The Paranoidist | Issue #5 By Paul Morin | March 7, 2026

On February 28, the United States and Israel launched coordinated strikes across Iran. Within six hours, Iran retaliated against U.S. military installations in six countries. Missiles struck Bahrain, Kuwait, Qatar, the UAE, Jordan, and Saudi Arabia. Oil tankers began avoiding the Strait of Hormuz. Israel declared a state of emergency. Gulf states that had spent weeks lobbying against the strikes found themselves activating air defenses against Iranian missiles they never wanted to be in the path of.

A week earlier, in The Paranoidist's first flash issue, I had argued that the containment assumption, the belief that strikes would be a discrete event with a beginning, a middle, and an end, would fail. Not because any single escalation vector was unmanageable, but because five of them would run concurrently, and the portfolio math worked against simultaneous containment. When the strikes came, containment failed in six hours.

I am not revisiting the Iran analysis today. I am asking a different question: why did so many smart, experienced analysts, strategists, and decision-makers believe containment would hold? Why did the markets barely price the correlated scenario? Why did the strategic debate treat a strike on Iran as a move in a game, one with predictable counter-moves and a manageable endgame?

The answer is that most strategic analysis, whether in national security, corporate risk management, or investment strategy, still relies on the intellectual architecture of game theory. And game theory, for all its elegance, is built on assumptions that collapse in exactly the scenarios where getting the analysis right matters most.

Those assumptions are not presented as assumptions. They are embedded so deeply in the analytical frameworks that they feel like facts. They are assumptions dressed up as analysis. And they are failing.

Game theory, formalized by John von Neumann and Oskar Morgenstern in the 1940s and extended by John Nash and Thomas Schelling in subsequent decades, provides a structured way to analyze strategic interaction. If I know your options and your incentives, and you know mine, we can model the interaction and identify equilibrium outcomes: stable states where neither player benefits from changing strategy.

This toolkit dominated Cold War strategic thinking for good reason. The U.S.-Soviet confrontation had the properties that game theory requires: two primary players, relatively stable preference orderings (both preferred survival to annihilation), shared information about capabilities (nuclear arsenals are hard to hide), and a closed system (the two superpowers were the game). Deterrence theory, mutually assured destruction, escalation ladders, arms control frameworks: all of these are game-theoretic constructs, and they worked. The Cold War ended without nuclear exchange.

The toolkit also reshaped business strategy. Michael Porter's five forces model, auction theory, competitive dynamics frameworks: all are built on game-theoretic foundations. In boardrooms and business schools around the world, strategic planning is taught as a process of modeling competitors, anticipating their moves, and optimizing your response.

The problem is not that game theory is wrong. Within its domain, it remains powerful. The problem is that the scenarios now threatening organizations and institutions have migrated outside that domain, and the toolkit is following them there uninvited.

Game theory requires five foundational assumptions. Each one is failing in today's operating environment.

Assumption 1: Rational actors. Game theory models players as rational optimizers: agents who assess their options, evaluate probable outcomes, and choose the strategy that maximizes their expected utility. This is a useful simplification when players are, in fact, making deliberate, calculated choices.

But a regime under simultaneous external bombardment, internal protest, possible leadership decapitation, and communications blackout is not a rational unitary optimizer. Its decision-making is fragmented. Information flows are degraded. Multiple centers of authority may be issuing contradictory orders. The emotional and cognitive dynamics of existential threat, what behavioral economists call "hot state" decision-making, produce choices that no rational-actor model predicts.

This is not unique to Iran in February 2026. It describes any organization or institution in crisis: a company facing simultaneous cyberattack and regulatory investigation, a government managing a pandemic while an election is contested, a financial system experiencing correlated failures across multiple asset classes. The rational-actor assumption fails precisely when the stakes are highest.

Assumption 2: Stable preferences. Game theory requires that players have well-defined, consistent preference orderings. Player A prefers outcome X to outcome Y, and that preference holds throughout the game.

