Training & Security Leadership
Systems Thinking, Not Tools, Increasingly Separates Senior Talent From Peers
Most people remember the Six Degrees of Kevin Bacon game. You start with any actor and, within a few moves, you can usually connect them to Kevin Bacon through shared films. The game is about pop culture trivia but the lesson was never really about movies. It was about networks, proximity and how quickly distance collapses once you trace relationships instead of assuming separation. That same logic applies cleanly to modern cybersecurity risk and to how careers advance in this industry specialty.
See Also: Going Beyond the Copilot Pilot – A CISO’s Perspective
Why the Metaphor Works for Supply Chain Risk
Risk is frequently discussed as if it enters through direct technical failures, such as phishing emails, exposed servers or missed patches. But many disruptive incidents do not arrive that way. They arrive through trusted relationships that feel indirect, inherited or outside one’s immediate control. In practice, disruption often propagates through a sequence of operational dependencies that are neither obvious nor directly managed by the affected organization. The number of degrees between “not our system” and “our outage” is often small. What is large is the gap in visibility. Like the Kevin Bacon game, the connection was always there – most teams simply did not trace it.
This is why supply chain and third-party risks have moved from a compliance concern to a board-level conversation. The issue is not “do you trust your vendors?” It is: “Do you understand how many steps away a single point of failure sits from your ability to operate?”
A Recent Reminder That Distance Is an Illusion
A recent ransomware attack against DXS International, a healthcare technology provider supporting NHS England, disrupted administrative and operational services relied upon by thousands of general practitioner offices. Front-line clinical care largely continued, but systems tied to referrals, scheduling and other backend workflows were affected across a wide network of hospitals and clinics. Many impacted organizations were not direct customers of DXS International, nor did they manage that vendor relationship themselves. Some had never encountered the provider by name, yet their operations were still constrained.
The technical root cause matters, but the structural lesson matters more. Risk exposure emerged through layered dependencies rather than direct compromise. In reality, their Kevin Bacon number was low. Their awareness of that relationship was not.
This pattern is becoming more common. As ecosystems grow more interconnected, indirect dependencies increasingly determine who feels the blast radius of an incident.
So How is This Related to Cybersecurity Careers?
This is where the metaphor becomes useful beyond risk management. Cybersecurity careers do not plateau because people lack technical knowledge. They stall because professionals remain focused on their immediate role and fail to demonstrate systems thinking. Hiring managers and leaders are listening for something more nuanced than tool proficiency. They are listening for whether you understand how your work connects to outcomes you do not directly own.
The Career Version of Six Degrees
You can map professional maturity using the same framework. Degree one is your tasks, the tools you use, the alerts you triage and the controls you manage. Degree two is adjacent teams, who depends on your output and whose work enables yours, including engineering, legal, procurement and finance. Degree three is external dependencies, vendors, platforms and services your organization relies on even if they are not in your job description. Degree four is business impact, revenue interruption, patient care delays, regulatory exposure and customer trust erosion. Early-career professionals tend to speak comfortably at degree one. Mid-career professionals start to incorporate degree two. The people who advance into senior technical, architectural or leadership roles can articulate all four. That distinction shows up clearly in interviews.
What Strong Candidates Do Differently
Many candidates describe responsibilities accurately. They talk about managing vendor risk assessments, reviewing SOC reports or supporting third-party compliance. Stronger candidates describe relationships and consequences. They explain how a vendor outage would affect billing or care delivery, where visibility ended beyond tier-one suppliers and how risk acceptance decisions shifted once dependencies were understood. That language signals readiness for broader responsibility. It shows the candidate understands not just how controls work but also why they matter to the organization as a whole.
Why This Matters Now
The cybersecurity job market has matured. Certifications are common, and tool familiarity is expected. What differentiates professionals is their ability to reason across boundaries. Supply chain risk provides a clear lens through which that capability becomes visible. Incidents tied to third-party dependencies tend to elevate the same people every time. Not because they caused the fix, but because they could explain the problem clearly to leadership, trace the relationships quickly and translate technical disruption into business impact. Those moments are career accelerators. They do not reward panic. They reward perspective.
What This Means for Career Growth
If you want this metaphor to work for you professionally, the application is straightforward. Stop treating third-party risk as paperwork. Stop describing your role as isolated. Start mapping how your work connects to systems you do not own. Ask yourself what breaks if your function fails, who downstream feels it first and how many degrees away a single external dependency is from that outcome. You do not need a leadership title to think this way. You need curiosity and the willingness to look beyond your immediate scope.
The reason Six Degrees of Kevin Bacon stuck in popular culture is simple. It revealed how small the world is once connections are traced honestly. Cyber risk works the same way. So do careers. The connection between where you are and where you want to be is usually shorter than it appears. The difference is whether you are willing to map the chain.