The New Normal Is Actually Very Normal: Punctuated Equilibrium, Security Cycle Theory, and the "New Normal"

Originally published on LevelBlue

In 2020, the world was hit with an unexpected pandemic that changed much of life as many had come to know it. Virtually overnight, masks were required, employees were working remotely, and businesses were locked down. The term "The New Normal" took center stage — suggesting life would be forever changed and humans would struggle to adapt. What actually occurred was neither "new" nor as unprecedented as it sounds.

Punctuated Equilibrium

Punctuated equilibrium is a theory originally developed by paleontologists to explain evolutionary biological change. It posits that systems generally remain static — characterized by long periods of stasis — and only change when punctuated by sudden disruptions in conditions. The theory has since been applied to political science, organizational theory, technological change, and corporate behavior.

History is replete with examples:

• The Black Death (14th Century) — Killed 25–40% of Europe's population, ended the Hundred Years' War truce, and dismantled the English Feudal system entirely.
• The assassination of Archduke Ferdinand (1914) — The proverbial straw that broke the camel's back, thrusting Europe into WWI and reshaping the entire world map.
• The sinking of the RMS Lusitania (1915) — 128 American deaths triggered a chain of events that brought the US into WWI in 1917.
• The fall of the Soviet Union (December 25, 1991) — Overnight dismantled the bi-polar Cold War structure and gave rise to a multi-polar world with new regional powers and rogue actors.
• September 11, 2001 — Permanently altered US defense policy, airport security, and the global posture toward terrorism. The effects are still felt today.

The Security Cycle Theory

The concept of threat adaptation is directly linked to security cycle theory:

1. A threat actor launches an attack.
2. Companies improve their security to address the new threat.
3. As defenses improve, threat actors adapt their tactics and techniques.
4. As threat actors improve capabilities, defenders must again update protections.
5. This cycle continues indefinitely — until a punctuating disruption resets the equilibrium.

The important implication: defense is always reactive by nature. Defenders cannot act until they know what they are defending against. The pandemic was exactly that kind of punctuating event — forcing tens of thousands of employees home overnight, introducing massive new attack surfaces before defenses could adapt.

What "The New Normal" Actually Means

According to the DHS Security Lexicon, Adaptive Threats are:

"...threats intentionally caused by humans...caused by people that can change their behavior or characteristics in reaction to prevention, protection, response, and recovery measures taken."

Criminals, being adaptive and rational actors, saw the pandemic-driven changes and updated their own behavior to exploit newly introduced vulnerabilities. This was not unprecedented behavior — it was the security cycle playing out exactly as it always has.

Conclusion

The "New Normal" is not new. It is punctuated equilibrium in action — a sudden disruption forcing rapid adaptation across organizations, governments, and adversaries alike. The organizations that will thrive are those that understand the cycle, invest in adaptive defenses, and resist the temptation to treat each disruption as a permanent catastrophe rather than a predictable phase in a recurring pattern.