You can also think of risk slightly differently as a mathematical equation ... That mathematical equation is: What is the threat, and what is your vulnerability to that threat? And literally, it's threat times vulnerability equals your risk.

The idea that we want to mitigate risk to zero before we act is really common and really costly.

Of course, we all know that not making or delaying a decision is a decision in itself and carries its own risks.

When COVID-19 arrived, what did we do globally? We acted as individual nations. What did we do nationally? We froze to a great degree at the national level for a period ... Then, we executed, at least on the state level, but I could argue we were even more atomized than that. In many cases, we operated at a municipal level—and no organization, at that level, has the resources or the ability to effectively fight a pandemic by itself ... It actually has to be a globally united effort.

One of the things that's so toxic about our information ecosystem right now is that because everyone can essentially silo themselves without even knowing they're doing it—everyone can create enough of an echo chamber based on the kind of news they like to hear, it seems that many people become unreachable.

I came to the conclusion that the greatest risk that we face is, in fact, us. If we're worried about the risks in the world, we should go look in the mirror because most of the other risks we can't do anything about; they are external risks that will inevitably emerge. They will be impossible to predict with great clarity ... But we can absolutely be confident that they will show up, and they will impact us.

A huge cybersecurity challenge is inevitable. It's not possible; it is inevitable. And when I talk about huge, I'm not talking about Target having some customer data exposed; I'm talking about things that we rely on stopping for at least a period—maybe it's banking, maybe it's our energy distribution, things like that. I think it's absolutely inevitable that that will happen.

As long as the American government and society are working, we will get dinged up with threats that will come, but we will always be able to respond. When the system isn’t working, I think we are fundamentally vulnerable to COVID-19, or to potential foreign aggression, or to terrorism, cybersecurity, you pick any number of threats.

If you only hear what you already believe or if you protect yourself from the offensive words of somebody who violates your safe space, then I think you are making yourself more vulnerable over time.

I personally don't believe that Afghanistan, in what we tried after 2001, was impossible. I don't believe that the Taliban were 10 feet tall. I've seen too many up close to believe that. What I believe is, in fact, many of the things that failed us was us. It was our weaknesses in putting together a coherent, well-coordinated effort over time.

If we look at the United States as the pandemic started to appear... our first response was not to be as candid with the American people as we should have been.

When you lose confidence that society is going to work in your favor—that law & order and supply chains are going to work, then people become incentivized to do what's best for them because the good of society no longer applies.

When we are ignorant, we are vulnerable. When we are ignorant as a society, we are societally vulnerable.