectors: Data poisoning that degrades model accuracy; ransomware attacks targeting hospital infrastructure; disinformation campaigns to erode trust in healthcare.
Mitigations: Rigorous testing of healthcare algorithms before deployment; redundant diagnostic pathways that ensure accuracy; resilient patient-data pipelines; global standards for AI use in medicine.
Stakeholders can design safeguards against these misuse scenarios by monitoring early warnings such as unexplained spikes in diagnostic error rates, coordinated social-media narratives about AI “failures,” or supply-chain disruptions of critical AI hardware.
Biosecurity and Engineered Pathogens
Synthetic biology and gene-editing technologies have enormous potential in medicine, agriculture, and sustainability, but also create new risks like engineered pathogens or accidental releases/leaks. Consider futures in which cheap, widely accessible bioengineering capabilities let bad actors design novel viruses faster than global health systems can respond.
Assets: Public health and safety, globalization, trust in scientific institutions, continuity of healthcare systems.
Adversaries: Rogue states seeking competitive advantage, extremist groups experimenting with bioweapons, insiders at research labs, or “biohackers” unintentionally producing harmful organisms.
Vulnerabilities: Uneven biosecurity standards across labs, gaps in international governance/coordination, reliance on centralized vaccine production facilities, lack of rapid surveillance.
Attack Vectors: Release of engineered pathogens, manipulation of genetic supply chains, disinformation campaigns undermining trust in vaccines and public health responses.
Mitigations: Stronger oversight and certification of synthetic biology; global safety standards; investment in rapid vaccine production platforms; integration of genomic surveillance into public health; international cooperation agreements for early outbreak detection/mitigation.
Health/national security agencies and biotech companies can monitor early warning systems such as spikes in unusual DNA synthesis requests, unexplained clusters of illness in regions with biotech hubs, or coordinated narratives sowing doubt about public health authorities. They could then develop methods to halt suspicious synthesis orders, implement rapid-response epidemiology teams, or invoke emergency collaboration agreements to scale vaccine development and distribution.
Implementation Pattern (What “Good” Looks Like)
The polycrisis is dynamic, so polycritical foresight must be too. Futurists can adopt the following sample implementation plan to ensure that strategy, facilitations, and advisory are robust:
Standing cadence. Quarterly/seasonal horizon-scan and scenario reports + annual “future-back” threat modeling sprints.
Indicator tracking. Maintain a shared list of flags (early indicators) mapped to each modeled threat; instrument dashboards to watch them.
Backcasted roadmaps. For each priority scenario, identify “gates” (policies/controls) and assign accountable owners, deadlines, and test criteria.
Multidomain coverage. Use the six-domain lens to catch extra-technical drivers.
Red/blue teaming with futures. Test tomorrow’s potential tactics, techniques, and procedures (drawing on game theory and frameworks like MITRE ATT&CK) through tabletop exercises or live-fire drills (mirrors best practices in both industry and defense operations).
Program maturity. Tracking how well threat-modeling practices are adopted and used in practice (i.e., who owns them, how often they’re updated, and whether they inform real decisions).
Toward Polycritical Foresight
We now live in an era when crises are no longer isolated events but part of a dense web of interacting risks. Foresight has always been about expanding our imagination, but imagination alone is not enough. We need sharper tools to identify where we are exposed, who might exploit those exposures, and how crises could ripple through our interconnected systems. Threat modeling without futures thinking risks clinging to yesterday’s attack patterns.
Bringing these two fields together isn’t without its challenges. Threat modeling, which works well for bounded systems, can be messy when applied to the global scale. There's also the risk of creating a false sense of precision, fostering undue paranoia, inducing scope creep, or running into political sensitivities when naming adversaries. Furthermore, more collaboration is necessary between futurists and security researchers to ensure they have a shared language to minimize cross-talk and blindspots.
Still, I believe the juice is worth the squeeze, resulting in more actionable foresight that is better attuned to the complex, interconnected nature of the polycrisis. This fusion does more than help us anticipate collapse. It equips us to improve strategic recommendations across all futures—even ones framed in a positive light—by making them more specifically resilient to adversaries, weak links, and cascading risks. Polycritical foresight weaves together foresight to expand the horizon of what might unfold; threat modeling to sharpen that horizon into actors, vulnerabilities, attack paths, and mitigations; and a clear grasp of how the polycrisis represents an interdependent system rather than a list of disparate crises. This practice is how we build strategies strong enough to withstand cascading risks—and flexible enough to adapt when confronted with unexpected emerging realities.