Preferences destabilize under stress. A regime that preferred cautious deterrence last month may prefer maximum retaliation today, not because its long-term interests changed, but because its time horizon collapsed. A CEO who preferred gradual market expansion in Q3 may prefer radical cost-cutting in Q4 after a supply chain shock. Prospect theory, developed by Daniel Kahneman and Amos Tversky, demonstrated that humans systematically shift their risk preferences depending on whether they perceive themselves as operating in the domain of gains or losses. In the domain of losses, and especially perceived existential losses, risk-seeking behavior increases dramatically. When the framing shifts from "how do we optimize?" to "how do we survive?", the preference ordering that game theory relied on no longer applies.

Assumption 3: Shared, reliable information. Game theory comes in flavors: perfect information (both players see the board, as in chess), imperfect information (players have private information, as in poker), and incomplete information (players are uncertain about each other's type or preferences). All of these assume that the information players do have is fundamentally reliable.

Today's operating environment features something worse than imperfect or incomplete information: corrupted information. Cyber operations degrade communications. Disinformation campaigns pollute the information space. During the February 28 strikes, Israel drove Iran's internet connectivity to 4% of normal traffic. Iranian decision-makers were not operating with imperfect information. They were operating in a communications blackout, unsure which of their own systems were functioning, which commanders were alive, and what was happening across their own territory. This is not a game-theoretic problem. This is fog, and game theory has no fog variable.

Assumption 4: Bounded, identifiable players. Classical game theory handles two players elegantly. Three players with difficulty. The mathematical complexity scales poorly. Most applied game theory simplifies multi-player situations by identifying the "key" players and modeling bilateral interactions.

The Iran scenario on February 28 involved the United States, Israel, Iran, the IRGC (which operates with partial autonomy from the civilian government), proxy networks in Iraq, Yemen, and elsewhere, six Gulf states that were pulled into the conflict involuntarily, global energy markets, shipping companies making independent risk decisions, insurers adjusting war-risk premiums, Congress debating war powers, and millions of Iranian civilians whose behavior (protest or compliance) will shape the regime's survival. These are not spectators. They are active agents whose decisions interact with and reshape the strategic landscape in real time. No game-theoretic model captures this.

Assumption 5: Closed systems with defined rules. Games have rules. Chess pieces move in prescribed ways. Auction formats define what bids are permissible. The system is closed: nothing outside the game changes the game.

Strategic reality is an open system. Exogenous shocks arrive without warning. A strike intended to destroy missile infrastructure hits a girls' school. A cyberattack designed to blind military communications also shuts down civilian internet, changing the information environment for an entire population. A pandemic arrives in the middle of a trade war. Rules change: new doctrines are announced, alliances shift, technologies emerge. The system is not closed. It is permeable, adaptive, and constantly being reshaped by events that no player anticipated or controlled.

When all five assumptions fail simultaneously, what you have is not a difficult game. You have something that is not a game at all. And analyzing it with game-theoretic tools does not produce insight. It produces assumptions dressed up as analysis.

The deeper issue is a distinction that economist Frank Knight made in 1921, one that remains underappreciated a century later.

Risk is a situation where you can identify the possible outcomes and assign probabilities to them. You might not know which outcome will occur, but you know the menu and the odds. A coin flip is risk. A poker hand is risk. A well-modeled insurance portfolio is risk.

Uncertainty is a situation where you cannot identify all possible outcomes, cannot assign reliable probabilities, or both. You do not know the menu. You do not know the odds. You may not even know that you do not know.

Game theory is a tool for risk. It operates within defined possibility spaces with assignable (if sometimes subjective) probabilities. It is spectacularly good at optimizing within those spaces. AlphaZero, DeepMind's chess and Go engine, is the ultimate expression of this: given a perfectly defined game with complete rules, it finds strategies that surpass any human player.

