Norbert Wiener: His Ideas on Cybernetics and What Still Holds Up Today

In 1948, computers were enormous, expensive machines, the internet didn't exist, and the idea of cybersecurity as a profession was still decades away. That year, an American mathematician named Norbert Wiener published a book with a rather intimidating title: Cybernetics: Or Control and Communication in the Animal and the Machine.¹

It wasn't about hackers, viruses or protecting computer networks. Those weren't the problems Wiener was trying to solve. Instead, he wanted to understand how machines and living organisms use information to respond to the world around them.

It might sound like an unlikely starting point for a conversation about modern cybersecurity, but Wiener's work introduced ideas about information, feedback and control that remain relevant to the systems cybersecurity professionals are trying to protect.

He also had some rather uncomfortable things to say about the relationship between humans and technology.

Born in 1894 in Columbia, Missouri, Wiener was an extraordinary child. He entered Tufts College at just 11 years old and completed his doctorate at Harvard when he was 18.² He later became a professor at the Massachusetts Institute of Technology, where much of his most influential work took place.

His interests were unusually broad, ranging from mathematics and engineering to biology, philosophy and the social consequences of technology. During the Second World War, he worked on mathematical problems associated with anti-aircraft fire control, particularly the challenge of predicting the movements of an aircraft so that a weapon could be aimed at where the target would be rather than where it had been.

That work helped shape his interest in feedback systems: mechanisms that continuously use information about their performance to make adjustments.

A familiar example is a thermostat. It measures the temperature, compares it with a desired setting and switches the heating on or off. The resulting temperature change is measured again, allowing the system to continue correcting itself.

Wiener recognised that comparable principles could be used to understand machines, biological organisms and certain aspects of human behaviour. He brought these ideas together under the name cybernetics, drawing on the Greek word associated with steering or governing.

The word would eventually become part of the vocabulary from which modern uses of cyber developed. But Wiener did not invent cybersecurity, nor was he attempting to establish it as a discipline.

What he was doing was asking how systems behave when information is used to guide their actions.

And that question has never really gone away.

Consider industrial control systems, for example. Electricity networks, manufacturing plants and water treatment facilities depend on sensors, controllers and automated processes to keep equipment operating within acceptable limits.

The engineering principles behind these systems have clear connections to the study of feedback and control. Cybersecurity introduces another problem: what happens when somebody deliberately interferes with the information those systems receive?

A compromised sensor might report an incorrect temperature. A manipulated controller might issue an unsafe instruction. A malicious actor might interfere with the communications connecting different components.

The attacker is exploiting the system's dependence on information to make decisions.

Wiener wasn't describing industrial cyberattacks in 1948. But his framework helps explain why the integrity of information matters so much in systems that control physical processes.

His work also raises a question about trust. A feedback system can make perfectly logical adjustments based on the information available to it, yet still produce dangerous results if that information is inaccurate.

In cybersecurity, that distinction is fundamental. A system functioning exactly as designed is not necessarily a system functioning safely.

Wiener's interest in communication was equally important. His work explored the relationship between information, noise and the ability of systems to transmit meaningful signals reliably.

Modern cybersecurity professionals encounter related problems every day, although the circumstances are often quite different.

Data can be corrupted accidentally, altered maliciously or manipulated to mislead the systems and people relying on it. Maintaining its integrity is one of the central objectives of information security.

But there is an important distinction between Wiener's work and today's security practices. His mathematical treatment of communication was not a theory of malicious cyber threats. Noise in a communications system and a deliberate attempt to falsify information are not the same thing.

What remains relevant is the underlying dependence on reliable information.

If information is unreliable, the decisions made from it may be unreliable too.

That becomes particularly interesting when we look at artificial intelligence.

Wiener was writing about automation decades before modern machine learning, generative AI or autonomous software agents existed. Yet he was already concerned about machines taking on increasingly complex tasks and the consequences of allowing automated systems to influence human decisions.

In The Human Use of Human Beings, published in 1950, he expanded on the social implications of cybernetics, including the potential effects of automation on employment and human agency.

He understood that technology could improve human capabilities while also concentrating power or removing people from processes they once controlled.

Those concerns are recognisable today, particularly as organisations introduce AI systems capable of writing code, analysing threats, investigating incidents and carrying out actions across digital environments.

