The Math You Can’t Beat#

I’ve had this conversation maybe a hundred times. Maybe more. It always happens the same way — somebody who’s never worked a security detail catches me after a news cycle. A bombing at a marathon. A shooter in a shopping mall. A truck plowing through a holiday parade. They lean in and ask: “How do we stop this?”

And I can see it in their faces. They want a real answer. A blueprint. Some kind of master plan that makes the chaos make sense again.

I wish to God I had one.

But the truth — the truth that nobody on Capitol Hill has the guts to say on camera — is that you can’t. You can’t stop all of it. Not completely. Not now, not ever. And it’s not because we’re stupid. It’s not because we’re underfunded. It’s not because some politician dropped the ball. It’s because of math. Cold, merciless, unforgiving math.

I learned this one the hard way, standing post for the President of the United States. We hardened the White House until it was a fortress. We locked down Air Force One. We swept every motorcade route, every hotel suite, every stage where he’d stand behind a podium. We did it with a kind of obsessive, grinding paranoia that would wear most people down to nothing. And we were good at it. Damn good.

But here’s what ate at me every single night: every time we turned one target into a vault, we knew — every agent on the detail knew — that we’d just pushed the crosshairs somewhere else. We weren’t killing the threat. We were just shuffling it around like a shell game.

That’s the ugly truth sitting at the center of everything we do in this business, and nobody wants to hear it: the guy trying to hurt you only has to get lucky once. You have to be perfect every single time.

Let me spell this out so there’s no room for misunderstanding.

Defense costs scale with the number of things you’re trying to protect. Every shopping mall. Every elementary school. Every subway platform. Every outdoor concert. Every marathon finish line. Every Fourth of July parade where families spread blankets on the grass. Security people call these “soft targets” — places where crowds gather out in the open, where there’s no metal detector, no checkpoint, no blast wall. Places built for people to enjoy themselves, not to survive an attack.

Now try counting them. Not just in your town. Across the whole country. How many soft targets exist in America on any given Tuesday afternoon? Thousands? Tens of thousands? The real number is so big it might as well be infinite. Every park bench, every food court, every street fair — they’re all on the list.

Defending all of them at the same time? That’s a bill nobody can pay. You’d need an armed agent at every door of every public space. Cameras on every lamppost. A tactical team staged within sprinting distance of every gathering of more than fifty people. The budget would swallow the Pentagon whole and still come back hungry. And even then — even if you built that surveillance nightmare from coast to coast — you’d still have gaps. Because the attacker picks when. The attacker picks where. The attacker picks how. The defender just has to stand there and try to cover everything, all at once, forever.

The attacker’s overhead? Drive around. Find the softest spot. That’s the whole operation. One afternoon with a pair of sunglasses and a cup of coffee.

This isn’t a gap you can throw money at. It’s a law of nature.

This asymmetry doesn’t just create one problem. It triggers a chain reaction that most people — and I mean most of the people making policy in this country — haven’t thought through nearly hard enough.

The Resource Dilution Effect. Every dollar you spend locking down Target A is a dollar you didn’t spend on Target B. After 9/11, we dumped a mountain of money into airport security. Massive investment. And sure, airports got harder to hit. But did the country get safer? Not really. The total risk didn’t shrink — it just slid sideways. It drained toward the places with the thinnest protection, which is exactly where any halfway rational attacker is going to look next.

I watched it happen with my own eyes. After we poured resources into federal buildings in D.C., the threat assessments started lighting up around all the unprotected space nearby — the parks across the street, the Metro stations a block away, the sandwich shops where staffers grabbed lunch. We’d built ourselves a beautiful castle. And we’d surrounded it with a field of sitting ducks. The castle was tougher to crack, no question. But the ducks were more exposed than ever, because the money that could have shielded them was locked inside the castle walls.

The Target Displacement Effect. This one drives security professionals absolutely crazy. You harden one target, and the threat just migrates to the next one down the list. Lock down the airports, and the bad guys look at train stations. Fortify the train stations, and they eye the bus depots. Secure the bus depots, and they pivot to open-air markets. It’s the most terrifying game of whack-a-mole ever invented, and the moles are a hell of a lot smarter than the hammer.

What this means in practice is that the big security “wins” — the ones that politicians love to hold press conferences about — are often mirages. Yeah, you made this one building harder to attack. Congratulations. But you didn’t make the threat smaller. You just gave it a new zip code. The attacker didn’t pack up and go home. He recalculated.

We saw the target displacement effect play out in real time at the 2026 White House Correspondents’ Dinner. As CNN reported, 2,600 people were packed into the Washington Hilton ballroom — with the president, vice president, and House speaker all sitting at the head table. An extreme concentration of high-value targets in a single soft target venue. The Secret Service had hardened the event with magnetometers, credential checks, and multi-layered response teams. But the suspect exploited his status as a hotel guest to remain inside the security bubble, then charged past a checkpoint carrying a shotgun. The hardened perimeter didn’t eliminate the threat. It just shifted the point of attack to the seam between “hotel guest” and “event attendee” — a gap nobody had fully sealed.

