Deciding when defence in depth control strategies are necessary for risk management and crisis response

Defence in depth is a time-tested strategy in some technical fields, such as cybersecurity or nuclear reactor technology. In view of potentially devasting consequences of exponential growth, the implementation of such a strategy is almost self-evident in this case. Less obvious is a formal explanation of why and when such a control strategy is necessary compared to traditional risk management approaches and which systems or organisations can benefit from it. Quantitative arguments are given based on the properties of heavy tail stochastic variables. Particularly, their single big-jump property provides the rationale to require a hierarchy of barriers for containment of a cascade of daughter events. The COVID-19 pandemic has vividly demonstrated how difficult it is to implement an appropriate control strategy under these circumstances. Concretely, it is shown that the spread of transport vectors in this case has heavy tail properties and consequently requires a defence in depth response.