The cybersecurity industry is increasingly interested in how much autonomy such systems should have. Should an AI agent be allowed to make changes to a production environment? Can it isolate a compromised machine without human approval? What happens when it makes a mistake, or when somebody manipulates the information it uses?

Wiener did not provide answers to those specific questions. But his work encourages us to examine the relationship between information, automated decisions and human oversight.

It also reminds us that automation is not simply a question of technical capability.

A machine might be able to perform a task, but that doesn't automatically mean it should be given unrestricted authority to perform it.

That is an especially relevant distinction in cybersecurity, where a poorly configured automated response can sometimes cause as much disruption as the incident it was intended to contain.

Wiener's thinking also developed in response to the military applications of technology.

Having contributed to wartime research, he became increasingly concerned about the uses to which scientific discoveries could be put. In January 1947, in an open letter published in The Atlantic Monthly, he refused a request from a researcher at an aircraft company for a copy of a wartime paper on controlled missiles, arguing that scientists had responsibilities concerning the consequences of their work.³

This was not a cybersecurity debate, but it was an early example of a scientist challenging the assumption that technical knowledge should be supplied without considering how it might be used.

The question has obvious parallels with contemporary discussions about offensive security research, vulnerability disclosure, surveillance technologies and AI-enabled weapons.

Security researchers regularly face decisions about whether to publish technical findings, how to disclose vulnerabilities and what responsibilities accompany the development of powerful tools.

Wiener's position was shaped by the circumstances of his own time, particularly the aftermath of the Second World War. It would be inaccurate to present him as having anticipated modern vulnerability disclosure policies or responsible security research frameworks.

Nevertheless, his insistence that technical work carries social responsibilities remains worth examining.

Not everything about cybernetics has aged equally well.

One of the ambitions of the field was to identify common principles governing machines, animals and human organisations. That was intellectually exciting, but it also encouraged attempts to explain extraordinarily complicated biological and social phenomena through the language of systems and feedback.

Those comparisons can be useful, but they have limits.

A human organisation is not simply a machine with inputs and outputs. Human decisions are shaped by culture, institutions, politics, incentives and experiences that cannot always be reduced to a control problem.

Modern cybersecurity offers plenty of examples.

An organisation can have excellent technical controls and still suffer a breach because of poor management decisions, weak communication or conflicting priorities. Equally, treating employees as unreliable components in a technical system can overlook the conditions that shape how people actually behave.

Wiener's framework is valuable for understanding aspects of technical systems. It is less convincing when used as a complete explanation of human behaviour.

There is another limitation. Cybernetics helps us understand how systems regulate themselves, but it does not, by itself, provide the methods needed to defend those systems against determined adversaries.

Modern cybersecurity has developed its own disciplines, including cryptography, authentication, access control, secure software engineering, penetration testing and incident response.

These cannot simply be traced back to Wiener's 1948 book. Many have separate histories, and some were already developing before cybernetics emerged.

That matters because the history of cybersecurity is sometimes told as though it followed a neat path from one visionary thinker to today's industry.

It didn't.

Cybersecurity emerged through overlapping developments in computing, telecommunications, mathematics, military research, commercial technology and the growing need to protect information and systems from misuse.

Wiener was part of the wider intellectual history of computing and information, but he was not the founding father of everything that now carries the word cyber.

Perhaps the most interesting thing about revisiting his work is how familiar some of the underlying questions feel.

How do we know whether the information a system receives can be trusted? How should automated systems respond when conditions change? Who remains responsible when machines act on our behalf? And how do we ensure that technology serves human purposes rather than allowing technical capabilities to determine what happens next?

These are not all questions Wiener invented, and he certainly didn't answer them all.

But he helped establish a way of thinking about machines and information that continues to influence engineering and the study of complex systems.

For cybersecurity professionals, his legacy is therefore more interesting than a linguistic connection to the word cyber.

His work offers a reminder that the systems we protect do not operate in isolation. They receive information, make decisions, interact with people and increasingly affect the physical world.

Understanding those relationships is important, even when the practical tools we use to secure them have developed far beyond anything Wiener could have imagined.

Nearly eight decades after Cybernetics appeared, the technology has changed beyond recognition.

The questions about information, control and human responsibility have proved rather more persistent.