The Psychological Asymmetry Effect. The defender has to win every single engagement. The attacker only has to win once. Sit with that for a second. Think about what that does to the people standing on the wall year after year. It creates a permanent feeling of “not enough.” You can harden a thousand targets. You can stop a hundred plots. You can throw every resource you’ve got at the problem — and you still know, bone-deep, that you’re exposed somewhere. That knowledge corrodes you from the inside. Over time, it pushes defenders toward one of two bad places: either you go overboard — throwing money at security theater, building elaborate rituals that look impressive but don’t actually change the math — or you burn out. You hit a wall where the exhaustion wins and you start thinking, “We do what we can,” and you stop believing you’ll ever get ahead of it.

I’ve watched both happen. The TSA checkpoint is the poster child for the first one — billions spent on a visible performance that catches contraband but barely dents the fundamental problem. The burnout? That’s what I started seeing in some corners of the government toward the tail end of my career. A tired shrug. A quiet acceptance that the next successful attack wasn’t a question of if. Just when.

So if the math can’t be beaten, why bother? Why pour your life into a fight you know you can’t win?

Because the play isn’t to beat the math. The play is to ask a completely different question.

The old-school security model asks: “How do we stop every attack?” That’s the prediction game — the rearview-mirror thinking I talked about before. It sounds great in a campaign speech. It polls well. And it is flat-out impossible when you’re talking about soft targets. You cannot prevent every attack on every undefended space in a free country. Period. End of discussion.

The Institutional Immune System flips the script entirely: “When we take a hit — and we will take hits — how fast do we get back on our feet?”

That’s the pivot from trying to build an impenetrable wall to building something that can absorb a punch and keep standing. And before anyone calls that giving up — it’s not. It’s growing up. Your immune system doesn’t pretend it can block every virus that walks through the door. What it does is invest in three things that matter a whole lot more than a fantasy of perfect prevention:

Rapid detection. The faster you know something’s happening, the faster you can move. Seconds aren’t a luxury — they’re the difference between casualties and a body count. That means real-time awareness on the ground. Communication systems that don’t choke when everyone hits the radio at once. First responders who can act on their own judgment without waiting for sign-off from seventeen layers of bureaucratic approval.

Damage containment. When the breach comes — and it will come — how do you keep it from spreading? How do you wall off the blast zone, shield the areas around it, and keep the rest of the system running even with a hole punched through it? Think about watertight compartments on a warship. You accept that a torpedo might flood one section. But you build the ship so that one flooded compartment doesn’t drag the whole vessel to the bottom.

Fast recovery. How quickly does the hit zone bounce back? Not just the buildings and the infrastructure — the people. A community that picks itself up in days instead of months robs the attacker of the one thing they really wanted: lasting fear. Recovery speed is its own kind of armor, because it tanks the attacker’s return on investment. You hit us, and we’re back open for business before the news cycle ends. That’s a message that hits harder than any checkpoint.

Let me be dead clear about one thing: I’m not telling anyone to stop trying to prevent attacks. Prevention saves lives. Every conspiracy busted, every threat neutralized before it goes hot, every target we make harder to hit — that’s real work, and it matters. I spent my whole career doing it, and I’d do it again tomorrow.

But prevention by itself is a losing hand when you’re playing against soft targets. The math won’t let you win that way. Any security strategy built on the fairy tale of stopping everything is a house built on sand, and the tide’s already coming in.

And here’s the part that should keep every policymaker awake at night: the legal framework isn’t even keeping up with the math we already can’t beat. In April 2026, a federal appeals court overturned the terrorism conviction of the 2017 New York City subway bomber — a man who detonated a pipe bomb in a crowded Manhattan transit station, the textbook definition of a soft target attack. The court ruled that “lone wolf” attackers inspired by propaganda but acting independently cannot be convicted of providing material support to terrorist organizations. Think about what that means for deterrence. The math already favors the attacker. Now the legal system is telling a certain category of attackers that even if they strike and survive, the heaviest charges might not stick. That’s not closing the gap. That’s widening it.

The conversation nobody in Washington wants to have — because it doesn’t fit on a yard sign or a cable news chyron — goes like this: we live in an open country. That openness is the best thing about us and the most dangerous thing about us, all at the same time. You can’t seal every crack without sealing the country shut. And a country that’s sealed shut isn’t worth a damn.

So we protect what we can. We fortify what we have to. And we build the toughness to take the punches that are going to land no matter what we do. Not because we quit. Because we wised up. Because we looked the math in the face and accepted that perfect security is a fantasy — and that real strength was never about whether you get knocked down. It’s about how fast you’re standing again.

That’s the math you can’t beat. But it’s the math you can live with — long as you’ve got the nerve to look it in the eye.