The scenarios that actually threaten organizations, industries, and nations are increasingly characterized by uncertainty, not risk. The range of possible outcomes is not known in advance. The probabilities are not assignable. The system dynamics produce emergent behaviors that were not in any player's strategy set.

The 2008 financial crisis was treated as a risk problem. The models assigned probabilities to default rates, correlation structures, and loss distributions. The models were precise. They were also wrong, not because the math was bad, but because the underlying assumption, that the possibility space was known and the probability distributions were stable, was an assumption dressed up as analysis. The actual outcome was outside the modeled distribution entirely.

The COVID-19 pandemic was treated as a risk problem by organizations that had pandemic plans. Those plans assumed specific parameters: transmission rates, mortality rates, durations. The actual pandemic violated those parameters in ways that cascaded through supply chains, labor markets, and institutional capacity in combinations that no plan anticipated.

The Iran escalation was treated as a risk problem by markets that priced a temporary oil spike and went home for the weekend. The actual scenario, simultaneous retaliation against six countries, de facto Strait closure, communications blackout, potential leadership decapitation, and a stated objective of regime change with no defined endpoint, was not in the priced distribution.

In each case, the failure was the same: applying risk tools to uncertainty problems, and mistaking the precision of the output for the reliability of the analysis.

If game theory is insufficient, what frameworks better serve an environment defined by uncertainty, complexity, and correlated multi-domain disruption?

The answer is not a single replacement. It is a toolkit of complementary approaches, each addressing a specific failure of the game-theoretic model.

Complexity theory addresses the failure of the closed-system assumption. Emerging from the Santa Fe Institute and the work of Stuart Kauffman, John Holland, and W. Brian Arthur, complex adaptive systems theory studies environments with many interacting agents, feedback loops, and nonlinear dynamics. The core insight: in complex systems, the behavior of the whole cannot be predicted by understanding the individual parts. The system produces emergent outcomes that no single agent intended or controls.

This is what the portfolio-of-risks analysis in The Paranoidist's Flash Issue #1 was doing, even without the label. Rather than modeling what any single player would do, it assessed the system: five concurrent escalation vectors, correlated through a shared decision calculus, producing a system-level probability of containment failure that was dramatically higher than any individual vector suggested. That is a complexity argument, not a game-theoretic one. Game theory asks "what will Iran do?" Complexity theory asks "what does the system do when you perturb it?"

Complexity theory is better at explaining why prediction fails than at providing specific predictions. For decision-makers, that is actually useful: it tells you which variables matter, where the system is fragile, and why tail risks are underpriced. It does not tell you which tail materializes. That honesty is an upgrade from the false precision of game-theoretic equilibria.

Scenario planning addresses the failure of the stable-preferences and perfect-information assumptions. Developed by Peter Schwartz, Pierre Wack, and the Royal Dutch Shell planning team in the 1970s, scenario planning builds multiple plausible futures, not to predict which one occurs, but to stress-test your strategy against all of them.

Shell famously used this method to prepare for the 1973 oil shock before it happened. They did not predict the shock. They asked "what if?" and discovered that their strategy was fragile against a scenario that their conventional models treated as implausible. When the shock arrived, Shell was the only major oil company that had a playbook.

The discipline of scenario planning is to identify the assumptions your current strategy depends on and then construct scenarios in which those assumptions fail. This is the opposite of game-theoretic optimization, which takes assumptions as given and optimizes within them. Scenario planning attacks the assumptions themselves.

Behavioral economics addresses the failure of the rational-actor assumption. Kahneman and Tversky demonstrated that humans deviate from rational optimization in predictable, systematic ways. Two findings are especially relevant in the current environment.

Loss aversion is asymmetric: people and institutions will take far greater risks to avoid losses than to achieve equivalent gains. A regime fighting for survival takes risks that no rational-actor model predicts. A company facing potential bankruptcy makes decisions that its Q3 strategic plan never contemplated. When the stakes shift from optimization to survival, the entire decision calculus changes.

