Security outcomes depend on effort in three different ways. In weakest link problems, the least careful party sets the result. In best shot problems, one strong defender is enough. In total effort problems, everyone's work adds up. Knowing which applies tells you where to spend money and attention.
Where the models come from
Anderson and Moore trace the idea to Hirshleifer, who told a story of an island whose flood defences were built by individual families. The island's safety depended on its laziest family. He contrasted that with a city whose defence against missiles depends on the single best defensive shot. Hal Varian extended this to three cases relevant to information systems: minimum effort, best effort, and sum of efforts.
Weakest link
Program correctness can depend on the most careless programmer introducing a vulnerability. Phishing resistance across a company is similar. One employee who clicks can be enough.
Anderson and Moore note that in this case, adding agents makes systems less reliable, and the party with the lowest benefit to cost ratio dominates. Hiring more people increases the chance one is the weak one.
What to do: raise the floor. Use defaults, guardrails and automated checks so that the worst day of the worst contributor is still acceptable.
Best shot
Security can depend on the best effort, such as the work of a champion architect. One excellent design review can stop a class of problem for everyone.
What to do: find and protect the few people whose judgment matters most, and give them leverage through templates and review rights.
Total effort
Vulnerability testing often depends on the sum of everyone's effort. More testers find more bugs. The paper notes that the burden tends to fall on those with the highest benefit to cost ratio, while others free-ride.
What to do: make contributing cheap and visible, and share the load on purpose.
A quick sorting exercise
Pick a risk and ask three questions.
- If one person or component fails, is the whole thing compromised? Then it is weakest link.
- Does one good defender neutralise the risk? Then it is best shot.
- Does each extra check reduce residual risk a bit? Then it is total effort.
Dependency risk is often weakest link: one vulnerable transitive package can be the entry point. A pull request gate that blocks that package sets a floor. Safeguard's policies and gates do this at the pull request, and dependency scanning feeds them.
Quick check
Why does hiring more developers not always make code safer?
If safety depends on the weakest contributor, more contributors add more chances for a weak one. Raising the floor with guardrails helps more than adding headcount.
Which model fits penetration testing?
Mostly total effort, since more testers and more hours find more issues.
Sources
Last reviewed: 19 October 2026.
