What is the difference between a complicated system and a complex one, and why does cyber security architecture care?
Complicated = many parts, but defined causal links you could in principle follow; complex = tangled cause-and-effect, non-linear predictability and dynamic behaviour. Most real estates are both at once.
* Complicated yields to analysis; complex does not — and the two demand different work. *
| Complicated | Complex | |
|---|---|---|
| Cause and effect | Defined causal connections between elements | Unsurveyable cause-and-effect relationships |
| Predictability | In principle yes — follow the chain | Non-linear; small changes can have outsized effects |
| Behaviour over time | Static unless changed | Dynamic, changes by itself |
| What makes it hard | Size: the number of parts and relations | Nature: you cannot fully trace the interactions |
| The right response | Analysis, documentation, decomposition — understand it | Observation, experiment, small reversible steps, monitoring — cope with it |
A mechanical watch is complicated: hundreds of parts, every one of them deterministic, and a patient expert can explain every tick. A city's traffic is complex: the same road closure produces a different outcome on different days because the parts react to each other and to being observed.
Why the distinction earns its place: the two demand different work. For the complicated part of the estate, the payoff is documentation and structure — draw it, and it becomes tractable. For the complex part, the ambition to "fully understand it first" is a trap; you get further with observability, blast-radius limitation and changes you can undo. Treating a complex system as merely complicated produces confident plans that surprise you in production.
And most real-world situations are honestly both — a complicated estate (thousands of components with traceable connections) that behaves complexly (users, attackers, vendors and dependencies all reacting to each other).
Go deeper:
Wikipedia — Cynefin framework — the sense-making framework this distinction comes from, including what to do in each domain.