Framing effects alter decisions even when the objective situation is identical. The same military action, framed as "liberation" by one side and "aggression" by the other, produces different cognitive and emotional responses that shape real decisions. These are not irrational responses. They are human responses, and any framework that ignores them is modeling a species that does not exist.

Network theory addresses the failure of the bounded-players assumption. Rather than modeling bilateral interactions between identified players, network theory studies how the structure of connections between nodes determines the behavior and resilience of the system.

The key insight: networks with highly connected hubs are robust against random failures but catastrophically fragile against targeted attacks on those hubs. This maps directly to supply chain risk (remove a critical supplier node and failures cascade), cyber risk (attack the hub and the network degrades), infrastructure risk (the Strait of Hormuz is a network chokepoint for 20% of global oil), and institutional risk (CISA was a hub in the national cyber defense network; during the DHS shutdown it was operating at 38% capacity when the Iran crisis arrived).

When you analyze a situation through a game-theory lens, you see players making moves. When you analyze it through a network-theory lens, you see structural vulnerabilities that no player's strategy accounts for. Both are real. Only one is visible through the game-theory lens.

Normal accidents theory and High Reliability Organization theory address the failure of the closed-system assumption from a different angle than complexity theory. Charles Perrow's "Normal Accidents" (1984) argues that in tightly coupled, complex systems, catastrophic failures are not anomalies. They are inevitable features of the system's architecture. The interactions between components are too numerous and too nonlinear for anyone to anticipate all failure modes. The question is not whether the system fails. It is when.

This is close to The Paranoidist's founding thesis. Issue #1 examined the structural mismatch between the complexity of the systems we are building and the capacity of institutions to manage crises. Flash Issues #1 and #2 demonstrated that mismatch in real time: a military operation that activated more escalation vectors, faster, than any containment framework could manage.

The complementary tradition, High Reliability Organization theory from Karl Weick and Kathleen Sutcliffe, studies organizations that operate in high-risk environments and manage to avoid normal accidents: aircraft carriers, nuclear power plants, air traffic control. These organizations share five characteristics: preoccupation with failure (they expect things to go wrong), reluctance to simplify (they resist reducing complex situations to simple narratives), sensitivity to operations (they pay attention to the front lines, not just the models), commitment to resilience (they plan for recovery, not just prevention), and deference to expertise (in a crisis, decisions are made by the people closest to the problem, not the people highest in the hierarchy).

For the risk leaders and board directors in this audience, HRO theory is not just descriptive. It is prescriptive. Organizations that adopt these five principles navigate uncertainty better than organizations that optimize around game-theoretic models. The question is whether your organization operates like an aircraft carrier or like a chess player.

Antifragility, Nassim Nicholas Taleb's framework, addresses a question that none of the other frameworks ask: can you benefit from disorder rather than merely survive it?

Taleb distinguishes between fragile systems (harmed by volatility and shocks), robust systems (unaffected by them), and antifragile systems (strengthened by them). Most organizational risk management aims for robustness: withstand the shock and return to normal. Taleb argues that in an environment of increasing volatility and uncertainty, robustness is not enough. The strategic goal should be to position yourself so that disorder, which is coming regardless, works in your favor.

This reframes the conversation for senior leaders. The question is not just "how do we protect against the downside?" It is "how do we build an organization that gets stronger when the environment gets more chaotic?" That is a fundamentally different strategic conversation than anything game theory offers.

This brings us to the question I hear most often from the executives and board members I work with: can AI solve this? Is there a DeepMind for strategic planning?

The honest answer is: not in the way most people mean when they ask the question. And understanding why reveals something important about both AI's capabilities and the nature of the problems we face.

AlphaZero, DeepMind's engine that achieved superhuman performance in chess and Go, works because those games have specific properties: perfect information (both players see the entire board), fixed rules (the rules do not change mid-game), two players, zero-sum outcomes, and a closed system. These are the same properties that make game theory work. AlphaZero is, in a sense, the ultimate game-theoretic optimizer: given a perfectly defined possibility space, it explores that space more thoroughly than any human can and finds strategies that no human ever discovered.

