What these foundations can and cannot do¶

The material in this section draws on work developed by Virginia Satir, Gerald Weinberg, and related thinkers in organisational development, change management, systems thinking, and learning design. It is useful. It is also limited in specific ways that are worth being clear about before applying any of it.

What these foundations offer¶

They offer ways of seeing. The Satir Change Model makes the chaos phase of a transition visible and names it as structural rather than exceptional. ChangeShop makes the homeostatic resistance of organisations visible and names it as systemic rather than personal. Problem-solving frameworks make the gap between stated problems and actual ones visible and name it as the normal starting condition rather than an anomaly.

Applied to security, these lenses change what you look at. They make the political layer of a security problem visible alongside the technical one. They make communication patterns visible as a factor in whether honest reporting reaches the people who need to act on it. They make the model that has been quietly wrong for eighteen months visible as a candidate for investigation rather than a given.

They are also complementary to each other. The Satir model describes the emotional and behavioural shape of change. ChangeShop describes how to work with a system that resists change. Systems thinking describes the structural conditions that produce the problems you are trying to address. Montessori principles describe how to design environments where learning and capability development actually happen. Used together, they provide a more complete picture than any one of them does in isolation.

What these foundations cannot do¶

They cannot replace domain knowledge. Understanding the Satir change model does not tell you how to design a pipeline, run a purple team exercise, or build an ISMS. These foundations inform how you work with people and organisations while doing those things. They do not substitute for technical competence in the work itself.

They are not prescriptive. None of them tell you what to do in the specific situation in front of you. They describe patterns and dynamics. How those patterns apply in a particular organisation, at a particular moment, with a particular set of constraints, requires judgement that no framework can provide in advance.

They do not guarantee outcomes. The Satir model implies that organisations which survive the chaos phase tend to reach a new and often better equilibrium. Often, not always. It does not guarantee that every organisation will get there, or that the new equilibrium will be better in all respects, or that the change will produce the results it was designed for. New status quos can be worse than old ones, or only differently problematic. The model maps what tends to happen; it does not determine what will.

They cannot substitute for the relational and structural work of change. Knowing that resistance is information rather than obstruction does not remove the difficulty of working with people who are resistant. Knowing that the chaos phase is expected does not make it easier to hold an organisation’s nerve during it. The frameworks point toward the work. They do not do the work.

A note on context¶

These frameworks were developed primarily in Western, English-speaking, and often corporate or therapeutic settings. They carry assumptions about how organisations function, what constitutes good communication, and what change looks like that may not transfer without adjustment to different cultural, political, or structural contexts.

They also reflect particular historical moments. Satir’s work emerged in the mid-twentieth century. Weinberg’s extensions and elaborations accumulated over decades of work with software organisations that were, for much of that time, a specific kind of institution. Applying these frameworks to current security practice requires some translation and some critical distance.

How to use them¶

Use them as lenses, not recipes. A lens changes what is visible. It does not prescribe what to do with what you see.

Use them in combination. A situation that looks like a communication problem through one lens may look like a structural problem through another. Both readings may be accurate, and the most useful intervention may address both simultaneously.

Use them with scepticism. If a framework seems to explain everything too neatly, the neatness is probably wrong. Real situations are messier than any model accounts for. The frameworks are useful precisely because they make some things clearer, not because they eliminate ambiguity.

Treat the criticisms as part of the material. The limitations of the Satir model, the conditions under which ChangeShop insights do not apply, the ways in which systems thinking can become an excuse for inaction: these are as worth understanding as the frameworks themselves.