The strategic environment has none of these properties. The information is imperfect and corrupted. The rules change. The players are numerous and their boundaries are blurry. The outcomes are not zero-sum. The system is open. AlphaZero is a spectacular tool for risk problems. It has nothing meaningful to contribute to uncertainty problems.

But that is not the end of the AI story. It is the beginning.

The current generation of large language models and multi-modal AI systems are not game-theoretic optimizers. They are pattern recognizers and synthesizers operating across enormous information spaces. They do not solve for Nash equilibria. They identify connections between domains, surface historical analogies, stress-test narratives against large bodies of evidence, and generate scenarios faster than any human team can.

Consider what The Paranoidist did in Flash Issue #1. The analysis synthesized information across energy markets, military doctrine, cyber capabilities, proxy network structures, shipping logistics, and insurance risk pricing to identify a portfolio of correlated risks that the conventional analysis was treating in silos. That cross-domain synthesis, done in hours rather than weeks, is something AI enables. It is not optimization. It is augmented sense-making.

There are frontier AI approaches moving beyond the chess paradigm that are worth watching:

Multi-agent simulation, where thousands of scenarios are run with heterogeneous agents operating under imperfect information and adaptive strategies, produces distributions of outcomes rather than point predictions. This is essentially computational scenario planning. It does not tell you "the answer." It helps you understand which variables matter most and where the system is fragile. Some defense planning groups and sophisticated financial institutions are using early versions of this.

Reinforcement learning in open-ended environments, where the rules and objectives evolve during training, is an active area of research. DeepMind's own work has moved in this direction. The question is whether you can train agents that develop robust strategies in environments characterized by genuine uncertainty. The honest assessment: we are not there yet, and meaningful progress is likely years away.

"World models," AI systems with genuine causal understanding of how the world works rather than just pattern recognition, represent the most ambitious frontier. If achieved, such systems could bridge the gap between game-theoretic optimization and complexity-informed analysis. But we are early in that journey.

The practical takeaway for today's decision-makers is this: the AI that helps you navigate uncertainty is not an oracle that tells you what will happen. It is a thinking partner that helps you stress-test your assumptions faster, across more variables and more domains, than your team can manage alone. The human in the loop, the one with judgment, experience, domain knowledge, and the productive paranoia to ask "what if we are wrong?", is not optional. They are the critical component.

If your organization is waiting for an AI that "solves" strategic planning the way AlphaZero solved chess, you will be waiting forever. Not because AI is not powerful, but because the strategic environment is not a chess board. It is an open, multi-player, multi-domain, uncertainty-dominated landscape where the rules change, the players fragment, the information degrades, and the outcomes include possibilities that were not in anyone's model. No algorithm optimizes that. What you need instead is a better toolkit for navigating it, augmented by AI that accelerates the human judgment at the center of the process.

If you are a board director: Ask your management team a simple question at the next meeting: "What are the three largest assumptions embedded in our current strategic plan, and what happens to the plan if each one is wrong?" If the answer comes back as a set of probability-weighted scenarios with precise numbers, you are looking at assumptions dressed up as analysis. The scenarios that threaten your organization are the ones outside the modeled distribution. Push for scenario planning that explicitly constructs futures in which the plan's foundational assumptions fail. And ask whether your organization's crisis management operates on HRO principles (preoccupation with failure, deference to expertise in the moment) or on hierarchical command-and-control that worked in stable environments but breaks under genuine uncertainty.

If you are a CRO or risk leader: Audit your risk framework for game-theoretic assumptions you may not realize are there. If your models assume rational counterparties, stable correlations, or bounded disruption durations, those assumptions are embedded, not explicit. They were inherited from the toolkit, not chosen deliberately. Build a parallel assessment process: for your top five risks, construct the correlated scenario where multiple risks materialize simultaneously (not sequentially), where the actors involved behave in loss-averse rather than rationally optimizing ways, and where the duration is twice what your models assume. If that exercise produces results that differ dramatically from your current risk register, the risk register is the problem, not the exercise. And assess your organization's network vulnerabilities: where are the hubs whose failure cascades through the system? The Strait of Hormuz was the global energy network's hub vulnerability. What is yours?

If you are a CEO or founder: The strategic planning process at most companies is implicitly game-theoretic: model the competition, anticipate their moves, optimize your position. That process works in stable, well-understood competitive environments. It fails in environments characterized by the kind of multi-domain uncertainty we are now living through. Supplement (do not replace) your competitive strategy with a resilience strategy: what are the structural vulnerabilities in your business model, supply chain, and infrastructure that could be exposed by correlated shocks? And ask yourself the antifragility question: is there a way to position your organization so that increasing disorder in the environment works in your favor rather than against it? The companies that emerge stronger from volatile periods are not the ones with the best game-theoretic models. They are the ones that built adaptive capacity before they needed it.

If you are a citizen and a thinker: When you hear an analyst, a commentator, or a policymaker say that an adversary "will" do something because it is "rational" or in their "interest," you are hearing a game-theoretic assumption presented as a prediction. Ask what happens if the actor is not rational in the way the model requires. Ask what happens if their preferences have shifted under stress. Ask what happens if the information they are working with is degraded or corrupted. Ask what happens if the system produces an outcome that no single player intended. These are not exotic scenarios. They are the normal condition of the world we now inhabit. The assumption that strategic actors behave like chess players on a well-defined board is comforting. It is also, increasingly, wrong. The scenarios that surprise us are the ones where the assumptions fail, and the first step in preparing for them is recognizing the assumptions for what they are.

Game theory remains a useful tool for well-defined competitive interactions with identifiable players, stable rules, and reliable information. These situations still exist. They are not the ones keeping risk leaders awake at night.

The scenarios that threaten organizations and institutions today, geopolitical confrontations that escalate across multiple domains simultaneously, cyber campaigns against critical infrastructure, supply chain cascades triggered by correlated shocks, AI-driven disruptions that reshape competitive landscapes faster than strategic plans can adapt, share a common feature: they operate outside the assumptions that game theory requires.

The alternative is not a single replacement framework. It is a toolkit: complexity theory for understanding system dynamics, scenario planning for stress-testing assumptions, behavioral economics for understanding real (not modeled) decision-making, network theory for identifying structural vulnerabilities, normal accidents and HRO theory for building resilient organizations, and antifragility for turning volatility into advantage. AI augments this toolkit not as an oracle but as an accelerant for the human judgment at the center of the process.

The phrase that should stay with you from this issue is this: every time you see a precise, confident strategic analysis, ask what assumptions it depends on. If those assumptions are not stated explicitly, they are embedded invisibly. And embedded, unstated assumptions are the most dangerous kind, because they feel like facts rather than choices. They are assumptions dressed up as analysis.

Productive paranoia does not mean predicting catastrophe. It means identifying the assumption everyone is relying on and asking: what if it is wrong? The Paranoidist exists to ask that question. This issue is about recognizing that the most widely relied-upon assumption in strategic analysis, that the world behaves like a game with rules, rational players, and calculable outcomes, is itself the assumption most in need of stress-testing.

The Paranoidist publishes weekly, with flash issues when events warrant. If this changed how you think about one thing, consider subscribing. If it didn't, tell me what I'm missing.

Paul Morin is the founder of DeepStrategy.ai and publisher of The Paranoidist, BoardroomRadar and ScenarioWatch. He has spent more than three decades in entrepreneurship, finance, risk management, and insurance, which is why he worries about the things that keep other people awake at night.

Researched, written, and edited in collaboration with Claude by Anthropic.